Can you post the Netflow configs from your router(s)? Sanitize them as you wish - mainly interested in what interfaces and what directions you have netflow enabled and what the export timers are at. Also what version records.
I too had issues with CPU on 3.3.3 on FreeBSD. I'm running 3.2.1 OK - but it segfaults and dies more than I'd like. I will tell you from what I've seen if there are a bunch of flows arriving to nTop when the netflow interfaces are activated it does take a LONG time to catch up and does consume 100% CPU until it does - even on 3.2.1. If you still have 3.3.x maybe turn it up when flow exports are light and see what happens. Also, I had to run multiple instances of nTop with multiple netflow listeners to get the traffic separation I was looking for. Maybe you'll have to do something similar? Gary -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Richard Laager Sent: Tuesday, January 29, 2008 3:32 PM To: [email protected] Subject: [Ntop] NetFlow Interfaces We're running ntop 2.2 and are trying to switch from using a monitor port to having our routers export NetFlow statistics. I'm running into a number of problems. As near as I can tell, ntop locks up after some period of time in two cases: 1) If we're doing running with both NetFlow and the high-traffic mirror port; session track is disabled. 2) If we run with NetFlow only and enable session tracking. I *think* things are okay with NetFlow only if session tracking is disabled. I tried upgrading to ntop 3.3 and using just NetFlow (with session tracking disabled). It seems to separate the interfaces coming in from NetFlow (on the hosts page). With ntop 3.2, the CPU load was less than 20% at all times. With ntop 3.3, the CPU is maxed out immediately and stays that way. Could this be due to the change in interface handling? We have a LOT (a couple thousand) sub-interfaces on one router. Is there some way (either on the Cisco routers or in ntop) that we can get the old behavior back to see if that's the cause of the CPU problems? Thanks, Richard <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font> _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
