Jorge it's hard to say what's happened. Unless there are not software issues (e.g. bugged software releases) as I believe, you have so much traffic that ntop drops more packets than the number it processes. First of all make sure that you have configured properly for your environment, then investigate if your setup is optimal for ntop.
Regards Luca On Apr 2, 2008, at 6:25 PM, Gary Gatten wrote: > I can’t reconcile these numbers. I will mention though if you’re > trying to capture traffic at a high rate (pps) especially off a Gb > interface, you may want to read some of the docs on this; such as > PF_RING. > > Gary > > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf > Of Jorge Cuevas > Sent: Wednesday, April 02, 2008 6:50 AM > To: [email protected] > Subject: [Ntop] Strange values of traffic report stastistics > > Hi everybody, > > I am trying to gather information regarding my network and the > behaviour of my sensor. I have ossim (www.ossim.net) running on one > of my interfaces and I am increasing the traffic analysed adding new > monitoring sessions (from the catalyst) to my promiscuos port. > > I am using ntop for studying the performance and packet losts, but I > get strange values from global statistics: > > Dropped (libpcap) > 403,8% > 339,576,877 > Dropped (ntop) > 0,0% > 0 > Total Received (ntop) > 84,087,157 > Total Packets Processed > 84,087,157 > Unicast > 95,5% > 80,289,585 > Broadcast > 0,8% > 660,955 > Multicast > > > > Can anybody give me a hand? How can libpcap be dropping 400% of the > traffic? > > > Thanks in advance > > > -- > Jorge Cuevas González <[EMAIL PROTECTED]> > Director de Proyectos www.nesys-st.com > Tfno: 94 406 0546 Móvil: 617165161 > GPG: 3C1C CE59 3258 07C6 BB44 76B2 7861 9F93 9710 0C6F > "This email is intended to be reviewed by only the intended > recipient and may contain information that is privileged and/or > confidential. If you are not the intended recipient, you are hereby > notified that any review, use, dissemination, disclosure or copying > of this email and its attachments, if any, is strictly prohibited. > If you have received this email in error, please immediately notify > the sender by return email and delete this email from your system." > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
