Hi Guys, I am running the latest version of ntop (3.0.052) on Redhat 9 (with latest o/s updates).
Ntop crashes without anything interesting in the logs... See last fews transactions... Jul 28 09:32:22 ntop named[2876]: lame server resolving '5.244.160.200.in-addr.arpa' (in '5.244.160.200.in-addr.arpa'?): 200.160.246.218#53 Jul 28 09:33:24 ntop ntop[2919]: [MSGID0825709] IDLE_PURGE: FINISHED selection, 27 [out of 531] hosts selected Jul 28 09:33:24 ntop ntop[2919]: [MSGID8477291] IDLE_PURGE: Device 0 [eth1]: 27 hosts deleted, elapsed time is 2.252347 seconds (0.083420 per host) Jul 28 09:34:14 ntop ntop[2919]: [MSGID8757584] OSFP: scanFingerprintLoop() checked 7, resolved 7 Jul 28 09:35:25 ntop ntop[2919]: [MSGID0825709] IDLE_PURGE: FINISHED selection, 15 [out of 531] hosts selected Jul 28 09:35:25 ntop ntop[2919]: [MSGID8477291] IDLE_PURGE: Device 0 [eth1]: 15 hosts deleted, elapsed time is 0.406120 seconds (0.027075 per host) Jul 28 09:36:45 ntop ntop[2919]: [MSGID8757584] OSFP: scanFingerprintLoop() checked 9, resolved 9 Jul 28 09:37:26 ntop ntop[2919]: [MSGID0825709] IDLE_PURGE: FINISHED selection, 47 [out of 545] hosts selected Jul 28 09:37:26 ntop kernel: device eth1 left promiscuous mode I am running ntop with the following command.. ntop -u ntop -i eth1 -m "172.16.0.0/12,10.0.0.0/8,192.168.0.0/16" -d -L -o -t5 Is there a known bug/fix? Regards, Glenn Elliott -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Wednesday, 28 July 2004 4:46 AM To: [EMAIL PROTECTED] Subject: Ntop Digest, Vol 2, Issue 30 Send Ntop mailing list submissions to [EMAIL PROTECTED] To subscribe or unsubscribe via the World Wide Web, visit http://listgateway.unipi.it/mailman/listinfo/ntop or, via email, send a message with subject or body 'help' to [EMAIL PROTECTED] You can reach the person managing the list at [EMAIL PROTECTED] When replying, please edit your Subject line so it is more specific than "Re: Contents of Ntop digest..." Today's Topics: 1. Re: A couple a basic NTOP questions (Chris Moore - GMD) 2. Re: sflow - update (Bret Jordan) 3. Re: A couple a basic NTOP questions (Spam) 4. RE: sflow - update (Burton M. Strauss III) ---------------------------------------------------------------------- Message: 1 Date: Tue, 27 Jul 2004 10:02:10 -0600 From: Chris Moore - GMD <[EMAIL PROTECTED]> Subject: Re: [Ntop] A couple a basic NTOP questions To: "'[EMAIL PROTECTED]'" <[EMAIL PROTECTED]> Message-ID: <[EMAIL PROTECTED]> Content-Type: text/plain; charset="iso-8859-1" You have to understand that this question gets asked at least twice a week on this list, and it is covered - at least a starting point - in the FAQ. So you haven't even read the documentation that's on your Ntop box. I'd suggest that you at least try to explore all the different pages served by the Ntop web server. You'll find all sorts of cool and helpful stuff. Click "about" in the top menu. Click the "?" with a circle around it (right next to the little icon that looks like a bug) in the secondary menu and then click the link under the FAQ title. Or you could just look in the docs directory and the FAQ is there. It is up-to-date as far as I know. You must understand that none of us get paid to help you (well, you CAN pay people like Burton to help you, but obviously you're not paying him now) so it is more than a bit annoying when people don't even attempt to help themselves before asking the list for help. And when people ask the same question every other day, I'm sure you can see where people might get a little short about it. -----Original Message----- Date: Tue, 27 Jul 2004 08:29:31 -0700 From: Andrew Davis <[EMAIL PROTECTED]> Subject: Re: [Ntop] A couple a basic NTOP questions To: "Burton M. Strauss III" <[EMAIL PROTECTED]> Cc: [EMAIL PROTECTED] Message-ID: <[EMAIL PROTECTED]> Content-Type: text/plain; charset=us-ascii; format=flowed You know, I can't count the number of lists where people reply with "read the docs". Funny, cause I always read them (if I can find them) before I post to a list. It was only *after* searching all over ntop.org and via google that I found some very dated (ver 2.x) info, but was able to get ntop up and running. What I was wondering about was storing the data... why it appeared to be lost after a reboot and if storing it in mysql was the only option. Of course, typical to most lists, no one can just "say, you can configure it to store the data, but you need mysql" or "no, you can't... a mysql db is the only". Had I received an answer like that, I could move on and know what direction to go. Instead, I'm told to read the docs (which I already have... those I could find anyway), that the docs are old and outdated (???), and to search the archives (which I have, but if any of you notice, when you go the page with the archives, there's no search option and heck if I want to download all the files, unpack them all, and then search them all). I wasn't asking for my