[Ntop] Problem Sending NetFlow Traces
Hermano Toscano Moura
toscano_moura at hotmail.com
Thu Aug 4 20:12:26 CEST 2005
I just edit the queue...
#define MAX_NUM_QUEUED_ADDRESSES 102400000
Now im sending a 8Mb Trace and the problem is the same!
<html><div><H3 align=center><FONT color=#ff0000>Hermano José Toscano Moura
Filho</FONT><IMG height=2 src="http://graphics.hotmail.com/greypixel.gif"
width="100%" vspace=9><FONT color=#0000cc>UFPB: </FONT>Aluno de
graduação(Computação)<FONT color=#0000cc>CEFET-PB:</FONT> Aluno de
graduação(Telemática)<FONT color=#0000cc>RNP:</FONT> Estagiário(GT-P2P)<IMG
height=2 src="http://graphics.hotmail.com/greypixel.gif" width="100%"
vspace=9></H3></div></html>
<br><br><br>>From: "Burton Strauss"
<Burton at ntopSupport.com><br>>Reply-To: ntop at unipi.it<br>>To:
<ntop at Unipi.IT><br>>Subject: RE: [Ntop] Problem Sending NetFlow
Traces<br>>Date: Thu, 4 Aug 2005 11:28:08 -0500<br>><br>>Address
resolution takes time -- give it a try, using dig or nslookup
-<br>>you'll be surprised.<br>><br>>That's why it's in a separate
thread, fed by a queue. The queue is (by<br>>default) 4K. When the
queue fills up, ntop just stops queuing addresses and<br>>keeps them in
numeric form. As the queue gets emptied, ntop can accept<br>>additional
addresses to resolve. In packet capture mode, you'll eventually<br>>see
other packets from those hosts and everything gets
resolved.<br>><br>>When you send a huge file, ntop gets hit with all
those addresses at once to<br>>resolve. This overflows the queue and
some don't get resolved.<br>><br>>You can try sending the file in
smaller chunks, or you could edit the queue<br>>size in globals-defines.h
and
recompile.<br>><br>>-----Burton<br>><br>><br>><br>>-----Original
Message-----<br>>From: ntop-bounces at unipi.it
[mailto:ntop-bounces at unipi.it] On Behalf Of<br>>Hermano Toscano
Moura<br>>Sent: Thursday, August 04, 2005 10:54 AM<br>>To:
ntop at Unipi.IT<br>>Subject: [Ntop] Problem Sending NetFlow
Traces<br>><br>>Hi There...<br>><br>>I'm sending a netflow trace
to Ntop like this:<br>><br>>flow-cat /home/hermano/gt/netflow |
flow-send -dV5 0/127.0.0.1/5555<br>><br>>The file that Im sending has
around 480Mb...<br>>But the results are not the expected, I think ntop is
not processing all the<br>>information of this trace...<br>>The
following messages appears:<br>><br>>**WARNING** Address resolution
queue is full [4096 slots] Addresses in<br>>excess won't be resolved -
ntop continues<br>><br>>My questions are...<br>>Why ntop cant
process all the file? I think 480Mb is not a too large
trace<br>>file...<br>>Can I fix this problem?<br>>If I send pieces
of this trace(like 48 files of 10Mb), i solve my
problem?<br>><br>>Thanks evrybody in advance and sorry about my poor
english!<br>><br>>Hermano
Toscano<br>><br>><br>>_______________________________________________<br>>Ntop
mailing
list<br>>Ntop at unipi.it<br>>http://listgateway.unipi.it/mailman/listinfo/ntop<br>><br>>_______________________________________________<br>>Ntop
mailing
list<br>>Ntop at unipi.it<br>>http://listgateway.unipi.it/mailman/listinfo/ntop<br>
More information about the Ntop
mailing list