The meaning of this message is described in the FAQ. ntop does address resolution asynchronously, and there is a queue of items remaining to be resolved. On a busy network, there can be a lot, especially @ startup. But once things settle down, there rarely are many. So we just put a limit on the queue.
If ntop finds a packet from that unresolved host later on and the queue isn't full, it gets added and resolved then. So typically, after a few minutes things settle down. If this happens during a run, it can be a sign that ntop can't access the dns server. If your DNS server has changed, the only way I know to change where ntop is looking is via a restart. However, remember that ntop also sniffs DNS packets that other hosts send/receive - as a way of avoiding the overhead of our own DNS queries. Either way, you can ignore it - it just won't show you all of the translations from IP addresses to names. -----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Gatten Sent: Monday, September 15, 2008 9:55 PM To: [email protected] Subject: Re: [Ntop] log "warning" resolution queue full There might be a CLI switch for this - but I think you have to make a change(s) in the globals-define.h and recompile. :( Also, I think there is a setting for the number of threads used for resolution - so maybe up those a little? There's lots of good tweaks in globals-define.h - check it out, but don't break anything! G -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Johannes Prost Sent: Monday, September 15, 2008 9:15 PM To: [email protected] Subject: [Ntop] log "warning" resolution queue full Hi All, running ntop 3.2 win32 for 81 days, I have this entry in my log 09/11/08 15:46:47 **WARNING** Address resolution queue is full [4096 slots] 09/11/08 15:46:47 Addresses in excess won't be resolved - ntop continues I am new to ntop, appologize my questions: What does it mean, except that some kind of queue is full ? :) Where do I have to take a look, and what / where has something to be changed ? I am thank full for any pointers and explanation. Johannes _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font> _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