hand to be held. I was asking a general question so I know which path to go down as I move forward, but as with most lists I got the typical RTFM, though in this case, with a follow-up that says, "oh, and TFM is out-dated". ------------------------------ Message: 2 Date: Tue, 27 Jul 2004 10:09:33 -0600 From: Bret Jordan <[EMAIL PROTECTED]> Subject: Re: [Ntop] sflow - update To: [EMAIL PROTECTED] Message-ID: <[EMAIL PROTECTED]> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Thanks I will try some of that.. You know, I might be able to give you access to one of my Opteron boxen for a few days if you wanted to play with this.. Bret Burton M. Strauss III wrote: >The Opterons are 64 bit, right? So the size of u_long (typedef >unsigned >long) depends on the processor. u_int32_t is a 32bit unsigned integer >across all platforms. And thus the u_int32_t change makes a lot of sense. > >Similarly, the definition of u_int (idx) is also OS dependent. > >unsigned short computeIdx(HostAddr *srcAddr, HostAddr *dstAddr, int >sport, int dport) {} > >so there's an implicit conversion there. W/o a 64bit Operton I can't >say more, but I'd be interested in the value of idx at that point. >Maybe add some traceEvent() calls after: > > idx = computeIdx(&srcHost->hostIpAddress,&dstHost->hostIpAddress, >sport, dport); > traceEvent(CONST_TRACE_INFO, "computeIdx() = %u (%x)", idx, idx); > >And again at the failure point... > > traceEvent(CONST_TRACE_INFO, >"myGlobals.device[%d].tcpSession[%d]=", >actualDeviceId, idx); > traceEvent(CONST_TRACE_INFO, "%d", >myGlobals.device[actualDeviceId].tcpSession[idx]); > prevSession = theSession = >myGlobals.device[actualDeviceId].tcpSession[idx]; > >Could also be the computeIdx() routine itself: > >unsigned short computeIdx(HostAddr *srcAddr, HostAddr *dstAddr, int >sport, int dport) { > > unsigned short idx; > if (srcAddr->hostFamily != dstAddr->hostFamily) > return -1; > switch (srcAddr->hostFamily){ > case AF_INET: > /* > * The hash key has to be calculated in a specular > * way: its value has to be the same regardless > * of the flow direction. > * > * Patch on the line below courtesy of > * Paul Chapman <[EMAIL PROTECTED]> > */ > idx = >(u_int)(dstAddr->Ip4Address.s_addr+srcAddr->Ip4Address.s_addr+sport+dport) ; > break; >#ifdef INET6 > case AF_INET6: > idx = (u_int)(dstAddr->Ip6Address.s6_addr[0] + > dstAddr->Ip6Address.s6_addr[0] + > srcAddr->Ip6Address.s6_addr[0] + > srcAddr->Ip6Address.s6_addr[0] + sport +! dport); > break; >#endif > } > return idx; >} > >which doesn't like the 64bit... How wide is unsigned short? You could >try replacing it with the explicit type here so it does the 'right' >(expected) truncation. > >-----Burton > > > >>-----Original Message----- >>From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of >>Bret Jordan >>Sent: Monday, July 26, 2004 5:29 PM >>To: [EMAIL PROTECTED] >>Subject: [Ntop] sflow - update >> >> >>Okay I have been playing around with this some more and running ntop >>through gdb and found that if I do the following I can get sflow to >>work on my Opterons with a 2.6.5 kernel. >> >>1) Edit the sflowplugin.c file and change all "u_long" references to >>"u_int32_t" >>2) Do NOT use a "-m" option to define local subnets . >> >>IIf you use the -m option to define local subnets it WILL segfault. >>Below you will find the output (STDOUT and a list and bt from gdb) >>from the segfault. >> >>Bret >> >>Wed Jul 21 12:15:46 2004 SFLOW: Collector listening on port 6343 Wed >>Jul 21 12:15:46 2004 Creating dummy interface, 'sFlow-device' >>Wed Jul 21 12:15:46 2004 THREADMGMT: sFlow thread (1092614512) started... >>[New Thread 1092614512 (LWP 17049)] >> >>Program received signal SIGSEGV, Segmentation fault. >>[Switching to Thread 1092614512 (LWP 17049)] >>0x0000002a958178e3 in handleSession (h=Variable "h" is not available. >>) at sessions.c:637 >>637 prevSession = theSession = >>myGlobals.device[actualDeviceId].tcpSession[idx]; >> >> >>(gdb) list >>632 >>633 #ifdef CFG_MULTITHREADED >>634 accessMutex(&myGlobals.tcpSessionsMutex, "handleSession"); >>635 #endif >>636 >>637 prevSession = theSession = >>myGlobals.device[actualDeviceId].tcpSession[idx]; >>638 >>639 while(theSession != NULL) { >>640 if(theSession && (theSession->next == theSession)) { >>641 traceEvent(CONST_TRACE_WARNING, "Internal Error (4) >>(idx=%d)", idx); >> >> >>(gdb) bt >>#0 0x0000002a958178e3 in handleSession (h=Variable "h" is not available. >>) at sessions.c:637 >>#1 0x0000002a9580e3b1 in processIpPkt (bp=Variable "bp" is not available. >>) at pbuf.c:1358 >>#2 0x0000002a9581050f in processPacket (_deviceId=Variable "_deviceId" >>is not available. >>) at pbuf.c:3160 >>#3 0x0000002a9581298e in queuePacket (_deviceId=Variable "_deviceId" >>is not available. >>) at pbuf.c:2108 >>#4 0x0000002a98c5efd2 in receiveSflowSample (sample=Variable "sample" >>is not available. >>) at sflowPlugin.c:940 >>#5 0x0000002a98c5f112 in