[Ntop] Poor ntop performance with pf_ring 4.1

Richard C. Hesse richard at mochimedia.com
Tue Nov 3 23:13:01 CET 2009


Hello, I'd appreciate any help possible in troubleshooting some poor  
ntop performance I'm seeing. I'm seeing a lot of dropped packets both  
in the ntop UI and in pf_ring's output. Here's the pf_ring info:

cat /proc/net/pf_ring/*
Bound Device   : eth3
Slot Version   : 10 [4.1.0]
Sampling Rate  : 1
Appl. Name     : <unknown>
IP Defragment  : No
BPF Filtering  : Disabled
# Filt. Rules  : 0
Cluster Id     : 0
Channel Id     : -1
Tot Slots      : 65535
Bucket Len     : 8232
Slot Len       : 8346 [bucket+header]
Tot Memory     : 546959360
Tot Packets    : 30752095
Tot Pkt Lost   : 25111485
Tot Insert     : 5640610
Tot Read       : 5575075
Tot Fwd Ok     : 0
Tot Fwd Errors : 0
Num Free Slots : 0
PF_RING Version     : 4.1.0 ($Revision: 3982 $)
Ring slots          : 65535
Slot version        : 10
Capture TX          : No [RX only]
IP Defragment       : No
Transparent mode    : Yes
Total rings         : 1
Total plugins       : 0

ntop sampling is currently set to 2, but it can't even keep up with  
that. It's only handling about 45k pps. I think part of the problem  
here might be the bucket length? Previously ntop didn't have to worry  
about this because it was handled by pf_ring. Now, pf_ring lets the  
apps set different capture sizes and is no longer set when loading the  
module. Any idea on how to get ntop to set the bucket length to 64 or  
128 bytes?

Thanks.

-richard


More information about the Ntop mailing list