Hi,
I have a question on the amount of traffic ntop and libpcap can
handle, considering hardware specifications. I have spanned 1Gb of
traffic the following linux system and ntop is reporting a large
amount of dropped traffic. ntop eventually quits because it runs out
of hash table memory. I suspect libpcap is dropping FIN packets and
as a result ntop keeps the conversation in memory.
Given the hardware specifications below, how much traffic can I
expect ntop and libpcap handle? When I look at the physical interface
I only see 100 drops. ntop reports no drops. The majority of dropped
traffic appears to be with libpcap.
CPU
Dual core Intel(R) Xeon(R) CPU 5140 @ 2.33GHz
Memory
:~# free
total used free shared buffers cached
Mem: 2075348 1873576 201772 0 7792 1417668
-/+ buffers/cache: 448116 1627232
Swap: 4000176 48 4000128
listening interface
eth1 Link encap:Ethernet HWaddr
inet6 addr: Scope:Link
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:3678032734 errors:0 dropped:100 overruns:0 frame:0
TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:618105664 (589.4 MiB) TX bytes:492 (492.0 b)
Interrupt:114 Memory:fa000000-fa011100
Kernel
2.6.18-6-686 #1 SMP Fri Jun 6 22:22:11 UTC 2008 i686 GNU/Linux
libpcap version
libpcap0.8-dev 0.9.5-1
ntop version
ntop v.3.3.8
>From the ntop Global Traffic page
Packets
Dropped (libpcap) 115.8% 30,053,796
Dropped (ntop) 0.0% 0
Total Received (ntop) 25,955,606
Total Packets Processed 25,955,609
Unicast 100.0% 25,955,235
Broadcast 0.0% 7
Multicast 0.0% 355
--
Mike Marseglia
Systems Administrator, OSHEAN
401-886-0887 x208
401-248-4867
[email protected]
_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