sFlowMainLoop (notUsed=Variable "notUsed" is >>not available. >>) at sflowPlugin.c:1839 >>#6 0x0000002a9697e8e2 in start_thread () from >>/lib64/tls/libpthread.so.0 >>#7 0x0000002a96ea84d3 in thread_start () from /lib64/tls/libc.so.6 >>#8 0x0000000000000000 in ?? () >>#9 0x0000000000000000 in ?? () >>#10 0x0000000000000000 in ?? () >>#11 0x0000000000000000 in ?? () >>#12 0x0000000000000000 in ?? () >>#13 0x0000000000000000 in ?? () >>#14 0x0000000000000000 in ?? () >>#15 0x0000000000000000 in ?? () >>#16 0x0000000000000000 in ?? () >>#17 0x0000000000000000 in ?? () >>#18 0x0000000000000000 in ?? () >>#19 0x0000000000000000 in ?? () >>#20 0x0000002a96ff55e0 in _nl_C_locobj () from /lib64/tls/libc.so.6 >>#21 0x00000000411ffdc8 in ?? () >>#22 0x0000000000000000 in ?? () >>#23 0x0000000000000000 in ?? () >>#24 0x0000000000000000 in ?? () >>#25 0x0000000000000000 in ?? () >>#26 0x0000002a9700d4a0 in __malloc_initialize_hook () from >>/lib64/tls/libc.so.6 >>#27 0x0000000000000000 in ?? () >>#28 0x0000000000000000 in ?? () >>#29 0x0000000000000000 in ?? () >>#30 0x00000000411ff970 in ?? () >>#31 0x0000000000b39f48 in ?? () >>#32 0x00000000411ff970 in ?? () >>#33 0x0000000000000001 in ?? () >>#34 0x0000000000000000 in ?? () >>#35 0x0000000000000000 in ?? () >>#36 0x0000000000000000 in ?? () >>#37 0x0000000000000000 in ?? () >>#38 0x0000000000000000 in ?? () >>#39 0x0000000000000000 in ?? () >>---Type <return> to continue, or q <return> to quit--- #40 >>0x0000000000000000 in ?? () >>#41 0x0000000000000000 in ?? () >>#42 0x0000000000000000 in ?? () >>#43 0x0000000000000000 in ?? () >>#44 0x0000000000000000 in ?? () >>#45 0x0000000000000000 in ?? () >>#46 0x0000000040fff9f0 in ?? () >>#47 0x0000002a96a861d0 in stack_cache_maxsize () from >>/lib64/tls/libpthread.so.0 >>#48 0x00003aae00004299 in ?? () >>#49 0x0000000000000000 in ?? () >>#50 0x00000000411ff810 in ?? () >>#51 0x0000000000000000 in ?? () >>#52 0x0000000000000000 in ?? () >>#53 0x0000000000000000 in ?? () >>#54 0x0000000000000000 in ?? () >>#55 0x0000000000000000 in ?? () >>#56 0x0000000000000000 in ?? () >>#57 0x0000000000000000 in ?? () >>#58 0x0000000000000000 in ?? () >>#59 0x0000000000000000 in ?? () >>#60 0x0000000000000000 in ?? () >>#61 0x0000000000000000 in ?? () >>#62 0x0000000000000000 in ?? () >>#63 0x0000000000000000 in ?? () >>#64 0x0000000000000000 in ?? () >>#65 0x0000000000000000 in ?? () >>#66 0x0000000000000000 in ?? () >>#67 0x0000000000000000 in ?? () >>#68 0x0000000000000000 in ?? () >>#69 0x0000000000000000 in ?? () >>#70 0x0000000000000000 in ?? () >>#71 0x0000000000000000 in ?? () >>#72 0x0000000000000000 in ?? () >>#73 0x0000000000000000 in ?? () >>#74 0x0000000000000000 in ?? () >>#75 0x0000000000000000 in ?? () >>#76 0x0000000000000000 in ?? () >>#77 0x0000000000000000 in ?? () >>#78 0x0000000000000000 in ?? () >>#79 0x0000000000000000 in ?? () >>---Type <return> to continue, or q <return> to quit--- #80 >>0x0000000000000000 in ?? () >>#81 0x0000000000000000 in ?? () >>#82 0x0000000000000000 in ?? () >>#83 0x0000000000000000 in ?? () >>#84 0x0000000000000000 in ?? () >>#85 0x0000000000000000 in ?? () >>#86 0x0000000000000000 in ?? () >>#87 0x0000000000000000 in ?? () >>#88 0x0000000000000000 in ?? () >>#89 0x0000000000000000 in ?? () >>#90 0x0000000000000000 in ?? () >>#91 0x0000000000000000 in ?? () >>#92 0x0000000000000000 in ?? () >>#93 0x0000000000000000 in ?? () >>#94 0x0000000000000000 in ?? () >>#95 0x0000000000000000 in ?? () >>#96 0x0000000000000000 in ?? () >>#97 0x0000000000000000 in ?? () >>#98 0x0000000000000000 in ?? () >>#99 0x0000000000000000 in ?? () >>#100 0x0000000000000000 in ?? () >>#101 0x0000000000000000 in ?? () >>#102 0x0000000000000000 in ?? () >>#103 0x0000000000000000 in ?? () >>#104 0x0000000000000000 in ?? () >>#105 0x0000000000000000 in ?? () >>#106 0x0000000000000000 in ?? () >>#107 0x0000000000000000 in ?? () >>#108 0x0000000000000000 in ?? () >>#109 0x0000000000000000 in ?? () >>#110 0x0000000000000000 in ?? () >>#111 0x0000000000000000 in ?? () >>#112 0x0000000000000000 in ?? () >>#113 0x0000000000000000 in ?? () >>#114 0x0000000000000000 in ?? () >>#115 0x0000000000000000 in ?? () >>#116 0x0000000000000000 in ?? () >>#117 0x00000000411ffa20 in ?? () >>#118 0x0000000000000000 in ?? () >>#119 0x0000000000000000 in ?? () >>---Type <return> to continue, or q <return> to quit--- #120 >>0x0000000000000000 in ?? () >>#121 0x0000000000000000 in ?? () >>#122 0x0000000000000000 in ?? () >>#123 0x0000000000000000 in ?? () >>#124 0x0000000000000000 in ?? () >>#125 0x0000000000000000 in ?? () >>#126 0x0000000000000000 in ?? () >>#127 0x0000000000000000 in ?? () >>#128 0x0000000000000000 in ?? () >>#129 0x0000000000000000 in ?? () >>#130 0x0000000000000000 in ?? () >>#131 0x0000000000000000 in ?? () >>#132 0x0000000000000000 in ?? () >>#133 0x0000000000000000 in ?? () >>#134 0x0000000000000000 in ?? () >>#135 0x0000000000000000 in ?? () >>#136 