>From docs/FAQ (because we *believe* it's much better in 3.2, this has been
moved to docs/FAQarchive, which is where this copy is from).
-----Burton
----------------------------------------------------------------------------
----
----- Dropped packets
----------------------------------------------------------
----------------------------------------------------------------------------
----
A. Short Answer: You need a faster processor. Maybe.
A. Long Answer: There are four places packets drop "in" ntop. One in
the NIC, one in the OS kernel, one in the libpcap library and one
actually in ntop.
First off, this is largely NOT controlled by ntop. It's inside the
network
card, the network card driver and libpcap. All ntop does is use the
stats
provided by libpcap, pcap_stats:
"int pcap_stats() returns 0 and fills in a pcap_stat struct. The
values represent packet statistics from the start of the run to
the time of the call. If there is an error or the under lying
packet capture doesn't support packet statistics, -1 is returned
and the error text can be obtained with pcap_perror() or
pcap_geterr()."
to get the value and reports it in report.con the Stats | Traffic
page, some in the configuration report (info.html) and also on
the problem report skeleton.
The information on the Stats | Traffic page is simply the best available.
However, this data is not always easy to obtain nor interpret.
It looks great, but the reality is that the stats provided by libpcap
aren't very good!
Q. Not good? Why...
A. The network card (NIC) reads packets from the wire into a small buffer.
That buffer is emptied by the OS into it's own buffers which are then
passed to libpcap. libpcap filters the packets (if requested) and
passes the packets to ntop.
Packets may be dropped at any or all of these stages, even on a system
that does not appear to be exceptionally busy.
Q. How can packets be lost in the NIC?
A. A NIC has a small buffer - modern cards have 8K, 12K, even more buffer
space. But if traffic comes in off the wire faster than the processes
are pulling it out of the NIC, well that buffer gets over-written and
packets get dropped.
Every time a packet comes in (or on some newer cards after a few packets
are recevied), the NIC interrupts the processor (CPU) to tell it to do
something. This isn't a problem - some NICs with larger buffers
internally queuing a number of packets before interrupting the OS to
boost performance.
Check ifconfig for this:
eth0 Link encap:Ethernet HWaddr 00:D0:09:77:85:B9
inet addr:192.168.42.6 Bcast:192.168.42.255
Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:3892397 errors:30 dropped:0 overruns:0 frame:33
^^^^^^^^^
TX packets:473009 errors:0 dropped:0 overruns:0 carrier:0
^^^^^^^^^
collisions:1073 txqueuelen:100
RX bytes:2606704447 (2485.9 Mb) TX bytes:70474880 (67.2 Mb)
Interrupt:11 Base address:0xc000
Now, if it's an occasional burst, losing 1 or 2 packets won't kill
you. TCP/IP recovers. And ntop's statistics aren't life-critical.
If, however, it's continuous, on-going and the count is growing - i.e.
the NIC/CPU combo can't keep up with the AVERAGE network flow?
You're toast...
Upgrade the Processor or NIC. Maybe.
Q. Can you tell if the NIC is the bottleneck?
A. Probably not. Different NIC cards (and NIC card drivers) record
different
information. Different tools present pieces and parts of it differently.
For example, a runt packet - one that is too short to really be a packet
is supposed to be discarded according to the tcp/ip standard. But do you
count it as a packet received??
On many systems, interface level (NIC) statistics are available through
the ifconfig (or similar) command. But what is available and what they
mean can be different - even though they're presented in the same format.
Different programs can read the 'same' data and show different things.
For example - eth1 is an Intel Ethernet Pro/100, eth2 a 3c905...
# netstat -i --all
Kernel Interface table
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP
TX-OVR Flg
eth1 1500 0 50752227 0 0 0 0 0 0
0 BMPRU
eth2 1500 0 145053154 0 0 0 0 0 0
0 BMPRU
No errors - great, right? But look at ifconfig, a few seconds earlier:
# ifconfig
eth1 Link encap:Ethernet HWaddr 00:03:47:B1:62:27
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:50754251 errors:0 dropped:0 overruns:0 frame:3454146
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:667103055 (636.1 Mb) TX bytes:0 (0.0 b)
Interrupt:9 Base address:0x1000
eth2 Link encap:Ethernet HWaddr 00:60:97:04:30:33
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:145056087 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:1784472399 (1701.8 Mb) TX bytes:0 (0.0 b)
Interrupt:9 Base address:0xb800
If I'm reading the code right, then the frame:nnnn count is set here:
sp->stats.rx_frame_errors += le32_to_cpu(sp->lstats->rx_align_errs);
Meaning? No clue - the writer of the driver had to sign an NDA and so
couldn't explain a lot of what the driver does. Besides, that data
isn't available to ntop anyway.
Q. How can packets can be lost in the kernel?
A. Each time that interrupt occurs, the kernel processes it by moving
the data from the NIC to a kernel buffer, then re-enable interrupts.
Not really.
Actually, in Linux (and other OSes), the Kernel interrupt handler is
broken in half - called in Linux the top and bottom. The bottom
interrupt works with processor interrupts off to grab the data and
buffer it and does only minimal processing as fast as possible so
interrupts can be turned back on. Then the top half is scheduled
and processes as a Kernel process (high priority), but it is less
time critical.
However, if the kernel can't process the bottom half in time - because
there isn't enough memory and/or the processor isn't fast enough to
respond to the interrupt, you do have a problem. The small buffer
in the NIC will overflow and packets are dropped (this is the ONE place
where a better NIC, with a larger buffer, MIGHT help).
While there are LOTS of possible causes, if the kernel is *routinely*
dropping packets, it's almost certainly an interrupt/processor
speed/buffering issue.
So, I guess what I'm saying is that the dropped: count from ifconfig
might not be the NIC's fault - and that's why a faster processor is a
better choice than an expensive server class NIC.
Q. But at least I can trust the libpcap reported counts, right?
A. Nope. You need to treat the pcap reported drops with more than a few
grains of salt. See this thread, for example:
http://www.tcpdump.org/lists/workers/2001/07/msg00018.html
and this msg:
http://www.mcabee.org/lists/snort-users/Jan-02/msg00771.html
There's a lot of other stuff about pcap problems, especially from
snort (another package that stresses libpcap) -
STFW for "libpcap ps_drop".
See, the call to pcap_stats reads internal counters - maybe they come
from the NIC and maybe they're just maintained by the kernel. That's a
function of how the low level NIC driver is written to handle certain
calls from higher level drivers. So it's a function of the specific
NIC card, something we try to hide from everyone, ntop included.
Ultimately, some piece of hardware or software SHOULD be counting packets
and dropped packets.
But, remember also, that - AT THE INSTANT OF THE pcap_stats call -
there can be packets queued in any of these buffers (NIC, kernel,
libpcap).
Put the two together and I wouldn't trust 'em.
Want more fear? Read the comments through out the libpcap code. Like
this gem from pcap-linux.c:
* Get the statistics for the given packet capture handle.
* Reports the number of dropped packets iff the kernel supports
* the PACKET_STATISTICS "getsockopt()" argument (2.4 and later
* kernels, and 2.2[.x] kernels with Alexey Kuznetzov's turbopacket
* patches); otherwise, that information isn't available, and we lie
* and report 0 as the count of dropped packets.
And this from pcap-bpf.c:
/*
* "ps_recv" counts packets handed to the filter, not packets
* that passed the filter. This includes packets later dropped
* because we ran out of buffer space.
*
* "ps_drop" counts packets dropped inside the BPF device
* because we ran out of buffer space. It doesn't count
* packets dropped by the interface driver. It counts
* only packets that passed the filter.
*
* Both statistics include packets not yet read from the kernel
* by libpcap, and thus not yet seen by the application.
*/
As you see from the comments in the code, the interpretation of even
those counts differs between operating systems and even between minor
versions
of the same OS (e.g. Linux 2.4.8 vs. 2.4.9). For example, some systems
do not maintain a dropped count and will always report zero. Differences
may also occur on the same system for different NIC drivers.
If a BPF filter (-B option) is in place, the differences between OSes are
more significant.
etc.
Trust nobody...
Q. ntop drops packets?
A. Sure. ntop runs multiple threads (we call them "NPS - Network Packet
Sniffer"
or something similar), one to handle each incomming device. These
operate
much like the bottom-half interrupt - they accept the packet and queue it
to another thread ("NPA - Network Packet Analyzer") for the analysis.
Ultimately, we're interested in the counter droppedPkts, which is
incremented in only one place, pbuf.c around 1398, which this is where
NPS is trying to queue a packet for NPA.
