That doesnt truley help me.
First off, I am not even listening in promiscuous mode, ntop is only accepting netflows. I am not running FreeBSD, I am running Fedora Core 4. The load on the Server was around 0.10.....until all the free memory was used, then it started going to swap. Ive never seen a program use 95% of real memory (95% of 1GB). Thats just an insane amount of RAM for such a little program. Is there a way to have ntop dump what it knows (speed and protocols) to an RRD file and then free up all the RAM? Im not interested in viewing all this data on the ntop site (although it would be helpful) i just like how ntop dumps to the RRD files that i can graph. I only sent 1/5 of our traffic to the ntop box (1 router out of 4), and the fact that it couldnt even handle that is kind of sad. On one of the pdfs, rrdandntop, "An ISP using ntop to monitor a couple of T3s needs a FAST computer and A LOT of memory" How fast is a fast computer and how much memory does it need? If I disable TCP sessions, will ntop still dump to RRD files with the correct protocol usage? Will it take some of the load off of the box? I was hoping someone knew some tweaks/tricks to keep memory usage down so it doesnt have to goto swap. Burton Strauss wrote: >In docs/FAQ and the back traffic for this list, we've frequently discussed >ntop and memory usage. Reading that will give you a basis for framing >reasonable questions... > >We've also discussed swap space (very bad) and the FreeBSD cpu issue (short >answer for that one: get over it). > >>From docs/FAQ: > >Q4. I'm running out of memory. >A. Basically ntop uses a lot of memory - it stores a chunk of information >about each > and every host it's monitoring. See "Q. Why does ntop use so much memory >?" and > the following articles below. > > >Re cpu, read the answer beginning: > >A. Also, understand that --set-pcap-nonblocking is going to increase ntop's > cpu usage. It will probably come close to pegging the CPU at 100%. Yet > strangely other processes won't seem to be impacted. (Of course, you >really > should be running ntop on it's own host, anyway, right?). > >(FreeBSD 5.x just automates this process, so you don't need the switch. >It's still the same WRT userland threads). > >-----Burton > > >-----Original Message----- >From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John >Barbieri >Sent: Wednesday, September 14, 2005 3:43 PM >To: [email protected] >Subject: [Ntop] Ntop and Netflows > > Howdy there. > > > > Ive been playting around with ntop and netflows, and I have to say, i > really > like how ntop presents the data. > > > the one thing i dont like is how much cpu power / memory is uses. On a > dual > opteron system with 1GB of ram, the load was about a 5.4 running > fedora core > 4. the load was low, until all the free memory was eaten up and it started > to use swap. > > > I was wondering if there was a way to use ntop as a netflow collector, but > not use so much memory. > > > also, this is probably for the wrong list, but if anyone knows of another > collector / displayer out there similar to ntop, that would be great > to. Ive > been trying to use other programs such as cflow, flow-tools, cu-flow, > flowscan, flowd etc. > > They did not seem to do what I wanted to (not to mention none of them > compiled for me either =/) > > > > any help would be greatly appreciated. > > > thank you > > > John Barbieri _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