0x0000000000000000 in ?? () >>#137 0x0000000000000000 in ?? () >>#138 0x0000000000000000 in ?? () >>#139 0x0000000000000000 in ?? () >>#140 0x0000000000000000 in ?? () >>#141 0x0000000000000000 in ?? () >>#142 0x0000000000000000 in ?? () >>#143 0x0000000000000000 in ?? () >>#144 0x0000000000000000 in ?? () >>#145 0x0000000000000000 in ?? () >>#146 0x0000000000000000 in ?? () >>#147 0x0000000000000000 in ?? () >>#148 0x0000000000000000 in ?? () >>#149 0x0000000000000001 in ?? () >>#150 0x0003cfc929ead38f in ?? () >>#151 0x0000000000000000 in ?? () >>#152 0x0000000000000000 in ?? () >>#153 0x0000000000000000 in ?? () >>#154 0x0000000000000000 in ?? () >>#155 0x0000002a98c5eff0 in receiveSflowSample () at sflowPlugin.c:925 >>#156 0x0000000000000000 in ?? () >>#157 0x0000000000000000 in ?? () >>#158 0x0000000000000000 in ?? () >>#159 0x0000000000000000 in ?? () >>---Type <return> to continue, or q <return> to quit--- #160 >>0x0000000000000000 in ?? () >>#161 0x0000000000000000 in ?? () >>#162 0x0000000000000000 in ?? () >>#163 0x0000000000000000 in ?? () >>#164 0x0000000000000000 in ?? () >>#165 0x0000000000000000 in ?? () >>#166 0x0000000041000000 in ?? () >>#167 0x0000000000200000 in ?? () >>#168 0x0000000000001000 in ?? () >>#169 0x0000000000000000 in ?? () >>#170 0x0000000000000000 in ?? () >>#171 0x0000000000000000 in ?? () >>#172 0x0000000000000000 in ?? () >>#173 0x0000000000000000 in ?? () >>#174 0x0000000000000000 in ?? () >>#175 0x0000000000000000 in ?? () >>#176 0x0000000000000000 in ?? () >>#177 0x0000000000000000 in ?? () >>#178 0x0000000000000000 in ?? () >>#179 0x0000000000000000 in ?? () >>#180 0x0000000000000000 in ?? () >>#181 0x0000000000000000 in ?? () >>#182 0x0000000000000000 in ?? () >>#183 0x0000000000000000 in ?? () >>#184 0x0000000000000000 in ?? () >>#185 0x0000000000000000 in ?? () >>#186 0x0000000000000000 in ?? () >>#187 0x0000000000000000 in ?? () >>#188 0x0000000000000000 in ?? () >>#189 0x0000000000000000 in ?? () >>#190 0x0000000000000000 in ?? () >>#191 0x0000000000000000 in ?? () >>#192 0x0000000000000000 in ?? () >>#193 0x0000000000000000 in ?? () >>#194 0x0000000000000000 in ?? () >>#195 0x0000000000000000 in ?? () >>#196 0x0000000000000000 in ?? () >>#197 0x0000000000000000 in ?? () >>#198 0x0000000000000000 in ?? () >>#199 0x0000000000000000 in ?? () >>---Type <return> to continue, or q <return> to quit--- #200 >>0x0000000000000000 in ?? () >>#201 0x0000000000000000 in ?? () >>#202 0x0000000000000000 in ?? () >>#203 0x0000000000000000 in ?? () >>#204 0x0000000000000000 in ?? () >>#205 0x0000000000000000 in ?? () >>#206 0x0000000000000000 in ?? () >>#207 0x0000000000000000 in ?? () >>#208 0x0000000000000000 in ?? () >>#209 0x0000000000000000 in ?? () >>#210 0x0000000000000000 in ?? () >>#211 0x0000000000000000 in ?? () >>#212 0x0000000000000000 in ?? () >>#213 0x0000000000000000 in ?? () >>#214 0x0000000000000000 in ?? () >>#215 0x0000000000000000 in ?? () >>#216 0x0000000000000000 in ?? () >>#217 0x0000000000000000 in ?? () >>#218 0x0000000000000000 in ?? () >>#219 0x0000000000000000 in ?? () >>#220 0x0000000000000000 in ?? () >>#221 0x0000000000000000 in ?? () >>#222 0x0000000000000000 in ?? () >>#223 0x0000000000000000 in ?? () >>#224 0x0000000000000000 in ?? () >>#225 0x0000000000000000 in ?? () >>#226 0x0000000000000000 in ?? () >>#227 0x0000000000000000 in ?? () >>#228 0x0000000000000000 in ?? () >>#229 0x0000000000000000 in ?? () >>#230 0x0000000000000000 in ?? () >>#231 0x0000000000000000 in ?? () >>#232 0x0000000000000000 in ?? () >>#233 0x0000000000000000 in ?? () >>#234 0x0000000000000000 in ?? () >>#235 0x0000000000000000 in ?? () >>#236 0x0000000000000000 in ?? () >>#237 0x0000000000000000 in ?? () >>#238 0x0000000000000000 in ?? () >>#239 0x0000000000000000 in ?? () >>Cannot access memory at address 0x41200000 >> >> >> >>-- >>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >>Bret Jordan Dean's Office >>Director of Networking College of Engineering >>801.585.3765 University of Utah >> [EMAIL PROTECTED] >>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> >> >>_______________________________________________ >>Ntop mailing list >>[EMAIL PROTECTED] >>http://listgateway.unipi.it/mailman/listinfo/ntop >> >> > >_______________________________________________ >Ntop mailing list >[EMAIL PROTECTED] >http://listgateway.unipi.it/mailman/listinfo/ntop > > > -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Bret Jordan Dean's Office Director of Networking College of Engineering 801.585.3765 University of Utah [EMAIL PROTECTED] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ------------------------------ Message: 3 Date: Tue, 27 Jul 2004 19:15:07 +0200 From: Spam <[EMAIL PROTECTED]> Subject: Re: [Ntop] A couple a basic NTOP questions To: Chris Moore - GMD <[EMAIL PROTECTED]> Message-ID: <[EMAIL PROTECTED]> Content-Type: text/plain; charset=us-ascii I have also tried to get NTOP to