Now, you can increase PACKET_QUEUE_LENGTH
ntop.h: 693 #define PACKET_QUEUE_LENGTH 2048
but if you're routinely dropping packets here it's because ntop can't
keep up with the flow. Increasing the queue length will ONLY help if
it's an occasional huge peak with times where the network is quiet
enough to allow you to work off the queue. And each packet buffer
in use takes up memory - (about 1.5MB for a queue of size 2048).
The instantaneous and maximum value for the queue are reported in
the configuration report:
# Queued Pkts to Process 0
# Max Queued Pkts 0
But, again, the best answer for dropped packets is probably a
faster processor... (Upgrading to an expensive faster NIC with a
larger internal buffer is rarely the best "bang for the buck" - if
you were running a server, then a server class NIC is a good idea,
but for workstations or network monitors, etc. you just need something
that can keep up with the network flow.)
Q. So what do you show?
A. The kicker is that accurate counts of raw and dropped packets do not
exist
or are not available without using low-level, system specific logic.
The counts that ARE available in a system-independent way are what is
reported in the statistics on the Stats | Traffic page.
Q. So what is reported?
A. ntop reports the packet and dropped counts as reported by libpcap and the
received, dropped and processed counts it maintains internally.
Q. So what does ntop do with what it does receive?
A. ntop processes or queues all packets received from libpcap but may drop
packets if the processing queue fills up. Losing a few packets inside
ntop due to a rare burst of traffic is just that - rare, and is not a
'bug'.
If you consistently see packets dropped by ntop then you probably need
to use a faster processor (increasing the buffer size beyond the default
of 2K packets will usually not help).
Q. How do I tell?
A. You can monitor the queue size on the 'Configuration' (info.html) page.
Q. What about the other dropped items?
A. If you consistently see packets dropped at either the interface or
libpcap level, there is not much we can offer in the way of help for you.
The best suggestion is to try another NIC or a faster machine.
Q. Why?
A. Some NICs - especially ISA ones - are just too slow at moving packets
off of the card. Measurements I did on an old SMC 10BaseT card in 1993
showed that the best it could do - ISA bus, windows overhead, etc. all
rolled together was about 1.7Mbps.
Memory bus speeds (e.g. PC100 vs PC133, DDR333 vs DDR400, etc.) can also
affect moving packets from the NIC to main memory.
Q. Won't a faster CPU help?
A. Maybe. Some network card drivers are processor intensive - and would
benefit - but others offload most of the processing to the NIC, and so a
faster CPU wouldn't matter.
Even a fancy (read as expensive) NIC may not work well - the drivers
for the NIC on one OS may take advantage of features the card provides
and be 'faster', while the driver for the same NIC on another OS may
not take advantage of these features and be 'slower'.
As we say, YMMV...
Q. So?
A. So, remember - ntop drops packets, the kernel drops packets, libpcap
drops
packets and none of 'em do it the same way. Don't bet the farm on
counting
every packet with absolute accuracy and use ntop the way it was meant to
be used - showing the overall usage and flows on the network.
Still it's not all gloom and doom!
Even if you're only processing 90% of the traffic, since the drops are
pretty random, it's a decent bet that if 90% of what you DO see is MP3s,
then 90% of the whole traffic flow is probably MP3s.
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
Simon
Sent: Wednesday, August 31, 2005 11:30 AM
To: [email protected]; [email protected]
Subject: RE: [Ntop] % dropped (libpcap) increases over time
Hi Burton,
I am sorry as I am new to this mailing list. Here is my question again:
Problem Description:
The % Dropped (libpcap) increases gradually over time (increased from 3% to
20% gradually). It keeps on increasing everyday. The top result seems
normal, and ifconfig doesn't report any package dropped. I am wondering what
the problem could be coming from?
Thanks.
top - 12:23:14 up 5 days, 19:59, 2 users, load
average: 0.54, 0.90, 0.92
Tasks: 105 total, 1 running, 104 sleeping, 0
stopped, 0 zombie
Cpu(s): 5.3% us, 2.0% sy, 0.0% ni, 92.1% id, 0.3% wa, 0.3% hi, 0.0% si
Mem: 514504k total, 508532k used, 5972k free,
4560k buffers
Swap: 1052248k total, 165624k used, 886624k free,
97792k cached
ifconfig eth1
eth1 Link encap:Ethernet HWaddr
00:D0:B7:B3:2B:79
inet addr:172.21.128.31
Bcast:172.21.143.255 Mask:255.255.240.0
inet6 addr: fe80::2d0:b7ff:feb3:2b79/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500
Metric:1
RX packets:93650495 errors:0 dropped:0 overruns:0 frame:0
TX packets:1531207 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:174798367 (166.7 MiB) TX
bytes:279582326 (266.6 MiB)
OS: sysname(Linux) release(2.6.11-1.1369_FC4)
version(#1 Thu Jun 2 22:55:56 EDT 2005) machine(i686)
Hardware: 1 CPU 677MHz, Memory 512MB
Packets
Received: 57742324
Processed: 57742324 (immediately)
Queued: 0
Lost: 0 (queue full)
Queue: Current: 0 Maximum: 0
Network:
Merged packet counts:
Received: 57742324
Ethernet: 57742324
Broadcast: 1102866
Multicast: 25636
IP: 56630471
Network Interface 0 eth1
Received (pcap): 32680
Dropped (pcap): 7615
NIC Speed: 100MHz
Location: LAN
Bandwidth: DSL
Basic Information
ntop Version.....3.1 SourceForge RPM
Configured on.....Dec 21 2004 2:31:05
Built on.....Dec 21 2004 02:32:47
OS.....i686-redhat-linux-gnu
libpcap version.....libpcap version 0.8.3 ntop Process Id.....17533 http
Process Id.....17533
Command line
Started as........./usr/bin/ntop -i eth1 --user ntop --daemon --db-file-path
/usr/share/ntop --domain us.murex.com --interface eth1 --trace-level 3
--daemon
--use-syslog=local3 --http-server 3000
--disable-schedyield -d
Resolved to........./usr/bin/ntop -i eth1 --user ntop --daemon
--db-file-path /usr/share/ntop --domain us.murex.com --interface eth1
--trace-level 3 --daemon
--use-syslog=local3 --http-server 3000
--disable-schedyield -d
Preferences used
-a | --access-log-file.....(default) (nil)
-b | --disable-decoders.....(default) No
-c | --sticky-hosts.....(default) No
-d | --daemon.....Yes
-e | --max-table-rows.....(default) 128
-f | --traffic-dump-file.....(default) (nil)
-g | --track-local-hosts.....(default) Track all
hosts
-o | --no-mac.....(default) Trust MAC Addresses
-i | --interface (effective).....eth1
-j | --create-other-packets.....(default) Disabled
-k | --filter-expression-in-extra-frame.....(default)
No
-l | --pcap-log.....(default) (nil)
-m | --local-subnets (effective).....(default)
(nil)
-n | --numeric-ip-addresses.....(default) No
-p | --protocols.....(default) internal list
-q | --create-suspicious-packets.....(default)
Disabled
-r | --refresh-time.....(default) 120
-s | --no-promiscuous.....(default) No
-t | --trace-level.....(default) 3
-u | --user.....ntop (uid=100, gid=101)
-w | --http-server.....(default) Active, all
interfaces, port 3000
-z | --disable-sessions.....(default) No
-B | --filter-expression.....(default) none
-D | --domain.....us.murex.com
-F | --flow-spec.....(default) none
-K | --enable-debug.....(default) No
-L | --use-syslog.....local3
-M | --no-interface-merge (effective).....(default)
(Merging Interfaces) Yes
-N | --wwn-map.....(default) (nil)
-O | --pcap-file-path.....(default) /var/ntop
-P | --db-file-path...../usr/share/ntop
-Q | --spool-file-path...../usr/share/ntop
-U | --mapper.....(default) (nil)
-W | --https-server.....Uninitialized
--disable-schedYield.....Yes
--disable-instantsessionpurge.....(default) No
--disable-mutexextrainfo.....(default) No
--disable-stopcap.....(default) No
--fc-only.....(default) No
--no-fc.....(default) No
--no-invalid-lun.....(default) No
--p3p-cp.....(default) none
--p3p-uri.....(default) none
--pcap-nonblocking.....(default) No
--skip-version-check.....(default) No
--ssl-watchdog.....(default) No
--w3c.....(default) No
Run time/Internal
Web server URL.....http://any:3000
SSL Web server (https://).....Not Active
GDBM version.....This is GDBM version 1.8.0, as of May
19, 1999.
