[Ntop] packet lost or dropped by libpcap

[Gary Gatten]

This is quite high loss for that amount of throughput.  I'm not familiar
with Debian, but I do know there are little quirks between OS's that
could  account for this.  Perhaps check the sites for Debian and libpcap
and see if anyone there has any thoughts.  All I can offer is make sure
you have compatible versions of libpcap and whatever OS you're using.
The latest release is not always the best on every platform.

Gary


-----Original Message-----
From: ntop-bounces at unipi.it [mailto:ntop-bounces at unipi.it] On Behalf Of
Jorge Cuevas
Sent: Wednesday, September 19, 2007 6:31 AM
To: ntop at unipi.it
Subject: [Ntop] packet lost or dropped by libpcap

Hi all, 

Im doing some tests and after capturing 6 days longs, with peaks of 1,6
Mbps, with averages of 2,0 kbps, with  total packets received
(ntop)=812,041, I find only 263,530 packets processed, and a 10% of
dropped (libpcap). 

The hard I am using is not the best in the market, but is not that bad:
Pentium 4 CPU 1500Hz, 1 G RAM, Debian 2.6.18-4-686.

Can anyone give me any clue about the reasons of dropped packets by
libpcap? Where can I gather information regarding performance of
libpcap, what things can be done for decreasing packet lost, or at least
the reason of this behaviour?  

Thanks in advance, 

Jorge   

_______________________________________________
Ntop mailing list
Ntop at unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

===========================================================================





"This email is intended to be reviewed by only the intended recipient
 and may contain information that is privileged and/or confidential.
 If you are not the intended recipient, you are hereby notified that
 any review, use, dissemination, disclosure or copying of this email
 and its attachments, if any, is strictly prohibited.  If you have
 received this email in error, please immediately notify the sender by
 return email and delete this email from your system."