be able to store data between sessions (reboots etc). The FAQ on the ntop.org page says i should use the -S flag. But that doesn't seem to work, nor is it documented in the man or when I do ntop --help. It is not always easy to find the information one want, even if it would be there. As Andrew Davis said, it may just be enough with a pointer on what to look for? I also believe you that it does get tedious to listen to the very same questions from new users all the time. perhaps the FAQ should be placed in the navigation menu on ntop.org and the docs and help would be merged into one page (perhaps with sub-pages). > You have to understand that this question gets asked at least twice a week > on this list, and it is covered - at least a starting point - in the FAQ. So > you haven't even read the documentation that's on your Ntop box. I'd suggest > that you at least try to explore all the different pages served by the Ntop > web server. You'll find all sorts of cool and helpful stuff. Click "about" > in the top menu. Click the "?" with a circle around it (right next to the > little icon that looks like a bug) in the secondary menu and then click the > link under the FAQ title. Or you could just look in the docs directory and > the FAQ is there. It is up-to-date as far as I know. > You must understand that none of us get paid to help you (well, you CAN pay > people like Burton to help you, but obviously you're not paying him now) so > it is more than a bit annoying when people don't even attempt to help > themselves before asking the list for help. And when people ask the same > question every other day, I'm sure you can see where people might get a > little short about it. > -----Original Message----- > Date: Tue, 27 Jul 2004 08:29:31 -0700 > From: Andrew Davis <[EMAIL PROTECTED]> > Subject: Re: [Ntop] A couple a basic NTOP questions > To: "Burton M. Strauss III" <[EMAIL PROTECTED]> > Cc: [EMAIL PROTECTED] > Message-ID: <[EMAIL PROTECTED]> > Content-Type: text/plain; charset=us-ascii; format=flowed > You know, I can't count the number of lists where people reply with > "read the docs". Funny, cause I always read them (if I can find them) > before I post to a list. It was only *after* searching all over ntop.org > and via google that I found some very dated (ver 2.x) info, but was able > to get ntop up and running. What I was wondering about was storing the > data... why it appeared to be lost after a reboot and if storing it in > mysql was the only option. Of course, typical to most lists, no one can > just "say, you can configure it to store the data, but you need mysql" > or "no, you can't... a mysql db is the only". Had I received an answer > like that, I could move on and know what direction to go. Instead, I'm > told to read the docs (which I already have... those I could find > anyway), that the docs are old and outdated (???), and to search the > archives (which I have, but if any of you notice, when you go the page > with the archives, there's no search option and heck if I want to > download all the files, unpack them all, and then search them all). I > wasn't asking for my hand to be held. I was asking a general question so > I know which path to go down as I move forward, but as with most lists I > got the typical RTFM, though in this case, with a follow-up that says, > "oh, and TFM is out-dated". > _______________________________________________ > Ntop mailing list > [EMAIL PROTECTED] > http://listgateway.unipi.it/mailman/listinfo/ntop ------------------------------ Message: 4 Date: Tue, 27 Jul 2004 13:43:44 -0500 From: "Burton M. Strauss III" <[EMAIL PROTECTED]> Subject: RE: [Ntop] sflow - update To: <[EMAIL PROTECTED]> Message-ID: <[EMAIL PROTECTED]> Content-Type: text/plain; charset="iso-8859-1" Yeah, right - it's an ugly process. See something that really is 32 bits (e.g. an IPv4 address) s/b u_int32_t. But something that's just a number should be ok as whatever the compiler picks for (say) unsigned int (whether that's 16, 32 or 64). But without the analysis, you can't tell. Basically you have to sort through every single reference that's not one of the u_int99_t types but rather one of the variant types to figure out if it's '64 bit' safe (ok). Or you can try and find them when they break things... Either way it's messy. -----Burton > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of > Bret Jordan > Sent: Tuesday, July 27, 2004 11:10 AM > To: [EMAIL PROTECTED] > Subject: Re: [Ntop] sflow - update > > > Thanks I will try some of that.. You know, I might be able to give you > access to one of my Opteron boxen for a few days if you wanted to play > with this.. > > Bret > > Burton M. Strauss III wrote: > > >The Opterons are 64 bit, right? So the size of u_long (typedef unsigned > >long) depends on the processor. u_int32_t is a 32bit unsigned integer > >across all platforms. And thus the u_int32_t change makes a lot > of