OpenSSL Version.....OpenSSL 0.9.7a Feb 19 2003
zlib version.....1.2.2.2
gd version (guess).....2.0.21+
Protocol Decoders.....Enabled
Fragment Handling.....Enabled
Tracking only local hosts.....No
# IP Protocols Being Monitored.....19
# Protocol slots.....978
# IP Ports Being Monitored.....174
# IP Ports slots.....348
WebServer Request Queue.....10
Devices (Network Interfaces).....1
Domain name (short).....com
IP to country flag table (entries).....52395
Total Hash Collisions (Vendor/Special) (lookup).....0
ntop Web Server
Item..................http://...................https://#
Handled Requests.....57954.....-
# Successful requests (200).....46841.....-
# Bad (We don't want to talk with you)
requests.....0.....-
# Invalid requests - 403 FORBIDDEN.....0.....-
# Invalid requests - 404 NOT FOUND.....3.....-
# Handled SIGPIPE Errors.....0
Memory allocation - data segment
arena limit, getrlimit(RLIMIT_DATA, ...).....-1
Allocated blocks (ordblks).....798
Allocated (arena).....14381056
Used (uordblks).....11319184
Free (fordblks).....3061872
Memory allocation - mmapped
Allocated blocks (hblks).....4
Allocated bytes (hblkhd).....5017600
Memory Usage
IPX/SAP Hash Size (bytes).....1897
IP to country flag table (bytes).....1614732 (1.5 MB)
Bytes per entry.....30.8
IP to AS (Autonomous System) number table
(bytes).....0 (0.0 MB)
Current memory usage.....19398656
Base memory usage.....9183232
Hosts stored (active+cache).....696 = (696 + 0)
(very) Approximate memory per host.....14.4KB
Host Memory Cache
Limit.....#define MAX_HOSTS_CACHE_LEN 512
Current Size.....0
Maximum Size.....0
# Entries Reused.....0
MAC/IPX Hash tables
IPX/SAP Hash Size (entries).....179
IPX/SAP Hash Collisions (load).....0
IPX/SAP Hash Collisions (use).....0
Packets
Received.....57776879
Processed Immediately.....57776879
Queued.....0
Current Queue.....0
Maximum Queue.....0
Host/Session counts - global
Purged Hosts.....78520
Terminated Sessions.....2,953,474
Host/Session counts - Device 0 (eth1)
Hash Bucket Size.....1.9 KB
Actual Hash Size.....16384
Stored hosts.....696
Bucket List Length.....[min 1][max 8][avg 1.1]
Max host lookup.....7
Session Bucket Size.....260
Sessions.....1,543
Max Num. Sessions.....2,120
----- Address Resolution -----
DNS Sniffing (other hosts requests)
DNS Packets sniffed.....2724387
less 'requests'.....1398960
less 'failed'.....69735
less 'reverse dns' (in-addr.arpa).....1104996
DNS Packets processed.....150696
Stored in cache (includes aliases).....105748
IP to name - ipaddr2str():
Total calls.....1100156
....OK.....0
....Total not found.....1100156
........Not found in cache.....1100149
........Too old in cache.....0
Queued - dequeueAddress()
Total Queued.....993502
Not queued (duplicate).....106654
Maximum Queued.....293
Current Queue.....104
Resolved - resolveAddress():
Addresses to resolve.....993398
....less 'Error: No cache database'.....0
....less 'Found in ntop cache'.....0
Gives: # gethost (DNS lookup) calls.....993398
DNS Lookup Calls:
DNS resolution attempts.....993398
....Success: Resolved.....945851
....Failed.....47547
........HOST_NOT_FOUND.....46716
........NO_DATA.....0
........NO_RECOVERY.....0
........TRY_AGAIN (don't store).....831
........Other error (don't store).....0
DNS lookups stored in cache.....992567
Host addresses kept numeric.....47547
Vendor Lookup Table
Input lines read.....0
Records added total.....0
.....includes special records.....0
getVendorInfo() calls.....0
getSpecialVendorInfo() calls.....9319
Found 48bit (xx:xx:xx:xx:xx:xx) match.....0
Found 24bit (xx:xx:xx) match.....9318
Found multicast bit set.....1
Found LAA (Locally assigned address) bit set.....0
Thread counts
Active.....8
Dequeue.....1
Children (active).....2135
Directory (search) order
Data Files......
/usr/share/ntop
Config Files......
/etc/ntop
/etc
Plugins....../plugins
/usr/lib/ntop/plugins
Compile Time: ./configure
./configure
parameters.....--host=i686-redhat-linux-gnu
--build=i686-redhat-linux-gnu
--target=i386-redhat-linux-gnu --program-prefix=
--prefix=/usr --exec-prefix=/usr --bindir=/usr/bin
--sbindir=/usr/sbin --sysconfdir=/etc
--datadir=/usr/share --includedir=/usr/include
--libdir=/usr/lib --libexecdir=/usr/libexec
--localstatedir=/var --sharedstatedir=/usr/com
--mandir=/usr/share/man --infodir=/usr/share/info
--enable-optimize --bindir=/usr/bin
--datadir=/usr/share --enable-sslv3 --enable-i18n
Built on (Host).....i686-redhat-linux-gnu
Built for(Target).....i386-redhat-linux-gnu
compiler (CFLAGS).....gcc -g -O2 -I/usr/local/include
-g -Wshadow -Wpointer-arith -Wmissing-prototypes
-Wmissing-declarations -Wnested-externs -fPIC
-DHAVE_CONFIG_H
include path.....(nil)
system libraries.....-L/usr/local/lib -lxml2 -lglib
-lpthread -lresolv -lnsl -lcrypt -lc -lssl -lcrypto
-lpcap -lgdbm -lgd -lpng -lz
install path...../usr
GNU C (gcc) version.....3.3.3 20040412 (Red Hat Linux
3.3.3-7) (3.3.3)
uname data.....sysname(Linux)
release(2.6.11-1.1369_FC4) version(#1 Thu Jun 2
22:55:56 EDT 2005) machine(i686)
Internationalization (i18n)
i18n enabled.....Yes
Locale directory (version.c)...../usr/lib/locale
