I think the "anomalia" is an RRD thing, there was a post about it recently.
As for changing your packet size distribution, there's nothing you can "set" - it all depends on the apps really. You'll always see a bunch of 64 byte packets; acks, handshakes, etc. The only thing you can do is to make sure your MTU's are "correct" (PMTUD, ICMP unreachables,etc.) and window sizes are also appropriate. G -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Barry Fawthrop Sent: Wednesday, September 10, 2008 7:16 AM To: [email protected] Subject: [Ntop] interrupt results Greetings All I'm new to ntop. Is there more information anywhere to help understand I have printed and read M. Tamon's guide (which is good) I was pleased to see that our results appear similar. One that surprises me is the Network Load Actual 41.0 Kbit/s 39.2 Pkt/s Last Minute 41.0 Kbit/s 39.2 Pkt/s Last 5 Minutes 33.8 Kbit/s 19.7 Pkt/s Peak 2.9 Mbit/s 378.1 Pkt/s Average 18.7 Kbit/s 4.7 Pkt/s This on a 1Gb card, 1 Gb switch, and 7Mb internet connection ? Two other unexpected results Packet Size: Shortest 42 bytes Average Size 452 bytes Longest 1,514 bytes Size <= 64 bytes 7.6% 178,682 64 < Size <= 128 bytes 57.3% 1,344,164 128 < Size <= 256 bytes 1.5% 34,816 256 < Size <= 512 bytes 1.4% 33,974 512 < Size <= 1024 bytes 3.9% 90,418 1024 < Size <= 1518 bytes 28.3% 664,374 Size > 1518 bytes 0.0% 0 WHAT Can I set to move this more towards 256 - 512 bytes ? Traffic TTL: Average TTL 57 TTL <= 32 0.0% 1,137 32 < TTL <= 64 85.3% 2,004,926 64 < TTL <= 96 0.0% 107 96 < TTL <= 128 12.2% 286,716 128 < TTL <= 160 0.0% 0 160 < TTL <= 192 0.0% 0 192 < TTL <= 224 0.0% 0 224 < TTL <= 256 0.6% 13,565 My Biggest Question is on the Network Load Statistics Graphs What is or causes the Yellow Anomalia ? Thank to you Barry _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font> _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