sense. > > > >Similarly, the definition of u_int (idx) is also OS dependent. > > > >unsigned short computeIdx(HostAddr *srcAddr, HostAddr *dstAddr, > int sport, > >int dport) {} > > > >so there's an implicit conversion there. W/o a 64bit Operton I can't say > >more, but I'd be interested in the value of idx at that point. Maybe add > >some traceEvent() calls after: > > > > idx = > computeIdx(&srcHost->hostIpAddress,&dstHost->hostIpAddress, sport, > >dport); > > traceEvent(CONST_TRACE_INFO, "computeIdx() = %u (%x)", idx, idx); > > > >And again at the failure point... > > > > traceEvent(CONST_TRACE_INFO, "myGlobals.device[%d].tcpSession[%d]=", > >actualDeviceId, idx); > > traceEvent(CONST_TRACE_INFO, "%d", > >myGlobals.device[actualDeviceId].tcpSession[idx]); > > prevSession = theSession = > >myGlobals.device[actualDeviceId].tcpSession[idx]; > > > >Could also be the computeIdx() routine itself: > > > >unsigned short computeIdx(HostAddr *srcAddr, HostAddr *dstAddr, > int sport, > >int dport) { > > > > unsigned short idx; > > if (srcAddr->hostFamily != dstAddr->hostFamily) > > return -1; > > switch (srcAddr->hostFamily){ > > case AF_INET: > > /* > > * The hash key has to be calculated in a specular > > * way: its value has to be the same regardless > > * of the flow direction. > > * > > * Patch on the line below courtesy of > > * Paul Chapman <[EMAIL PROTECTED]> > > */ > > idx = > >(u_int)(dstAddr->Ip4Address.s_addr+srcAddr->Ip4Address.s_addr+spo > rt+dport) ; > > break; > >#ifdef INET6 > > case AF_INET6: > > idx = (u_int)(dstAddr->Ip6Address.s6_addr[0] + > > dstAddr->Ip6Address.s6_addr[0] + > > srcAddr->Ip6Address.s6_addr[0] + > > srcAddr->Ip6Address.s6_addr[0] + sport +! dport); > > break; > >#endif > > } > > return idx; > >} > > > >which doesn't like the 64bit... How wide is unsigned short? > You could try > >replacing it with the explicit type here so it does the 'right' > (expected) > >truncation. > > > >-----Burton > > > > > > > >>-----Original Message----- > >>From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of > >>Bret Jordan > >>Sent: Monday, July 26, 2004 5:29 PM > >>To: [EMAIL PROTECTED] > >>Subject: [Ntop] sflow - update > >> > >> > >>Okay I have been playing around with this some more and running ntop > >>through gdb and found that if I do the following I can get sflow to work > >>on my Opterons with a 2.6.5 kernel. > >> > >>1) Edit the sflowplugin.c file and change all "u_long" references to > >>"u_int32_t" > >>2) Do NOT use a "-m" option to define local subnets . > >> > >>IIf you use the -m option to define local subnets it WILL segfault. > >>Below you will find the output (STDOUT and a list and bt from gdb) from > >>the segfault. > >> > >>Bret > >> > >>Wed Jul 21 12:15:46 2004 SFLOW: Collector listening on port 6343 > >>Wed Jul 21 12:15:46 2004 Creating dummy interface, 'sFlow-device' > >>Wed Jul 21 12:15:46 2004 THREADMGMT: sFlow thread (1092614512) > started... > >>[New Thread 1092614512 (LWP 17049)] > >> > >>Program received signal SIGSEGV, Segmentation fault. > >>[Switching to Thread 1092614512 (LWP 17049)] > >>0x0000002a958178e3 in handleSession (h=Variable "h" is not available. > >>) at sessions.c:637 > >>637 prevSession = theSession = > >>myGlobals.device[actualDeviceId].tcpSession[idx]; > >> > >> > >>(gdb) list > >>632 > >>633 #ifdef CFG_MULTITHREADED > >>634 accessMutex(&myGlobals.tcpSessionsMutex, "handleSession"); > >>635 #endif > >>636 > >>637 prevSession = theSession = > >>myGlobals.device[actualDeviceId].tcpSession[idx]; > >>638 > >>639 while(theSession != NULL) { > >>640 if(theSession && (theSession->next == theSession)) { > >>641 traceEvent(CONST_TRACE_WARNING, "Internal Error (4) > >>(idx=%d)", idx); > >> > >> > >>(gdb) bt > >>#0 0x0000002a958178e3 in handleSession (h=Variable "h" is not > available. > >>) at sessions.c:637 > >>#1 0x0000002a9580e3b1 in processIpPkt (bp=Variable "bp" is not > available. > >>) at pbuf.c:1358 > >>#2 0x0000002a9581050f in processPacket (_deviceId=Variable "_deviceId" > >>is not available. > >>) at pbuf.c:3160 > >>#3 0x0000002a9581298e in queuePacket (_deviceId=Variable "_deviceId" is > >>not available. > >>) at pbuf.c:2108 > >>#4 0x0000002a98c5efd2 in receiveSflowSample (sample=Variable "sample" > >>is not available. > >>) at sflowPlugin.c:940 > >>#5 0x0000002a98c5f112 in sFlowMainLoop (notUsed=Variable "notUsed" is > >>not available. > >>) at sflowPlugin.c:1839 > >>#6 0x0000002a9697e8e2 in start_thread () from > /lib64/tls/libpthread.so.0 > >>#7 0x0000002a96ea84d3 in thread_start () from /lib64/tls/libc.so.6 > >>#8 0x0000000000000000 in ?? () > >>#9 0x0000000000000000 in ?? () > >>#10 0x0000000000000000 in ?? () > >>#11 0x0000000000000000 in ?? () > >>#12 0x0000000000000000 in ?? () > >>#13 0x0000000000000000 in ?? () > >>#14 0x0000000000000000 in ?? () > >>#15 0x0000000000000000 in ?? () > >>#16 0x0000000000000000 in ?? () > >>#17 0x0000000000000000 in ?? () > >>#18 