Languages - per request
(Accept-Language:).....globals-defines.h: #define
MAX_LANGUAGES_REQUESTED 4
Languages supported - maximum.....globals-defines.h:
#define MAX_LANGUAGES_SUPPORTED 8
Languages supported - actual .....1
Default language.....en_US
Locale.....en_US.UTF-8
Numeric format.....1,000.00
Compile Time: Debug settings in globals-defines.h
DEBUG.....no
ADDRESS_DEBUG.....no
CHKVER_DEBUG.....no
CMPFCTN_DEBUG.....no
DNS_DEBUG.....no
DNS_SNIFF_DEBUG.....no
FC_DEBUG.....no
FINGERPRINT_DEBUG.....no
FRAGMENT_DEBUG.....no
FTP_DEBUG.....no
GDBM_DEBUG.....no
HASH_DEBUG.....no
HOST_FREE_DEBUG.....no
HTTP_DEBUG.....no
I18N_DEBUG.....no
IDLE_PURGE_DEBUG.....no
INITWEB_DEBUG.....no
MEMORY_DEBUG.....no
NETFLOW_DEBUG.....no
P2P_DEBUG.....no
PACKET_DEBUG.....no
PARAM_DEBUG.....no
PLUGIN_DEBUG.....no
PROBLEMREPORTID_DEBUG.....no
RRD_DEBUG.....no
SEMAPHORE_DEBUG.....no
SESSION_TRACE_DEBUG.....no
SSLWATCHDOG_DEBUG.....no
STORAGE_DEBUG.....no
UNKNOWN_PACKET_DEBUG.....no
URL_DEBUG.....no
VENDOR_DEBUG.....no
Compile Time: config.h
CFG_ETHER_HEADER_HAS_EA.....no
CFG_MULTITHREADED.....yes
CFG_NEED_INET_ATON.....no
HAVE_ALARM.....yes
HAVE_ALLOCA.....yes
HAVE_ALLOCA_H.....yes
HAVE_ARPA_INET_H.....yes
HAVE_ARPA_NAMESER_H.....yes
HAVE_BACKTRACE.....yes
HAVE_BZERO.....yes
HAVE_CRYPTGETFORMAT.....no
HAVE_CRYPT_H.....yes
HAVE_CTIME_R.....yes
HAVE_DIRENT_H.....yes
HAVE_DLFCN_H.....yes
HAVE_DL_H.....no
HAVE_DOPRNT.....no
HAVE_ENDPWENT.....yes
HAVE_ERRNO_H.....yes
HAVE_FACILITYNAMES.....yes
HAVE_FCNTL_H.....yes
HAVE_FINITE.....yes
HAVE_FLOAT_H.....yes
HAVE_FORK.....yes
HAVE_GDBM_H.....yes
HAVE_GD_H.....yes
HAVE_GDOME_H.....no
HAVE_GETHOSTBYADDR.....yes
HAVE_GETHOSTBYADDR_R.....yes
HAVE_GETHOSTBYNAME.....yes
HAVE_GETHOSTNAME.....yes
HAVE_GETIPNODEBYADDR.....no
HAVE_GETOPT_H.....yes
HAVE_GETPASS.....yes
HAVE_GETTIMEOFDAY.....yes
HAVE_GLIBCONFIG_H.....no
HAVE_GLIB_H.....no
HAVE_ICMP6_H.....no
HAVE_IEEEFP_H.....no
HAVE_IF_H.....no
HAVE_IFLIST_SYSCTL.....no
HAVE_IN6_ADDR.....yes
HAVE_INET_NTOA.....yes
HAVE_INT16_T.....yes
HAVE_INT32_T.....yes
HAVE_INT64_T.....yes
HAVE_INT8_T.....yes
HAVE_INTTYPES_H.....yes
HAVE_IP6_H.....no
HAVE_ISFINITE.....no
HAVE_ISINF.....yes
HAVE_LANGINFO_H.....yes
HAVE_LIBC.....yes
HAVE_LIBC_R.....no
HAVE_LIBCRYPT.....yes
HAVE_LIBCRYPTO.....yes
HAVE_LIBDL.....no
HAVE_LIBDLD.....no
HAVE_LIBGD.....yes
HAVE_LIBGDBM.....yes
HAVE_LIBGDOME.....no
HAVE_LIBGLIB.....yes
HAVE_LIBM.....no
HAVE_LIBNSL.....yes
HAVE_LIBPCAP.....yes
HAVE_LIBPNG.....yes
HAVE_LIBPOSIX4.....no
HAVE_LIBPTHREAD.....yes
HAVE_LIBPTHREADS.....no
HAVE_LIBRESOLV.....yes
HAVE_LIBRT.....no
HAVE_LIBSOCKET.....no
HAVE_LIBSSL.....yes
HAVE_LIBWRAP.....no
HAVE_LIBXML2.....yes
HAVE_LIBXNET.....no
HAVE_LIBZ.....yes
HAVE_LIMITS_H.....yes
HAVE_LINUX_IF_PPPOX_H.....yes
HAVE_LOCALE_H.....yes
HAVE_LOCALTIME_R.....yes
HAVE_LONG_DOUBLE.....yes
HAVE_MALLINFO_MALLOC_H.....yes
HAVE_MALLOC_H.....yes
HAVE_MATH_H.....yes
HAVE_MEMCHR.....yes
HAVE_MEMORY_H.....yes
HAVE_MEMSET.....yes
HAVE_NDIR_H.....no
HAVE_NET_BPF_H.....no
HAVE_NETDB_H.....yes
HAVE_NET_ETHERNET_H.....yes
HAVE_NET_IF_DL_H.....no
HAVE_NET_IF_H.....yes
HAVE_NETINET_ICMP6_H.....yes
HAVE_NETINET_IF_ETHER_H.....yes
HAVE_NETINET_IN_H.....yes
HAVE_NETINET_IN_SYSTM_H.....yes
HAVE_NETINET_IP6_H.....yes
HAVE_NETINET_IP_H.....yes
HAVE_NETINET_TCP_H.....yes
HAVE_NETINET_UDP_H.....yes
HAVE_NET_PPP_DEFS_H.....yes
HAVE_NET_ROUTE_H.....yes
HAVE_NET_SNMP_NET_SNMP_CONFIG_H.....no
HAVE_OPENSSL.....yes
HAVE_OPENSSL_CRYPTO_H.....yes
HAVE_OPENSSL_ERR_H.....yes
HAVE_OPENSSL_PEM_H.....yes
HAVE_OPENSSL_RSA_H.....yes
HAVE_OPENSSL_SSL_H.....yes
HAVE_OPENSSL_X509_H.....yes
HAVE_PCAP_BPF_H.....yes
HAVE_PCAP_FINDALLDEVS.....yes
HAVE_PCAP_H.....yes
HAVE_PCAP_OPEN_DEAD.....yes
HAVE_PCAP_SETNONBLOCK.....yes
HAVE_PNG_H.....yes
HAVE_PTHREAD_ATFORK.....yes
HAVE_PTHREAD_H.....yes
HAVE_PUTENV.....yes
HAVE_PWD_H.....yes
HAVE_RE_COMP.....yes
HAVE_REGCOMP.....yes
HAVE_REGEX.....yes
HAVE_SCHED_H.....yes
HAVE_SCHED_YIELD.....yes
HAVE_SCTP.....no
HAVE_SECURITY_PAM_APPL_H.....yes
HAVE_SELECT.....yes
HAVE_SEMAPHORE_H.....yes
HAVE_SETJMP_H.....yes
HAVE_SHADOW_H.....yes
HAVE_SIGNAL_H.....yes
HAVE_SNMP.....no
HAVE_SNPRINTF.....yes
HAVE_SOCKET.....yes
HAVE_SQRT.....yes
HAVE_STAT_EMPTY_STRING_BUG.....no
HAVE_STDARG_H.....yes
HAVE_STDDEF_H.....yes
HAVE_STDINT_H.....yes
HAVE_STDIO_H.....yes
HAVE_STDLIB_H.....yes
HAVE_STRCASECMP.....yes
HAVE_STRCHR.....yes
HAVE_STRCSPN.....yes
HAVE_STRDUP.....yes
HAVE_STRERROR.....yes
HAVE_STRFTIME.....yes
HAVE_STRING_H.....yes
HAVE_STRINGS_H.....yes
HAVE_STRNCASECMP.....yes
HAVE_STRPBRK.....yes
HAVE_STRRCHR.....yes
HAVE_STRSPN.....yes
HAVE_STRSTR.....yes
HAVE_STRTOK_R.....yes
HAVE_STRTOUL.....yes
HAVE_STRUCT_TM_TM_ZONE.....yes
HAVE_SYSCTL.....yes
HAVE_SYS_DIR_H.....no
HAVE_SYS_IOCTL_H.....yes
HAVE_SYS_LDR_H.....no
HAVE_SYSLOG_H.....yes
HAVE_SYS_NDIR_H.....no
HAVE_SYS_PARAM_H.....yes
HAVE_SYS_RESOURCE_H.....yes
HAVE_SYS_SCHED_H.....no
HAVE_SYS_SELECT_H.....yes
HAVE_SYS_SOCKET_H.....yes
HAVE_SYS_SOCKIO_H.....no
HAVE_SYS_STAT_H.....yes
HAVE_SYS_SYSCTL_H.....yes
HAVE_SYS_SYSLOG_H.....yes
