Gary, Well, the switch can do TX or RX only, or both on one port, but in all three cases I don't get all the info I need. The reason I'm trying to get the complete data set both ways is to help my little dept figure out what's loading the network when we see spikes. However, most of the traffic is highly directional, ie a lot of utilization one way and not much the other, and yet sometimes it's both (between our file servers and media editing lab computers, as well as department backups, etc). So just mirroring one way wouldn't give a very good picture sometimes.
As for the update times, well, I've left on the default...never had problems before the dual nics, so I think it's more an issue of trying to save two things at the update interval sometimes. So, I guess, might there be a way to ensure all data is saved for a given time in one go? Or what setting might I change to stop these collisions? Thank you, Derek On Mon, Nov 17, 2008 at 10:57 AM, <[EMAIL PROTECTED]> wrote: > Send Ntop mailing list submissions to > [email protected] > > To subscribe or unsubscribe via the World Wide Web, visit > http://listgateway.unipi.it/mailman/listinfo/ntop > or, via email, send a message with subject or body 'help' to > [EMAIL PROTECTED] > > You can reach the person managing the list at > [EMAIL PROTECTED] > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Ntop digest..." > > > Today's Topics: > > 1. Re: AS number missing (Burton Strauss III) > 2. Re: AS number missing (Luca Deri) > 3. rrdtool and ntop --no-mac (Derek Gore) > 4. Re: rrdtool and ntop --no-mac (Gary Gatten) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sun, 16 Nov 2008 15:58:05 -0600 > From: "Burton Strauss III" <[EMAIL PROTECTED]> > Subject: Re: [Ntop] AS number missing > To: <[email protected]> > Message-ID: <[EMAIL PROTECTED]> > Content-Type: text/plain; charset="utf-8" > > The problem with AS numbers is the aggregation. What works for one > individual is a reflection of their connection to the network. > > For example, within the State of XYZ University system, there are multiple > AS#s, one per campus, reflecting traffic flow through the state-wide > network. But the State provides a consolidated network inter-connection for > all campuses and universities to the rest of the world. So outsiders see > the aggregated network AS# only. > > There are organizations that make AS lookups available, but again, it > reflects their position in the network. The best know is Cymru: > http://www.team-cymru.org/Services/ip-to-asn.html > > > -----Burton > > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > Aurelien BEAUVOIS > Sent: Thursday, November 13, 2008 10:21 AM > To: [email protected] > Subject: Re: [Ntop] AS number missing > > I've modified the script and there are no problem now... If somebody is > interessed, you can ask me. > > Thanks > > Aurelien > > Le jeudi 13 novembre 2008 ? 14:50 +0100, Aurelien BEAUVOIS a ?crit : > > Hi, > > > > I've already looked for examples but nothing work. > > > > I've found a script in the ntop directory > > (/root/ntop-3.3.8/utils/AS-list.sh) but I've not more AS numbers on the > > html page Hosts... > > > > Aur?lien > > > > Le jeudi 13 novembre 2008 ? 13:35 +0100, Allan Eising a ?crit : > > > Hi, > > > > > > The AS information is fetched from a text file that is bundled with > > > ntop. This text file has unfortunately not been updated for a long > > > time, thus a lot of AS numbers are missing. If you search this mailing > > > list you'll find several examples on how to fetch more recent data > > > into your AS-list.txt file. > > > > > > Allan > > > > > > On Thu, Nov 13, 2008 at 12:42 PM, Aurelien BEAUVOIS > > > <[EMAIL PROTECTED]> wrote: > > > > Hello, > > > > > > > > I've activate AS numbers in ntop but some AS numbers missing. > > > > > > > > Have you an idea to resolve this problem ? > > > > > > > > Thanks > > > > > > > > Aur?lien BEAUVOIS > > > > Ikoula > > > > > > > > _______________________________________________ > > > > Ntop mailing list > > > > [email protected] > > > > http://listgateway.unipi.it/mailman/listinfo/ntop > > > > > > > _______________________________________________ > > > Ntop mailing list > > > [email protected] > > > http://listgateway.unipi.it/mailman/listinfo/ntop > > > > > _______________________________________________ > > Ntop mailing list > > [email protected] > > http://listgateway.unipi.it/mailman/listinfo/ntop > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop > > > > ------------------------------ > > Message: 2 > Date: Mon, 17 Nov 2008 09:23:01 +0100 > From: Luca Deri <[EMAIL PROTECTED]> > Subject: Re: [Ntop] AS number missing > To: [email protected] > Message-ID: <[EMAIL PROTECTED]> > Content-Type: text/plain; charset="us-ascii" > > An HTML attachment was scrubbed... > URL: > http://listgateway.unipi.it/pipermail/ntop/attachments/20081117/5aaa87d7/attachment-0001.html > > ------------------------------ > > Message: 3 > Date: Mon, 17 Nov 2008 10:43:20 -0700 > From: "Derek Gore" <[EMAIL PROTECTED]> > Subject: [Ntop] rrdtool and ntop --no-mac > To: [email protected] > Message-ID: > <[EMAIL PROTECTED]> > Content-Type: