Mailing List Archive: NTop: Users

Slackware - Segmentation fault when listening on eth1

Index | Next | Previous | View Threaded

andrei.staicu at ipso

Jul 8, 2008, 5:17 AM

Post #1 of 12 (339 views)
Permalink

Slackware - Segmentation fault when listening on eth1

Hello all,

I seem to have a small problem when running ntop 3.3.6, listening on
interfaces other than eth0.
For example:
/usr/bin/ntop -u nobody --sticky-hosts --use-syslog=local6 -i eth0
will run for ages, while
/usr/bin/ntop -u nobody --sticky-hosts --use-syslog=local6 -i eth1
on the same machine
will run for 5-30 seconds and yield Segmentation fault.
The same is true for another machine: on eth0 it works, on eth3 I get
Segmentation fault.
The machines have different hardware configurations; one of them is a
Slackware 12.1 and the latter is a Slackware 12.0.

Do you have any ideas on why this could happen?
If you need any more information, such as the logs, please let me know
and I will post them, although I don't see differences between the logs
between the two runs.

Thanks in advance.

_______________________________________________
Ntop mailing list
Ntop[at]unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

jlay at slave-tothe-box

Jul 8, 2008, 6:10 AM

Post #2 of 12 (331 views)
Permalink

Re: Slackware - Segmentation fault when listening on eth1 [In reply to]

On 7/8/08 6:17 AM, "Andrei-Florian Staicu" <andrei.staicu[at]ipso.ro> wrote:

> Hello all,
>
> I seem to have a small problem when running ntop 3.3.6, listening on
> interfaces other than eth0.
> For example:
> /usr/bin/ntop -u nobody --sticky-hosts --use-syslog=local6 -i eth0
> will run for ages, while
> /usr/bin/ntop -u nobody --sticky-hosts --use-syslog=local6 -i eth1
> on the same machine
> will run for 5-30 seconds and yield Segmentation fault.
> The same is true for another machine: on eth0 it works, on eth3 I get
> Segmentation fault.
> The machines have different hardware configurations; one of them is a
> Slackware 12.1 and the latter is a Slackware 12.0.
>
> Do you have any ideas on why this could happen?
> If you need any more information, such as the logs, please let me know
> and I will post them, although I don't see differences between the logs
> between the two runs.
>
> Thanks in advance.
>
>
> _______________________________________________
> Ntop mailing list
> Ntop[at]unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop

Do interfaces eth1 or eth3 have a valid IP assigned to them?

_______________________________________________
Ntop mailing list
Ntop[at]unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

sclark at netwolves

Jul 8, 2008, 6:25 AM

Post #3 of 12 (325 views)
Permalink

Re: Slackware - Segmentation fault when listening on eth1 [In reply to]

James Lay wrote:
> On 7/8/08 6:17 AM, "Andrei-Florian Staicu" <andrei.staicu[at]ipso.ro> wrote:
>
>
>>Hello all,
>>
>>I seem to have a small problem when running ntop 3.3.6, listening on
>>interfaces other than eth0.
>>For example:
>>/usr/bin/ntop -u nobody --sticky-hosts --use-syslog=local6 -i eth0
>>will run for ages, while
>>/usr/bin/ntop -u nobody --sticky-hosts --use-syslog=local6 -i eth1
>>on the same machine
>>will run for 5-30 seconds and yield Segmentation fault.
>>The same is true for another machine: on eth0 it works, on eth3 I get
>>Segmentation fault.
>>The machines have different hardware configurations; one of them is a
>>Slackware 12.1 and the latter is a Slackware 12.0.
>>
>>Do you have any ideas on why this could happen?
>>If you need any more information, such as the logs, please let me know
>>and I will post them, although I don't see differences between the logs
>>between the two runs.
>>
>>Thanks in advance.
>>
>>
>>_______________________________________________
>>Ntop mailing list
>>Ntop[at]unipi.it
>>http://listgateway.unipi.it/mailman/listinfo/ntop
>
>
>
> Do interfaces eth1 or eth3 have a valid IP assigned to them?
>
>
> _______________________________________________
> Ntop mailing list
> Ntop[at]unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
>
>
In my experiencing running NTOP on FreeBSD I have found it to be a great tool,
but it seems to be very fragile.