HAVE_SYS_TIME_H.....yes
HAVE_SYS_TYPES_H.....yes
HAVE_SYS_UN_H.....yes
HAVE_SYS_UTSNAME_H.....yes
HAVE_SYS_WAIT_H.....yes
HAVE_TCPD_H.....yes
HAVE_TM_ZONE.....yes
HAVE_TZNAME.....no
HAVE_U_INT16_T.....yes
HAVE_U_INT32_T.....yes
HAVE_U_INT64_T.....yes
HAVE_UINT64_T.....no
HAVE_U_INT8_T.....yes
HAVE_UNAME.....yes
HAVE_UNISTD_H.....yes
HAVE_VFORK.....yes
HAVE_VFORK_H.....no
HAVE_VPRINTF.....yes
HAVE_WORKING_FORK.....yes
HAVE_WORKING_VFORK.....yes
HAVE_ZLIB_H.....yes
INET6.....yes
LSTAT_FOLLOWS_SLASHED_SYMLINK.....yes
MAKE_STATIC_PLUGIN.....no
MAKE_WITH_I18N.....yes
MAKE_WITH_SNMP.....no
MAKE_WITH_SSLV3_SUPPORT.....yes
MAKE_WITH_SSLWATCHDOG_COMPILETIME.....no
MAKE_WITH_ZLIB.....yes
SETVBUF_REVERSED.....no
STDC_HEADERS.....yes
TIME_WITH_SYS_TIME.....yes
TM_IN_SYS_TIME.....no
CFG_CONFIGFILE_DIR - config file
directory...../etc/ntop
CFG_DATAFILE_DIR - data file
directory...../usr/share/ntop
CFG_DBFILE_DIR - database file directory...../var/ntop
CFG_PLUGIN_DIR - plugin file
directory...../usr/lib/ntop/plugins
CFG_RUN_DIR - run file directory...../var/ntop
CFG_NEED_GETDOMAINNAME (getdomainname(2)
function).....yes
CFG_xxxxxx_ENDIAN (Hardware Endian).....little
Compile Time: globals-defines.h
CONST_ABTNTOP_HTML.....aboutNtop.html
CONST_ACTIVE_TCP_SESSIONS_HTML.....NetNetstat.html
CONST_ADD_URLS_HTML.....addURLs.html
CONST_ADD_USERS_HTML.....addUsers.html
CONST_APACHELOG_TIMESPEC.....%d/%b/%Y:%H:%M:%S
CONST_ASLIST_FILE.....AS-list.txt
CONST_AS_LIST_HTML.....asList.html
CONST_BAR_ALLPROTO_DIST.....allProtoDistribution
CONST_BAR_FC_PROTO_DIST.....fcProtoDistribution
CONST_BAR_HOST_DISTANCE.....hostsDistanceChart
CONST_BAR_LUNSTATS_DIST.....ScsiBytesLunDistribution
CONST_BAR_VSAN_TRAF_DIST_RCVD.....vsanDomainTrafficDistribRcvd
CONST_BAR_VSAN_TRAF_DIST_SENT.....vsanDomainTrafficDistribSent
CONST_BROADCAST_ENTRY.....2
CONST_CGI_HEADER.....ntop-bin/
CONST_CHANGE_FILTER_HTML.....changeFilter.html
CONST_COLOR_1.....#CCCCFF
CONST_COLOR_2.....#FFCCCC
CONST_CONFIG_NTOP_HTML.....configNtop.html
CONST_CONST_PCTG_LOW_COLOR.....BGCOLOR=#C6EEF7
CONST_CONST_PCTG_MID_COLOR.....BGCOLOR=#C6EFC8
CONST_CREDITS_HTML.....Credits.html
CONST_CRYPT_SALT.....99
CONST_DAEMONNAME.....ntop
CONST_DELETE_URL.....deleteURL
CONST_DELETE_USER.....deleteUser
CONST_DNSCACHE_LIFETIME.....86400
CONST_DNSCACHE_PERMITTED_AGE.....900
CONST_DO_ADD_URL.....doAddURL
CONST_DO_ADD_USER.....doAddUser
CONST_DO_CHANGE_FILTER.....doChangeFilter
CONST_DOMAIN_STATS_HTML.....domainStats.html
CONST_DOUBLE_TWO_MSL_TIMEOUT.....240
CONST_DUMP_DATA_HTML.....dumpData.html
CONST_DUMP_HOSTS_INDEXES_HTML.....dumpDataIndexes.html
CONST_DUMP_NTOP_FLOWS_HTML.....dumpFlows.html
CONST_DUMP_NTOP_HOSTS_MATRIX_HTML.....dumpHostsMatrix.html
CONST_DUMP_NTOP_XML.....dump.xml
CONST_DUMP_TRAFFIC_DATA_HTML.....dumpTrafficData.html
CONST_ETTERCAP_FINGERPRINT.....fingerprint.php
CONST_ETTERCAP_HOMEPAGE.....http://ettercap.sourceforge.net/
CONST_FAVICON_ICO.....favicon.ico
CONST_FC_ACTIVITY_HTML.....fcActivity.html
CONST_FC_DATA_HTML.....fcData.html
CONST_FC_HOSTS_INFO_HTML.....fcHostsInfo.html
CONST_FC_SESSIONS_HTML.....FcSessions.html
CONST_FC_THPT_HTML.....fcThpt.html
CONST_FC_TRAFFIC_HTML.....fcShowStats.html
CONST_FILTER_INFO_HTML.....filterInfo.html
CONST_FINGERPRINT_LOOP_INTERVAL.....150
CONST_FTPDATA.....20
CONST_GRE_PROTOCOL_TYPE.....47
CONST_HANDLEADDRESSLISTS_MAIN.....0
CONST_HANDLEADDRESSLISTS_NETFLOW.....2
CONST_HANDLEADDRESSLISTS_RRD.....yes
CONST_HASH_INITIAL_SIZE.....16384
CONST_HOME_HTML.....home.html
CONST_HOME_UNDERSCORE_HTML.....home_.html
CONST_HOST_HTML.....host.html
CONST_HOSTS_INFO_HTML.....hostsInfo.html
CONST_HOSTS_LOCAL_CHARACT_HTML.....localHostsCharacterization.html
CONST_HOSTS_LOCAL_FINGERPRINT_HTML.....localHostsFingerprint.html
CONST_HOST_SORT_NOTE_HTML.....hostSortNote.html
CONST_HOSTS_REMOTE_FINGERPRINT_HTML.....remoteHostsFingerprint.html
CONST_HTTP_ACCEPT_ALL.....*/*
CONST_IMG_ARROW_DOWN.....
CONST_IMG_ARROW_UP.....
CONST_IMG_BRIDGE.....
CONST_IMG_DHCP_CLIENT.....
CONST_IMG_DHCP_SERVER.....
CONST_IMG_DIRECTORY_SERVER.....(nil)
CONST_IMG_DNS_SERVER.....
CONST_IMG_FC_VEN_BROCADE.....
CONST_IMG_FC_VEN_EMC.....
CONST_IMG_FC_VEN_EMULEX.....
CONST_IMG_FC_VEN_JNI.....
CONST_IMG_FC_VEN_SEAGATE.....
CONST_IMG_FIBRECHANNEL_SWITCH.....
CONST_IMG_FTP_SERVER.....(nil)
CONST_IMG_HAS_P2P.....
CONST_IMG_HAS_USERS.....
CONST_IMG_HIGH_RISK.....
CONST_IMG_HTTP_SERVER.....
CONST_IMG_IMAP_SERVER.....(nil)
CONST_IMG_LOCK.....
CONST_IMG_LOW_RISK.....
CONST_IMG_MEDIUM_RISK.....
CONST_IMG_MULTIHOMED.....
CONST_IMG_NIC_CARD.....
CONST_IMG_NTP_SERVER.....
CONST_IMG_OS_AIX.....
CONST_IMG_OS_BERKELEY.....
CONST_IMG_OS_BSD.....
CONST_IMG_OS_CISCO.....
CONST_IMG_OS_HP_JETDIRET.....
CONST_IMG_OS_HP_UX.....
CONST_IMG_OS_IRIX.....
CONST_IMG_OS_LINUX.....
CONST_IMG_OS_MAC.....
CONST_IMG_OS_NOVELL.....
CONST_IMG_OS_SOLARIS.....
CONST_IMG_OS_SUNOS.....
CONST_IMG_OS_UNIX.....
CONST_IMG_OS_WINDOWS.....
CONST_IMG_POP_SERVER.....(nil)
CONST_IMG_PRINTER.....
CONST_IMG_ROUTER.....
CONST_IMG_SCSI_DISK.....
CONST_IMG_SCSI_INITIATOR.....
CONST_IMG_SMTP_SERVER.....
