Regarding compression: I am also seeing low number for other protocols that don't use compression.
Regarding dropped packets: Yes there are lots of dropped packets! There is a percentage (~82) but no explanation about what the percentage is. Percentage of all packets seen? Regardless, it is a large number... Any idea why so many packets are being dropped? Could this be related to being on a Gbit network? I suppose I should try and use the pf_ring kernel patch, eh? thanks, Rich On Fri, 10 Sep 2004 08:40:49 +0400, Alexei Korobkin <[EMAIL PROTECTED]> wrote: > Dear Rich, > > Thu, 9 Sep 2004 14:21:52 -0700, Rich McClellan -> [EMAIL PROTECTED]: > > RM> In my brief experience with NTop it appears to underreport the actual > RM> volume of traffic on the network. For example, if I use scp or sftp > RM> to transfer a large file (ca. 12 MB) from one host to another, the > RM> appropriate box in the "Host Traffic Stats" table does not show the 12 > RM> MB of traffic. > > Probably you have ssh compression enabled? > Every week I transfer about 16 Gb of data using sftp with compression, and > both ntop and sftp own counters report only 10-11 Gb of real traffic. > > RM> Possibly irrelevant information: the network is running at Gb speed. > RM> Note both ssh and sftp are protocols that NTop is watching and show up > RM> as columns in the "IP Summary:Traffic" table. > > Take a look at Summary -> Traffic -> Dropped. Are there any dropped packets? > > -- > With best regards, Alexei Korobkin. > > _______________________________________________ > Ntop mailing list > [EMAIL PROTECTED] > http://listgateway.unipi.it/mailman/listinfo/ntop > _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
