[Ntop] Packets "Processed Immediately"
krzysztof.ksiazek at gmail.com
Thu May 31 20:13:44 CEST 2007
I've found that ntop (compiled from cvs two days ago), running on
Linux with pf_ring (also cvs) kernel 18.104.22.168 is reporting:
Processed Immediately 34,749,561 (64.6 %)
I have simple question - where I can find rest of them?
Queued 0 (0.0 %)
Dropped (libpcap) 0.0% 0
Dropped (ntop) 0.0% 0
also wrong place...
Comparing packet count on ntop (25kpps) to stats from cisco switch on
monitor port connected do ntop box (39kpps) I can confirm that 35% of
them are missing.
As a result stats from ntop are not reliable (i.e. 15MBps difference
in traffic and who knows what else).
On Mar 15 00:28:12 Ian McDonald asked exactly the same question.
Unfortunately, he didn't receive any answer. Maybe I'll be more lucky
Ntop is running with flags:
/usr/local/bin/ntop -m xxx.xxx.xxx.xxx/xx -i eth1 -u ntop -d -o
--disable-stopcap -n -b -z
If you need any additional info, I'll do my best to provide.
More information about the Ntop