CONST_INDEX_HTML.....index.html
CONST_INDEX_INNER_HTML.....index_inner.html
CONST_INFOHTML_COL1_WIDTH.....250
CONST_INFOHTML_COL23_WIDTH.....350
CONST_INFOHTML_COL2_WIDTH.....175
CONST_INFOHTML_COL3_WIDTH.....175
CONST_INFOHTML_WIDTH.....600
CONST_INFO_NTOP_HTML.....info.html
CONST_INVALIDNETMASK.....-1
CONST_IP_L_2_L_HTML.....ipL2L.html
CONST_IP_L_2_R_HTML.....ipL2R.html
CONST_IP_PROTO_DISTRIB_HTML.....ipProtoDistrib.html
CONST_IP_PROTO_USAGE_HTML.....ipProtoUsage.html
CONST_IP_R_2_L_HTML.....ipR2L.html
CONST_IP_R_2_R_HTML.....ipR2R.html
CONST_IP_TRAFFIC_MATRIX_HTML.....ipTrafficMatrix.html
CONST_ISO8601_TIMESPEC.....%Y-%m-%dT%H:%M:%S
CONST_LEFTMENU_HTML.....leftmenu.html
CONST_LEFTMENU_NOJS_HTML.....leftmenu-nojs.html
CONST_LEGEND_BOX_SIZE.....7
CONST_LIBGD_SO.....libgd.so
CONST_LOCALE_TIMESPEC.....%c
CONST_LOCAL_ROUTERS_LIST_HTML.....localRoutersList.html
CONST_LOG_VIEW_BUFFER_SIZE.....50
CONST_MAGIC_NUMBER.....1968
CONST_MAN_NTOP_HTML.....ntop.html
CONST_MODIFY_URL.....modifyURL
CONST_MODIFY_USERS.....modifyUsers
CONST_MULTICAST_MASK.....-536870912
CONST_MULTICAST_STATS_HTML.....multicastStats.html
CONST_NET_FLOWS_HTML.....NetFlows.html
CONST_NETMASK_ENTRY.....1
CONST_NETWORK_ENTRY.....0
CONST_NTOP_HELP_HTML.....help.html
CONST_NTOP_P3P.....ntop.p3p
CONST_NULL_HDRLEN.....4
CONST_NUM_TABLE_ROWS_PER_PAGE.....128
CONST_NUM_TRANSACTION_ENTRIES.....256
CONST_OSFINGERPRINT_FILE.....etter.finger.os
CONST_P2C_FILE.....p2c.opt.table
CONST_PACKET_QUEUE_LENGTH.....2048
CONST_PATH_SEP.....47
CONST_PCAPNONBLOCKING_SLEEP_TIME.....30000000
CONST_PCAP_NW_INTERFACE_FILE.....pcap file
CONST_PCTG_HIGH_COLOR.....BGCOLOR=#FF3118
CONST_PCTG_LOW.....25
CONST_PCTG_MID.....75
CONST_PIE_FC_PKT_SZ_DIST.....fcPktSizeDistribPie
CONST_PIE_INTERFACE_DIST.....interfaceTrafficPie
CONST_PIE_IP_TRAFFIC.....ipTrafficPie
CONST_PIE_PKT_CAST_DIST.....pktCastDistribPie
CONST_PIE_PKT_SIZE_DIST.....pktSizeDistribPie
CONST_PIE_TTL_DIST.....pktTTLDistribPie
CONST_PIE_VSAN_CNTL_TRAF_DIST.....vsanControlTrafficDistribPie
CONST_PLUGIN_ENTRY_FCTN_NAME.....PluginEntryFctn
CONST_PLUGIN_EXTENSION......so
CONST_PLUGINS_HEADER.....plugins/
CONST_PPP_HDRLEN.....4
CONST_PPP_PROTOCOL_TYPE.....34827
CONST_PRIVACYCLEAR_HTML.....privacyFlagClear.html
CONST_PRIVACYFORCE_HTML.....privacyFlagForce.html
CONST_PRIVACYNOTICE_HTML.....privacyNotice.html
CONST_PROBLEMRPT_HTML.....ntopProblemReport.html
CONST_REPORT_ITS_DEFAULT.....(default)
CONST_REPORT_ITS_EFFECTIVE..... (effective)
CONST_RESET_STATS_HTML.....resetStats.html
CONST_RFC1945_TIMESPEC.....%a, %d %b %Y %H:%M:%S GMT
CONST_RRD_EXTENSION......rrd
CONST_SCSI_BYTES_HTML.....ScsiBytes.html
CONST_SCSI_STATUS_HTML.....ScsiStatus.html
CONST_SCSI_TIMES_HTML.....ScsiTimes.html
CONST_SCSI_TM_HTML.....ScsiTMInfo.html
CONST_SFLOW_TCPDUMP_MAGIC.....-1582119980
CONST_SHOW_MUTEX_HTML.....showMutex.html
CONST_SHOW_PLUGINS_HTML.....showPlugins.html
CONST_SHOW_PORT_TRAFFIC_HTML.....showPortTraffic.html
CONST_SHOW_URLS_HTML.....showURLs.html
CONST_SHOW_USERS_HTML.....showUsers.html
CONST_SHUTDOWN_NTOP_HTML.....shutdown.html
CONST_SIZE_PCAP_ERR_BUF.....512
CONST_SORT_DATA_HOST_TRAFFIC_HTML.....dataHostTraffic.html
CONST_SORT_DATA_IP_HTML.....sortDataIP.html
CONST_SORT_DATA_PROTOS_HTML.....sortDataProtos.html
CONST_SORT_DATA_RCVD_HOST_TRAFFIC_HTML.....dataRcvdHostTraffic.html
CONST_SORT_DATA_SENT_HOST_TRAFFIC_HTML.....dataSentHostTraffic.html
CONST_SORT_DATA_THPT_HTML.....sortDataThpt.html
CONST_SORT_DATA_THPT_STATS_HTML.....thptStats.html
CONST_SSL_CERTF_FILENAME.....ntop-cert.pem
CONST_SWITCH_NIC_HTML.....switch.html
CONST_TEXT_INFO_NTOP_HTML.....textinfo.html
CONST_THPTLABEL_TIMESPEC.....%d/%m
CONST_THPT_STATS_MATRIX_HTML.....thptStatsMatrix.html
CONST_THROUGHPUT_GRAPH.....thptGraph
CONST_TOD_HOUR_TIMESPEC.....%H
CONST_TOD_NOSEC_TIMESPEC.....%H:%M
CONST_TOD_WSEC_TIMESPEC.....%H:%M:%S
CONST_TRAFFIC_STATS_HTML.....trafficStats.html
CONST_TRAFFIC_SUMMARY_HTML.....trafficSummary.html
CONST_TRMTU.....2000
CONST_TWO_MSL_TIMEOUT.....120
CONST_UNKNOWN_MTU.....65355
CONST_VERY_DETAIL_TRACE_LEVEL.....6
CONST_VIEW_LOG_HTML.....viewLog.html
CONST_VLAN_LIST_HTML.....vlanList.html
CONST_VSAN_DETAIL_HTML.....vsanDetail.html
CONST_VSAN_DISTRIB_HTML.....vsanDistrib.html
CONST_VSAN_LIST_HTML.....vsanList.html
CONST_W3C_CHARTYPE_LINE.....
CONST_W3C_DOCTYPE_LINE_32.....
CONST_W3C_DOCTYPE_LINE.....
CONST_W3C_P3P_XML.....w3c/p3p.xml
CONST_WIN32_PATH_NETWORKS.....networks
CONST_XML_DOCTYPE_NAME.....ntop_dump
CONST_XML_DTD_NAME.....ntopdump.dtd
CONST_XMLDUMP_PLUGIN_NAME.....xmldump
CONST_XML_TMP_NAME...../tmp/ntop-xml
CONTACTED_PEERS_THRESHOLD.....1024
DEFAULT_AS_LOOKUP_URL.....http://ws.arin.net/cgi-bin/whois.pl?queryinput=AS
DEFAULT_NETFLOW_PORT_STR.....2055
DEFAULT_NTOP_ACCESS_LOG_FILE.....(null)
DEFAULT_NTOP_AUTOREFRESH_INTERVAL.....120
DEFAULT_NTOP_DAEMON_MODE.....0
DEFAULT_NTOP_DEBUG.....0
DEFAULT_NTOP_DEBUG_MODE.....0
DEFAULT_NTOP_DEVICES.....(null)
DEFAULT_NTOP_DISABLE_PROMISCUOUS.....0
DEFAULT_NTOP_DOMAIN_NAME.....(nil)
DEFAULT_NTOP_DONT_TRUST_MAC_ADDR.....0
DEFAULT_NTOP_ENABLE_SESSIONHANDLE.....yes
DEFAULT_NTOP_FAMILY.....0
DEFAULT_NTOP_FCNS_FILE.....(null)
DEFAULT_NTOP_FILTER_EXPRESSION.....(null)
DEFAULT_NTOP_FILTER_IN_FRAME.....0
DEFAULT_NTOP_FLOW_SPECS.....(null)
DEFAULT_NTOP_LOCAL_SUBNETS.....(null)
DEFAULT_NTOP_MAX_HASH_ENTRIES.....16384
DEFAULT_NTOP_MAX_NUM_SESSIONS.....32768