0x0000000000000000 in ?? () > >>#19 0x0000000000000000 in ?? () > >>#20 0x0000002a96ff55e0 in _nl_C_locobj () from /lib64/tls/libc.so.6 > >>#21 0x00000000411ffdc8 in ?? () > >>#22 0x0000000000000000 in ?? () > >>#23 0x0000000000000000 in ?? () > >>#24 0x0000000000000000 in ?? () > >>#25 0x0000000000000000 in ?? () > >>#26 0x0000002a9700d4a0 in __malloc_initialize_hook () from > >>/lib64/tls/libc.so.6 > >>#27 0x0000000000000000 in ?? () > >>#28 0x0000000000000000 in ?? () > >>#29 0x0000000000000000 in ?? () > >>#30 0x00000000411ff970 in ?? () > >>#31 0x0000000000b39f48 in ?? () > >>#32 0x00000000411ff970 in ?? () > >>#33 0x0000000000000001 in ?? () > >>#34 0x0000000000000000 in ?? () > >>#35 0x0000000000000000 in ?? () > >>#36 0x0000000000000000 in ?? () > >>#37 0x0000000000000000 in ?? () > >>#38 0x0000000000000000 in ?? () > >>#39 0x0000000000000000 in ?? () > >>---Type <return> to continue, or q <return> to quit--- > >>#40 0x0000000000000000 in ?? () > >>#41 0x0000000000000000 in ?? () > >>#42 0x0000000000000000 in ?? () > >>#43 0x0000000000000000 in ?? () > >>#44 0x0000000000000000 in ?? () > >>#45 0x0000000000000000 in ?? () > >>#46 0x0000000040fff9f0 in ?? () > >>#47 0x0000002a96a861d0 in stack_cache_maxsize () from > >>/lib64/tls/libpthread.so.0 > >>#48 0x00003aae00004299 in ?? () > >>#49 0x0000000000000000 in ?? () > >>#50 0x00000000411ff810 in ?? () > >>#51 0x0000000000000000 in ?? () > >>#52 0x0000000000000000 in ?? () > >>#53 0x0000000000000000 in ?? () > >>#54 0x0000000000000000 in ?? () > >>#55 0x0000000000000000 in ?? () > >>#56 0x0000000000000000 in ?? () > >>#57 0x0000000000000000 in ?? () > >>#58 0x0000000000000000 in ?? () > >>#59 0x0000000000000000 in ?? () > >>#60 0x0000000000000000 in ?? () > >>#61 0x0000000000000000 in ?? () > >>#62 0x0000000000000000 in ?? () > >>#63 0x0000000000000000 in ?? () > >>#64 0x0000000000000000 in ?? () > >>#65 0x0000000000000000 in ?? () > >>#66 0x0000000000000000 in ?? () > >>#67 0x0000000000000000 in ?? () > >>#68 0x0000000000000000 in ?? () > >>#69 0x0000000000000000 in ?? () > >>#70 0x0000000000000000 in ?? () > >>#71 0x0000000000000000 in ?? () > >>#72 0x0000000000000000 in ?? () > >>#73 0x0000000000000000 in ?? () > >>#74 0x0000000000000000 in ?? () > >>#75 0x0000000000000000 in ?? () > >>#76 0x0000000000000000 in ?? () > >>#77 0x0000000000000000 in ?? () > >>#78 0x0000000000000000 in ?? () > >>#79 0x0000000000000000 in ?? () > >>---Type <return> to continue, or q <return> to quit--- > >>#80 0x0000000000000000 in ?? () > >>#81 0x0000000000000000 in ?? () > >>#82 0x0000000000000000 in ?? () > >>#83 0x0000000000000000 in ?? () > >>#84 0x0000000000000000 in ?? () > >>#85 0x0000000000000000 in ?? () > >>#86 0x0000000000000000 in ?? () > >>#87 0x0000000000000000 in ?? () > >>#88 0x0000000000000000 in ?? () > >>#89 0x0000000000000000 in ?? () > >>#90 0x0000000000000000 in ?? () > >>#91 0x0000000000000000 in ?? () > >>#92 0x0000000000000000 in ?? () > >>#93 0x0000000000000000 in ?? () > >>#94 0x0000000000000000 in ?? () > >>#95 0x0000000000000000 in ?? () > >>#96 0x0000000000000000 in ?? () > >>#97 0x0000000000000000 in ?? () > >>#98 0x0000000000000000 in ?? () > >>#99 0x0000000000000000 in ?? () > >>#100 0x0000000000000000 in ?? () > >>#101 0x0000000000000000 in ?? () > >>#102 0x0000000000000000 in ?? () > >>#103 0x0000000000000000 in ?? () > >>#104 0x0000000000000000 in ?? () > >>#105 0x0000000000000000 in ?? () > >>#106 0x0000000000000000 in ?? () > >>#107 0x0000000000000000 in ?? () > >>#108 0x0000000000000000 in ?? () > >>#109 0x0000000000000000 in ?? () > >>#110 0x0000000000000000 in ?? () > >>#111 0x0000000000000000 in ?? () > >>#112 0x0000000000000000 in ?? () > >>#113 0x0000000000000000 in ?? () > >>#114 0x0000000000000000 in ?? () > >>#115 0x0000000000000000 in ?? () > >>#116 0x0000000000000000 in ?? () > >>#117 0x00000000411ffa20 in ?? () > >>#118 0x0000000000000000 in ?? () > >>#119 0x0000000000000000 in ?? () > >>---Type <return> to continue, or q <return> to quit--- > >>#120 0x0000000000000000 in ?? () > >>#121 0x0000000000000000 in ?? () > >>#122 0x0000000000000000 in ?? () > >>#123 0x0000000000000000 in ?? () > >>#124 0x0000000000000000 in ?? () > >>#125 0x0000000000000000 in ?? () > >>#126 0x0000000000000000 in ?? () > >>#127 0x0000000000000000 in ?? () > >>#128 0x0000000000000000 in ?? () > >>#129 0x0000000000000000 in ?? () > >>#130 0x0000000000000000 in ?? () > >>#131 0x0000000000000000 in ?? () > >>#132 0x0000000000000000 in ?? () > >>#133 0x0000000000000000 in ?? () > >>#134 0x0000000000000000 in ?? () > >>#135 0x0000000000000000 in ?? () > >>#136 0x0000000000000000 in ?? () > >>#137 0x0000000000000000 in ?? () > >>#138 0x0000000000000000 in ?? () > >>#139 0x0000000000000000 in ?? () > >>#140 0x0000000000000000 in ?? () > >>#141 0x0000000000000000 in ?? () > >>#142 0x0000000000000000 in ?? () > >>#143 0x0000000000000000 in ?? () > >>#144 0x0000000000000000 in ?? () > >>#145 