In general, please use ntop-misc for pf_ring and other discussions not related to ntop usage (ntop) or development (ntop-dev).
Those two flags are BOTH in the header, which comes from libpcap, not specifically from ntop. So: 1. Which version of libpcap do you have? 2. To test whether this is related to pf_ring, you need to boot with a non-ring kernel (i.e. everything else the same) and see if it works properly. -----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sergio Iglesias Sent: Thursday, November 10, 2005 3:06 AM To: [email protected] Subject: [Ntop] Several interfaces sniffing problem Hi. I have a problem with the ntop or the libpcap, I'm not sure. Maybe you can tell me where the problem is. I have compiled the last PF_ring and ntop of the cvs and everything works fine. The pcount works fine in every interface. The computer is a linux with kernel 2.6.13-2. When I run the ntop sniffing only in one interfaces there is no problem OK; but when I sniff several interfaces doesn't work. I run the next command: ntop -x 100000000 -X 1000000000 -d -M -w 3001 -W 444 -P /opt/ntop_data2/ -i "eth0,eth1" -u ntop and most of the traffic is dropped by the kernel. In the messages file I can se the following: Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 558 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 195 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 975 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 195 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 195 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 256 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 493 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 174 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 200 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 200 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 975 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 152 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 152 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 115 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 635 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 115 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 863 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 195 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 152 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 152 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 677 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 200 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 338 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 740 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 195 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 275 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 605 Nov 10 09:50:10 octopus ntop[2872]: **WARNING** dequeuePacket: caplen 112 != len 115 As I can see two variables of the captured packet has different size: h.caplen and h.len. I don't know what's the problem. Maybe you can help me. Thanks in advance. Best regards. _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