DEFAULT_NTOP_MERGE_INTERFACES.....yes
DEFAULT_NTOP_NUMERIC_IP_ADDRESSES.....0
DEFAULT_NTOP_OTHER_PKT_DUMP.....0
DEFAULT_NTOP_P3PCP.....(null)
DEFAULT_NTOP_P3PURI.....(null)
DEFAULT_NTOP_PACKET_DECODING.....yes
DEFAULT_NTOP_PCAP_LOG_FILENAME.....(null)
DEFAULT_NTOP_PID_DIRECTORY...../var/run
DEFAULT_NTOP_PIDFILE.....ntop.pid
DEFAULT_NTOP_PROTO_SPECS.....(null)
DEFAULT_NTOP_SAMPLING.....yes
DEFAULT_NTOP_SETNONBLOCK.....0
DEFAULT_NTOP_STICKY_HOSTS.....0
DEFAULT_NTOP_SUSPICIOUS_PKT_DUMP.....0
DEFAULT_NTOP_TRACK_ONLY_LOCAL.....0
DEFAULT_NTOP_TRAFFICDUMP_FILENAME.....(null)
DEFAULT_NTOP_WEB_ADDR.....(null)
DEFAULT_NTOP_WEB_PORT.....3000
DEFAULT_SFLOW_PORT_STR.....6343
DEFAULT_SFLOW_SAMPLING_RATE.....400
DEFAULT_SNAPLEN.....384
DEFAULT_SYSLOG_FACILITY.....24
DEFAULT_TCPWRAP_ALLOW.....undefined
DEFAULT_TCPWRAP_DENY.....undefined
DEFAULT_TRACE_LEVEL.....3
DEFAULT_VSAN.....yes
DEFAULT_WEBSERVER_REQUEST_QUEUE_LEN.....10
EMSGSIZE.....90
ETHERMTU.....1500
IP_L4_PORT_CHARGEN.....19
IP_L4_PORT_DAYTIME.....13
IP_L4_PORT_DISCARD.....9
IP_L4_PORT_ECHO.....7
IP_TCP_PORT_FTP.....21
IP_TCP_PORT_GNUTELLA1.....6346
IP_TCP_PORT_GNUTELLA2.....6347
IP_TCP_PORT_GNUTELLA3.....6348
IP_TCP_PORT_HTTP.....80
IP_TCP_PORT_HTTPS.....443
IP_TCP_PORT_IMAP.....143
IP_TCP_PORT_JETDIRECT.....9100
IP_TCP_PORT_KAZAA.....1214
IP_TCP_PORT_MSMSGR.....1863
IP_TCP_PORT_NTOP.....3000
IP_TCP_PORT_POP2.....109
IP_TCP_PORT_POP3.....110
IP_TCP_PORT_PRINTER.....515
IP_TCP_PORT_SMTP.....25
IP_TCP_PORT_SQUID.....3128
IP_TCP_PORT_SSH.....22
IP_TCP_PORT_WINMX.....6699
LEN_ADDRESS_BUFFER.....44
LEN_CMDLINE_BUFFER.....4096
LEN_ETHERNET_ADDRESS_DISPLAY.....18
LEN_ETHERNET_ADDRESS.....6
LEN_ETHERNET_VENDOR_DISPLAY.....9
LEN_ETHERNET_VENDOR.....3
LEN_FC_ADDRESS_DISPLAY.....9
LEN_FC_ADDRESS.....3
LEN_FGETS_BUFFER.....512
LEN_GENERAL_WORK_BUFFER.....1024
LEN_MEDIUM_WORK_BUFFER.....128
LEN_SMALL_WORK_BUFFER.....24
LEN_TIMEFORMAT_BUFFER.....48
LEN_WWN_ADDRESS_DISPLAY.....24
LEN_WWN_ADDRESS.....8
MAKE_ASYNC_ADDRESS_RESOLUTION.....yes
MAKE_NTOP_PACKETSZ_DECLARATIONS.....no
MAKE_WITH_FORK_COPYONWRITE.....yes
MAKE_WITH_HTTPSIGTRAP.....no
MAKE_WITH_LOG_XXXXXX.....no
MAKE_WITH_NETFLOWSIGTRAP.....no
MAKE_WITH_SCHED_YIELD.....yes
MAKE_WITH_SEMAPHORES.....yes
MAKE_WITH_SSLWATCHDOG.....yes
MAKE_WITH_SSLWATCHDOG_RUNTIME.....yes
MAKE_WITH_SYSLOG.....yes
MAX_ADDRESSES.....35
MAX_ALIASES.....35
MAX_ASSIGNED_IP_PORTS.....1024
MAXCDNAME.....255
MAX_DEVICE_NAME_LEN.....64
MAX_DLT_ARRAY.....123
MAXDNAME.....1025
MAX_ELEMENT_HASH.....4096
MAX_FC_DOMAINS.....240
MAX_HASHDUMP_ENTRY.....65535
MAXHOSTNAMELEN.....64
MAX_HOSTS_CACHE_LEN.....512
MAX_HOSTS_PURGE_PER_CYCLE.....undefined
MAX_IP_PORT.....65534
MAXLABEL.....63
MAX_LANGUAGES_REQUESTED.....4
MAX_LANGUAGES_SUPPORTED.....8
MAX_LASTSEEN_TABLE_SIZE.....4096
MAX_LEN_SYM_HOST_NAME_HTML.....256
MAX_LEN_SYM_HOST_NAME.....64
MAX_LEN_URL.....512
MAX_LEN_VENDOR_NAME.....64
MAX_NFS_NAME_HASH.....12288
MAX_NODE_TYPES.....8
MAX_NUM_BAD_IP_ADDRESSES.....3
MAX_NUM_CONTACTED_PEERS.....8
MAX_NUM_DEQUEUE_THREADS.....1
MAX_NUM_DEVICES.....32
MAX_NUM_DEVICES_VIRTUAL.....7
MAX_NUM_DHCP_MSG.....8
MAX_NUM_FIN.....4
MAX_NUM_IGNOREDFLOWS.....32
MAX_NUM_LIST_ENTRIES.....32
MAX_NUM_NETWORKS.....32
MAX_NUM_OS.....256
MAX_NUM_PROBES.....16
MAX_NUM_PROTOS.....64
MAX_NUM_PURGED_SESSIONS.....512
MAX_NUM_PWFILE_ENTRIES.....32
MAX_NUM_QUEUED_ADDRESSES.....4096
MAX_NUM_RECENT_PORTS.....5
MAX_NUM_ROUTERS.....512
MAX_NUM_STORED_FLAGS.....4
MAX_NUM_UNKNOWN_PROTOS.....5
MAX_PACKET_LEN.....8232
MAX_PASSIVE_FTP_SESSION_TRACKER.....384
MAX_PDA_HOST_TABLE.....4096
MAX_PER_DEVICE_HASH_LIST.....65535
MAX_SESSIONS_CACHE_LEN.....512
MAX_SSL_CONNECTIONS.....32
MAX_SUBNET_HOSTS.....1024
MAX_TOT_NUM_SESSIONS.....65535
MAX_USER_VSAN.....1001
MAX_VLAN.....4096
MAX_VSANS_GRAPHED.....10
MAX_VSANS.....4095
MAX_WEBSERVER_REQUEST_QUEUE_LEN.....20
MAX_WIN32_NET_ALIASES.....35
MIN_SLICE_PERCENTAGE.....0
MIN_WEBSERVER_REQUEST_QUEUE_LEN.....2
NAME_MAX.....255
NETDB_SUCCESS.....0
NETFLOW_DEVICE_NAME.....NetFlow-device
NS_CMPRSFLGS.....192
NS_MAXCDNAME.....255
NTOP_PREF_ACCESS_LOG.....ntop.accessLogFile
NTOP_PREF_CAPFILE.....ntop.rFileName
NTOP_PREF_DAEMON.....ntop.daemonMode
NTOP_PREF_DBG_MODE.....ntop.debugMode
NTOP_PREF_DEVICES.....ntop.devices
NTOP_PREF_DOMAINNAME.....ntop.domainName
NTOP_PREF_DUMP_OTHER.....ntop.enableOtherPacketDump
NTOP_PREF_DUMP_SUSP.....ntop.enableSuspiciousPacketDump
NTOP_PREF_EN_PROTO_DECODE.....ntop.enablePacketDecoding
NTOP_PREF_EN_SESSION.....ntop.enableSessionHandling
NTOP_PREF_FILTER_EXTRA_FRM.....ntop.filterExpressionInExtraFrame
NTOP_PREF_FILTER.....ntop.currentFilterExpression
NTOP_PREF_FLOWSPECS.....ntop.flowSpecs
NTOP_PREF_IPV4.....ntop.ipv4
NTOP_PREF_IPV4V6.....ntop.ipv4orv6
NTOP_PREF_IPV6.....ntop.ipv6
NTOP_PREF_LOCALADDR.....ntop.localAddresses
NTOP_PREF_MAPPERURL.....ntop.mapperURL
NTOP_PREF_MAXHASH.....ntop.maxNumHashEntries
NTOP_PREF_MAXLINES.....ntop.maxNumLines
NTOP_PREF_MAXSESSIONS.....ntop.maxNumSessions
NTOP_PREF_MERGEIF.....ntop.mergeInterfaces
NTOP_PREF_NOBLOCK.....ntop.setNonBlocking
NTOP_PREF_NO_INVLUN.....ntop.noInvalidLunDisplay
NTOP_PREF_NO_ISESS_PURGE.....ntop.disableInstantSessionPurge
NTOP_PREF_NO_MUTEX_EXTRA.....ntop.disableMutexExtraInfo
NTOP_PREF_NO_PROMISC.....ntop.disablePromiscuousMode
NTOP_PREF_NO_SCHEDYLD.....ntop.schedYield
NTOP_PREF_NO_STOPCAP.....ntop.disableStopcap
