I don't know anything about Centos, but looks like a 64bit version?, so I'm assuming the processor is plenty fast. 300Mb/s isn't all that much, but what's more important is the frame/packets per second. 300Mb/s can vary from almost 586Kpps at 64 Bytes to as little as 25Kpps at 1500 Bytes. I'm guessing you'll be in the 150Kpps to 200Kpps if your traffic fits in the "average" profile.
Anyway, given all that - if your hardware is good libpcap shouldn't drop anything! You can maybe check out PF_RING: http://www.ntop.org/PF_RING.html Make sure you only have one copy of libpcap on your system or that nTop is linking to the correct one. Also, maybe use some tools (IPerf?) to benchmark your network I/O performance on that box and make sure it's OK before spending TOO much time trying to get libpcap/ntop to work. Gary -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Silas Moeckel Sent: Thursday, February 07, 2008 2:27 PM To: [email protected] Subject: [Ntop] Ntop 3.3 / Centos 5.1 x86_64 / forcedeth / libpcapperformance issues I have been working on setting up ntop to monitor aprox 300mbs of traffic via a pair of nvidia gige nics. I'm working with a hand compiled (all defaults) ntop 3.3 and stock libpcap and am experiencing as expected significant packet loss on the libpcap side. What is the best method to get past this, my preference is to stay with centos and rpm's if at all possible (I found the the dag ntop liked to crash). I don't seem to be the first person to attempt this but it seems everything is still very immature with hand compiled bits all over the place. As a side note since I cant seem to find proper RPM's would it be useful if once I get this working I generate them and post them somewhere it would seem to be a set of kernel custom modules, replacement libpcaps and version of all the apps dependent on them? Silas _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font> _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