0x0000000000000000 in ?? () > >>#146 0x0000000000000000 in ?? () > >>#147 0x0000000000000000 in ?? () > >>#148 0x0000000000000000 in ?? () > >>#149 0x0000000000000001 in ?? () > >>#150 0x0003cfc929ead38f in ?? () > >>#151 0x0000000000000000 in ?? () > >>#152 0x0000000000000000 in ?? () > >>#153 0x0000000000000000 in ?? () > >>#154 0x0000000000000000 in ?? () > >>#155 0x0000002a98c5eff0 in receiveSflowSample () at sflowPlugin.c:925 > >>#156 0x0000000000000000 in ?? () > >>#157 0x0000000000000000 in ?? () > >>#158 0x0000000000000000 in ?? () > >>#159 0x0000000000000000 in ?? () > >>---Type <return> to continue, or q <return> to quit--- > >>#160 0x0000000000000000 in ?? () > >>#161 0x0000000000000000 in ?? () > >>#162 0x0000000000000000 in ?? () > >>#163 0x0000000000000000 in ?? () > >>#164 0x0000000000000000 in ?? () > >>#165 0x0000000000000000 in ?? () > >>#166 0x0000000041000000 in ?? () > >>#167 0x0000000000200000 in ?? () > >>#168 0x0000000000001000 in ?? () > >>#169 0x0000000000000000 in ?? () > >>#170 0x0000000000000000 in ?? () > >>#171 0x0000000000000000 in ?? () > >>#172 0x0000000000000000 in ?? () > >>#173 0x0000000000000000 in ?? () > >>#174 0x0000000000000000 in ?? () > >>#175 0x0000000000000000 in ?? () > >>#176 0x0000000000000000 in ?? () > >>#177 0x0000000000000000 in ?? () > >>#178 0x0000000000000000 in ?? () > >>#179 0x0000000000000000 in ?? () > >>#180 0x0000000000000000 in ?? () > >>#181 0x0000000000000000 in ?? () > >>#182 0x0000000000000000 in ?? () > >>#183 0x0000000000000000 in ?? () > >>#184 0x0000000000000000 in ?? () > >>#185 0x0000000000000000 in ?? () > >>#186 0x0000000000000000 in ?? () > >>#187 0x0000000000000000 in ?? () > >>#188 0x0000000000000000 in ?? () > >>#189 0x0000000000000000 in ?? () > >>#190 0x0000000000000000 in ?? () > >>#191 0x0000000000000000 in ?? () > >>#192 0x0000000000000000 in ?? () > >>#193 0x0000000000000000 in ?? () > >>#194 0x0000000000000000 in ?? () > >>#195 0x0000000000000000 in ?? () > >>#196 0x0000000000000000 in ?? () > >>#197 0x0000000000000000 in ?? () > >>#198 0x0000000000000000 in ?? () > >>#199 0x0000000000000000 in ?? () > >>---Type <return> to continue, or q <return> to quit--- > >>#200 0x0000000000000000 in ?? () > >>#201 0x0000000000000000 in ?? () > >>#202 0x0000000000000000 in ?? () > >>#203 0x0000000000000000 in ?? () > >>#204 0x0000000000000000 in ?? () > >>#205 0x0000000000000000 in ?? () > >>#206 0x0000000000000000 in ?? () > >>#207 0x0000000000000000 in ?? () > >>#208 0x0000000000000000 in ?? () > >>#209 0x0000000000000000 in ?? () > >>#210 0x0000000000000000 in ?? () > >>#211 0x0000000000000000 in ?? () > >>#212 0x0000000000000000 in ?? () > >>#213 0x0000000000000000 in ?? () > >>#214 0x0000000000000000 in ?? () > >>#215 0x0000000000000000 in ?? () > >>#216 0x0000000000000000 in ?? () > >>#217 0x0000000000000000 in ?? () > >>#218 0x0000000000000000 in ?? () > >>#219 0x0000000000000000 in ?? () > >>#220 0x0000000000000000 in ?? () > >>#221 0x0000000000000000 in ?? () > >>#222 0x0000000000000000 in ?? () > >>#223 0x0000000000000000 in ?? () > >>#224 0x0000000000000000 in ?? () > >>#225 0x0000000000000000 in ?? () > >>#226 0x0000000000000000 in ?? () > >>#227 0x0000000000000000 in ?? () > >>#228 0x0000000000000000 in ?? () > >>#229 0x0000000000000000 in ?? () > >>#230 0x0000000000000000 in ?? () > >>#231 0x0000000000000000 in ?? () > >>#232 0x0000000000000000 in ?? () > >>#233 0x0000000000000000 in ?? () > >>#234 0x0000000000000000 in ?? () > >>#235 0x0000000000000000 in ?? () > >>#236 0x0000000000000000 in ?? () > >>#237 0x0000000000000000 in ?? () > >>#238 0x0000000000000000 in ?? () > >>#239 0x0000000000000000 in ?? () > >>Cannot access memory at address 0x41200000 > >> > >> > >> > >>-- > >>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > >>Bret Jordan Dean's Office > >>Director of Networking College of Engineering > >>801.585.3765 University of Utah > >> [EMAIL PROTECTED] > >>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > >> > >> > >>_______________________________________________ > >>Ntop mailing list > >>[EMAIL PROTECTED] > >>http://listgateway.unipi.it/mailman/listinfo/ntop > >> > >> > > > >_______________________________________________ > >Ntop mailing list > >[EMAIL PROTECTED] > >http://listgateway.unipi.it/mailman/listinfo/ntop > > > > > > > > -- > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > Bret Jordan Dean's Office > Director of Networking College of Engineering > 801.585.3765 University of Utah > [EMAIL PROTECTED] > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > > _______________________________________________ > Ntop mailing list > [EMAIL PROTECTED] > http://listgateway.unipi.it/mailman/listinfo/ntop ------------------------------ _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop End of Ntop Digest, Vol 2, Issue 30 ***********************************
_______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