text/plain; charset="iso-8859-1" > > Greetings all, > > I've recently been working on a project to setup ntop to the end of > analyzing our network load/traffic so we can better accommodate the demands > of the network. A test case using a simple machine with a single nic went > flawlessly. However, when I set up a more powerful machine with 2 nics to > start production monitoring, I started getting warnings from RRD tool that > go along the lines of this: > > **WARNING** RRD: rrd_update(/usr/.../ipBytesSent.rrd) error: illegal > attempt > to update using time > > 1109523297 when last update time is 1109523297 > (minimum one second step) > > > I have, of course, researched this problem a little and tried launching > with > the --no-mac option as well as configuring via the web interface to not > trust macs. Nevertheless, the problem persists. > > The setup is a gigabit switch hooked into 2 nics on the monitoring > computer. > One port is mirrored egress, and the other ingress, and I have ntop set to > merge the stats from both nics. > > Does anyone have any suggestions for how I might be able to fix this? > > Thank you. > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: > http://listgateway.unipi.it/pipermail/ntop/attachments/20081117/33e3c404/attachment-0001.html > > ------------------------------ > > Message: 4 > Date: Mon, 17 Nov 2008 11:56:54 -0600 > From: "Gary Gatten" <[EMAIL PROTECTED]> > Subject: Re: [Ntop] rrdtool and ntop --no-mac > To: <[email protected]> > Message-ID: > <[EMAIL PROTECTED]> > Content-Type: text/plain; charset="us-ascii" > > I don't think the "no mac" setting will influence these warnings - but > you probably need it anyway (most times you do). > > > > Maybe check the rrd configs and play with the update timers? Also, any > detail you don't "need" disable so that rrd is storing only what you'll > actually use. > > > > Lastly, if your switch supports it maybe have it mirror TX and RX so you > only need a single interface and NIC for monitoring. Merging tends to > distort the details of full duplex traffic. Ie: Is 45Mb/s on a T3 bad? > Well, if the traffic is all unidirectional - say ingress - yea, > probably bad cause that circuit is maxed. If however it's 25 Mb in and > 20 Mb out - maybe not so bad - especially if it's legit traffic. > Openview sometimes treats a full-duplex link like two half-duplex links > merged together: on a T1 running at 1536Kb/s egress it would show up on > reports as 50% utilization when really it's 100% of egress. > > > > Lastly, these warnings are annoying but I don't *THINK* they're causing > any harm. > > > > Gary > > > > > > > > > > ________________________________ > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of > Derek Gore > Sent: Monday, November 17, 2008 11:43 AM > To: [email protected] > Subject: [Ntop] rrdtool and ntop --no-mac > > > > Greetings all, > > I've recently been working on a project to setup ntop to the end of > analyzing our network load/traffic so we can better accommodate the > demands of the network. A test case using a simple machine with a single > nic went flawlessly. However, when I set up a more powerful machine with > 2 nics to start production monitoring, I started getting warnings from > RRD tool that go along the lines of this: > > **WARNING** RRD: rrd_update(/usr/.../ipBytesSent.rrd) error: illegal > attempt to update using time > > 1109523297 when last update time is 1109523297 > (minimum one second step) > > > I have, of course, researched this problem a little and tried launching > with the --no-mac option as well as configuring via the web interface to > not trust macs. Nevertheless, the problem persists. > > The setup is a gigabit switch hooked into 2 nics on the monitoring > computer. One port is mirrored egress, and the other ingress, and I have > ntop set to merge the stats from both nics. > > Does anyone have any suggestions for how I might be able to fix this? > > Thank you. > > > > > > > <font size="1"> > <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in > 0in 1.0pt 0in'> > </div> > "This email is intended to be reviewed by only the intended recipient > and may contain information that is privileged and/or confidential. > If you are not the intended recipient, you are hereby notified that > any review, use, dissemination, disclosure or copying of this email > and its attachments, if any, is strictly prohibited. If you have > received this email in error, please immediately notify the sender by > return email and delete this email from your system." > </font> > > -------------- next part -------------- > An HTML attachment was scrubbed... > URL: > http://listgateway.unipi.it/pipermail/ntop/attachments/20081117/96989a15/attachment.html > > ------------------------------ > > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop > > > End of Ntop Digest, Vol 54, Issue 8 > *********************************** > -- Derek Gore Systems Administration (ext 2-3678) HHP Services 108 Richards Building College of Health and Human Performance Brigham Young University Provo, UT 84602 Phone: (801) 422 3678 Mobile: (801) 602 3997
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
