[Ntop] Ntop 3.3 / Centos 5.1 x86_64 / forcedeth / libpcapperformance issues

[Gary Gatten]

I don't know anything about Centos, but looks like a 64bit version?, so
I'm assuming the processor is plenty fast.  300Mb/s isn't all that much,
but what's more important is the frame/packets per second.  300Mb/s can
vary from almost 586Kpps at 64 Bytes to as little as 25Kpps at 1500
Bytes.  I'm guessing you'll be in the 150Kpps to 200Kpps if your traffic
fits in the "average" profile.

Anyway, given all that - if your hardware is good libpcap shouldn't drop
anything!  You can maybe check out PF_RING:
http://www.ntop.org/PF_RING.html

Make sure you only have one copy of libpcap on your system or that nTop
is linking to the correct one.  Also, maybe use some tools (IPerf?) to
benchmark your network I/O performance on that box and make sure it's OK
before spending TOO much time trying to get libpcap/ntop to work.

Gary



-----Original Message-----
From: ntop-bounces at unipi.it [mailto:ntop-bounces at unipi.it] On Behalf Of
Silas Moeckel
Sent: Thursday, February 07, 2008 2:27 PM
To: ntop at unipi.it
Subject: [Ntop] Ntop 3.3 / Centos 5.1 x86_64 / forcedeth /
libpcapperformance issues

I have been working on setting up ntop to monitor aprox 300mbs of 
traffic via a pair of nvidia gige nics.  I'm working with a hand 
compiled (all defaults) ntop 3.3 and stock libpcap and am experiencing 
as expected significant packet loss on the libpcap side.  What is the 
best method to get past this, my preference is to stay with centos and 
rpm's if at all possible (I found the the dag ntop liked to crash).  I 
don't seem to be the first person to attempt this but it seems 
everything is still very immature with hand compiled bits all over the 
place. 

As a side note since I cant seem to find proper RPM's would it be useful

if once I get this working I generate them and post them somewhere it 
would seem to be a set of kernel custom modules, replacement libpcaps 
and version of all the apps dependent on them? 

Silas


_______________________________________________
Ntop mailing list
Ntop at unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop





<font size="1">
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'>
</div>
"This email is intended to be reviewed by only the intended recipient
 and may contain information that is privileged and/or confidential.
 If you are not the intended recipient, you are hereby notified that
 any review, use, dissemination, disclosure or copying of this email
 and its attachments, if any, is strictly prohibited.  If you have
 received this email in error, please immediately notify the sender by
 return email and delete this email from your system."
</font>