Make a switch somewhere so users can tweak it? Or use the mib-ii counters? ----- Original Message ----- From: [email protected] <[email protected]> To: [email protected] <[email protected]> Sent: Thu Aug 13 07:45:42 2009 Subject: Re: [Ntop] Libpcap counter issue?
If you read way back in the list, this is a known item. The various NICs report different things for the counters (some total, some # since last read). ntop tries to figure out which way the NIC is reporting, but can be fooled (esp. if the counts are low (and of course, we recommend running ntop on it's own system, so it should start up before there is a lot of traffic and that just makes it worse: there's no easy way to distinguish between the two types of reporting) If you look at ifconfig, you are seeing un-interpreted counters without any smarts so it doesn't look funny. If ntop gets it wrong ... well, we check the counter when we refresh and so the 'faster you refresh the wackier it gets' is he give-away. But, that's just a pass through from the NIC it's not ntop losing them. Just ignore it, nothing other than not passing along the info can be done. -----Burton -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Mike Tremaine Sent: Wednesday, August 12, 2009 7:03 AM To: [email protected] Subject: Re: [Ntop] Libpcap counter issue? Gary Gatten wrote: > > Try not to run the dev releases unless you must, who knows what > condition they're in at any given time. > > Do you think it's actually dropping packets, just the decimal is off > by 3 (or more) places? Or, is this bug just in the way the stats are > collected and displayed and there is no significant packet loss? > I don't believe there is packet loss, this is early morning and the network is pretty quiet, I think the counter is somehow getting messed up. I probably should be running 3.3.10 but since I had already started with the dev package and got it stable [mostly] I just kept using it. -Mike _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
