[Ntop] interrupt results

[Gary Gatten]

I think the "anomalia" is an RRD thing, there was a post about it
recently.

As for changing your packet size distribution, there's nothing you can
"set" - it all depends on the apps really.  You'll always see a bunch of
64 byte packets; acks, handshakes, etc.  The only thing you can do is to
make sure your MTU's are "correct" (PMTUD, ICMP unreachables,etc.) and
window sizes are also appropriate.

G


-----Original Message-----
From: ntop-bounces at unipi.it [mailto:ntop-bounces at unipi.it] On Behalf Of
Barry Fawthrop
Sent: Wednesday, September 10, 2008 7:16 AM
To: ntop at unipi.it
Subject: [Ntop] interrupt results

Greetings All

I'm new to ntop.

Is there more information anywhere to help understand

I have printed and read M. Tamon's guide (which is good)

I was pleased to see that our results appear similar.

One that surprises me is the Network Load
Actual	        41.0 Kbit/s	 39.2 Pkt/s
Last Minute	41.0 Kbit/s	 39.2 Pkt/s
Last 5 Minutes	33.8 Kbit/s	 19.7 Pkt/s
Peak     	 2.9 Mbit/s	378.1 Pkt/s
Average	        18.7 Kbit/s	  4.7 Pkt/s

This on a 1Gb card, 1 Gb switch, and 7Mb internet connection ?

Two other unexpected results
Packet Size:
Shortest	      42 bytes
Average Size	     452 bytes
Longest	           1,514 bytes
Size <= 64 bytes	     7.6%      178,682
64 < Size <= 128 bytes	    57.3%    1,344,164
128 < Size <= 256 bytes	     1.5%       34,816
256 < Size <= 512 bytes	     1.4%       33,974
512 < Size <= 1024 bytes     3.9%       90,418
1024 < Size <= 1518 bytes   28.3%      664,374
Size > 1518 bytes	     0.0%            0


WHAT Can I set to move this more towards 256 - 512 bytes ?


Traffic TTL:
Average TTL	57
TTL <= 32	      0.0%       1,137
32 < TTL <= 64	     85.3%   2,004,926
64 < TTL <= 96	      0.0%         107
96 < TTL <= 128	     12.2%     286,716
128 < TTL <= 160      0.0%           0
160 < TTL <= 192      0.0%           0
192 < TTL <= 224      0.0%           0
224 < TTL <= 256      0.6%      13,565


My Biggest Question is on the Network Load Statistics Graphs
What is or causes the Yellow Anomalia ?


Thank to you
Barry
_______________________________________________
Ntop mailing list
Ntop at unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop





<font size="1">
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'>
</div>
"This email is intended to be reviewed by only the intended recipient
 and may contain information that is privileged and/or confidential.
 If you are not the intended recipient, you are hereby notified that
 any review, use, dissemination, disclosure or copying of this email
 and its attachments, if any, is strictly prohibited.  If you have
 received this email in error, please immediately notify the sender by
 return email and delete this email from your system."
</font>