NTOP_PREF_NO_TRUST_MAC.....ntop.dontTrustMACaddr
NTOP_PREF_NUMERIC_IP.....ntop.numericFlag
NTOP_PREF_P3PCP.....ntop.P3Pcp
NTOP_PREF_P3PURI.....ntop.P3Puri
NTOP_PREF_PCAP_LOGBASE.....ntop.pcapLogBasePath
NTOP_PREF_PCAP_LOG.....ntop.pcapLog
NTOP_PREF_PRINT_FCORIP.....ntop.printFcOrIp
NTOP_PREF_PROTOSPECS.....ntop.protoSpecs
NTOP_PREF_REFRESH_RATE.....ntop.refreshRate
NTOP_PREF_SAMPLING.....ntop.sampleRate
NTOP_PREF_SPOOLPATH.....ntop.spoolPath
NTOP_PREF_SSLPORT.....ntop.sslPort
NTOP_PREF_STICKY_HOSTS.....ntop.stickyHosts
NTOP_PREF_TRACE_LVL.....ntop.traceLevel
NTOP_PREF_TRACK_LOCAL.....ntop.trackOnlyLocalHosts
NTOP_PREF_USE_SSLWATCH.....ntop.useSSLwatchdog
NTOP_PREF_USE_SYSLOG.....ntop.useSyslog
NTOP_PREF_VALUE_AF_BOTH.....0
NTOP_PREF_VALUE_AF_INET6.....10
NTOP_PREF_VALUE_AF_INET.....2
NTOP_PREF_VALUE_PRINT_BOTH.....3
NTOP_PREF_VALUE_PRINT_FCONLY.....2
NTOP_PREF_VALUE_PRINT_IPONLY.....yes
NTOP_PREF_W3C.....ntop.w3c
NTOP_PREF_WEBPORT.....ntop.webPort
NTOP_PREF_WWN_MAP.....ntop.fcNSCacheFile
NULL_VALUE.....(null)
PACKETSZ.....512
PARM_ENABLE_EXPERIMENTAL.....no
PARM_FORK_CHILD_PROCESS.....yes
PARM_HOST_PURGE_INTERVAL.....120
PARM_HOST_PURGE_MINIMUM_IDLE_ACTVSES.....1800
PARM_HOST_PURGE_MINIMUM_IDLE_NOACTVSES.....600
PARM_MIN_WEBPAGE_AUTOREFRESH_TIME.....15
PARM_PASSIVE_SESSION_MINIMUM_IDLE.....60
PARM_PRINT_ALL_SESSIONS.....no
PARM_SESSION_PURGE_MINIMUM_IDLE.....600
PARM_SHOW_NTOP_HEARTBEAT.....no
PARM_SSLWATCHDOG_WAIT_INTERVAL.....3
PARM_SSLWATCHDOG_WAITWOKE_LIMIT.....5
PARM_THROUGHPUT_REFRESH_INTERVAL.....30
PARM_USE_CGI.....yes
PARM_USE_COLOR.....no
PARM_USE_HOST.....no
PARM_USE_MACHASH_INVERT.....yes
PARM_USE_SESSIONS_CACHE.....no
PARM_WEDONTWANTTOTALKWITHYOU_INTERVAL.....300
SFLOW_DEVICE_NAME.....sFlow-device
THREAD_MODE.....MT (SSL)
UNKNOWN_P2P_FILE.....<unknown file>
ADDRESS_DEBUG.....no
CHKVER_DEBUG.....no
CMPFCTN_DEBUG.....no
DNS_DEBUG.....no
DNS_SNIFF_DEBUG.....no
FC_DEBUG.....no
FINGERPRINT_DEBUG.....no
FRAGMENT_DEBUG.....no
FTP_DEBUG.....no
GDBM_DEBUG.....no
HASH_DEBUG.....no
HOST_FREE_DEBUG.....no
HTTP_DEBUG.....no
I18N_DEBUG.....no
IDLE_PURGE_DEBUG.....no
INITWEB_DEBUG.....no
MEMORY_DEBUG.....no
NETFLOW_DEBUG.....no
P2P_DEBUG.....no
PACKET_DEBUG.....no
PARAM_DEBUG.....no
PLUGIN_DEBUG.....no
PROBLEMREPORTID_DEBUG.....no
SEMAPHORE_DEBUG.....no
SESSION_TRACE_DEBUG.....no
SSLWATCHDOG_DEBUG.....no
STORAGE_DEBUG.....no
UNKNOWN_PACKET_DEBUG.....no
URL_DEBUG.....no
VENDOR_DEBUG.....no
Compile Time: globals-report.h
AZURE_BG.....BGCOLOR="F0FFFF"
BASE_PROTOS_IDX.....30
CHART_FORMAT......png
DARK_BG.....BGCOLOR="#F3F3F3"
DISPLAY_FC_ALIAS.....2
DISPLAY_FC_DEFAULT.....2
DISPLAY_FC_FCID.....0
DISPLAY_FC_WWN.....1
GOLD_BG.....BGCOLOR="#FFD700"
SALMON_BG.....BGCOLOR="FA8072"
SORT_DATA_HOST_TRAFFIC.....12
SORT_DATA_IP.....10
SORT_DATA_PROTOS.....9
SORT_DATA_RCVD_HOST_TRAFFIC.....4
SORT_DATA_RECEIVED_IP.....2
SORT_DATA_RECEIVED_PROTOS.....1
SORT_DATA_RECEIVED_THPT.....3
SORT_DATA_SENT_HOST_TRAFFIC.....8
SORT_DATA_SENT_IP.....6
SORT_DATA_SENT_PROTOS.....5
SORT_DATA_SENT_THPT.....7
SORT_DATA_THPT.....11
SORT_FC_ACTIVITY.....15
SORT_FC_DATA.....13
SORT_FC_THPT.....14
TABLE_DEFAULTS..... CELLSPACING=0 CELLPADDING=2
TABLE_OFF.....(nil)
TABLE_ON.....(nil)
TD_BG.....(nil)
TH_BG.....(nil)
TOMATO_BG.....BGCOLOR="#FF6347"
TRAFFIC_STATS.....0
TR_ON.....(nil)
WHEAT_BG.....BGCOLOR="F5DEB3"
PLUGINS:
RRD:
RRD path...../usr/share/ntop/rrd
New directory permissions.....0700
New file umask.....0066
--- Burton Strauss <[EMAIL PROTECTED]> wrote:
> Not a blasted clue ... No idea which version of ntop
> this is, what
> environment, etc.
>
> Read docs/FAQ - the section on "Why does ntop drop
> packets" and the section
> on "How to ask for help". The former may answer
> your question, the latter
> will give you insight into the information we need
> to help you help
> yourself.
>
> -----Burton
>
>
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of
> Simon
> Sent: Tuesday, August 30, 2005 2:51 PM
> To: [EMAIL PROTECTED]
> Subject: [Ntop] % dropped (libpcap) increases over
> time
>
> Hi,
>
> The % Dropped (libpcap) increases gradually over
> time.
> It increases from 3% to 20% after a day. What could
> be the reason? Also,
> when I do "ifconfig", the number of dropped package
> is zero.
>
> eth1 Link encap:Ethernet HWaddr
> 00:D0:B7:B3:2B:79
> inet addr:172.21.128.31
> Bcast:172.21.143.255 Mask:255.255.240.0
> inet6 addr: fe80::2d0:b7ff:feb3:2b79/64
> Scope:Link
> UP BROADCAST RUNNING MULTICAST MTU:1500
> Metric:1
> RX packets:71499576 errors:0 dropped:0
> overruns:0 frame:0
> TX packets:1285725 errors:0 dropped:0
> overruns:0 carrier:0
> collisions:0 txqueuelen:1000
> RX bytes:860729228 (820.8 MiB) TX
> bytes:240776146 (229.6 MiB)
>
> Thanks in advance. Any help is appreciate.
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam? Yahoo! Mail has the best spam
> protection around
> http://mail.yahoo.com
> _______________________________________________
> Ntop mailing list
> [email protected]
> http://listgateway.unipi.it/mailman/listinfo/ntop
>
> _______________________________________________
> Ntop mailing list
> [email protected]
> http://listgateway.unipi.it/mailman/listinfo/ntop
>
____________________________________________________
Start your day with Yahoo! - make it your home page
http://www.yahoo.com/r/hs
_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