My $.02
Steve
_______________________________________________
Ntop mailing list
Ntop[at]unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

andrei.staicu at ipso

Jul 8, 2008, 6:47 AM

Post #4 of 12 (326 views)
Permalink

Re: Slackware - Segmentation fault when listening on eth1 [In reply to]

James Lay wrote:
> On 7/8/08 6:17 AM, "Andrei-Florian Staicu" <andrei.staicu[at]ipso.ro> wrote:
>
>> Hello all,
>>
>> I seem to have a small problem when running ntop 3.3.6, listening on
>> interfaces other than eth0.
>> For example:
>> /usr/bin/ntop -u nobody --sticky-hosts --use-syslog=local6 -i eth0
>> will run for ages, while
>> /usr/bin/ntop -u nobody --sticky-hosts --use-syslog=local6 -i eth1
>> on the same machine
>> will run for 5-30 seconds and yield Segmentation fault.
>> The same is true for another machine: on eth0 it works, on eth3 I get
>> Segmentation fault.
>> The machines have different hardware configurations; one of them is a
>> Slackware 12.1 and the latter is a Slackware 12.0.
>>
>> Do you have any ideas on why this could happen?
>> If you need any more information, such as the logs, please let me know
>> and I will post them, although I don't see differences between the logs
>> between the two runs.
>>
>> Thanks in advance.
>>
> Do interfaces eth1 or eth3 have a valid IP assigned to them?
>
Yes, each of the four interfaces (machine 1 - eth0, eth1, machine 2 -
eth0, eth3) have several IP's assigned on virtual interfaces
(eth1,eth1:1, a.s.o.). ntop correctly determines all these interfaces at
startup and correctly displays the statistics in the time it runs, until
the Segmentation fault error.

_______________________________________________
Ntop mailing list
Ntop[at]unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

Ggatten at waddell

Jul 8, 2008, 8:26 AM

Post #5 of 12 (325 views)
Permalink

Re: Slackware - Segmentation fault when listening on eth1 [In reply to]

I'm pretty sure the interface ntop / libpcap listens on doesn't need an
IP address. I've been wrong before, but other tools that use libpcap
(snort, etc.) definitely don't need an IP address on them.

G

-----Original Message-----
From: ntop-bounces[at]unipi.it [mailto:ntop-bounces[at]unipi.it] On Behalf Of
Steve Clark
Sent: Tuesday, July 08, 2008 8:26 AM
To: ntop[at]unipi.it
Subject: Re: [Ntop] Slackware - Segmentation fault when listening on
eth1

James Lay wrote:
> On 7/8/08 6:17 AM, "Andrei-Florian Staicu" <andrei.staicu[at]ipso.ro>
wrote:
>
>
>>Hello all,
>>
>>I seem to have a small problem when running ntop 3.3.6, listening on
>>interfaces other than eth0.
>>For example:
>>/usr/bin/ntop -u nobody --sticky-hosts --use-syslog=local6 -i eth0
>>will run for ages, while
>>/usr/bin/ntop -u nobody --sticky-hosts --use-syslog=local6 -i eth1
>>on the same machine
>>will run for 5-30 seconds and yield Segmentation fault.
>>The same is true for another machine: on eth0 it works, on eth3 I get
>>Segmentation fault.
>>The machines have different hardware configurations; one of them is a
>>Slackware 12.1 and the latter is a Slackware 12.0.
>>
>>Do you have any ideas on why this could happen?
>>If you need any more information, such as the logs, please let me know
>>and I will post them, although I don't see differences between the
logs
>>between the two runs.
>>
>>Thanks in advance.
>>
>>
>>_______________________________________________
>>Ntop mailing list
>>Ntop[at]unipi.it
>>http://listgateway.unipi.it/mailman/listinfo/ntop
>
>
>
> Do interfaces eth1 or eth3 have a valid IP assigned to them?
>
>
> _______________________________________________
> Ntop mailing list
> Ntop[at]unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
>
>
In my experiencing running NTOP on FreeBSD I have found it to be a great
tool,
but it seems to be very fragile.

My $.02
Steve
_______________________________________________
Ntop mailing list
Ntop[at]unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

<font size="1">
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'>
</div>
"This email is intended to be reviewed by only the intended recipient
and may contain information that is privileged and/or confidential.
If you are not the intended recipient, you are hereby notified that
any review, use, dissemination, disclosure or copying of this email
and its attachments, if any, is strictly prohibited. If you have
received this email in error, please immediately notify the sender by
return email and delete this email from your system."
</font>

_______________________________________________
Ntop mailing list
Ntop[at]unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

David.Ziemba at ColoradoCollege

Jul 8, 2008, 8:36 AM

Post #6 of 12 (325 views)
Permalink

Re: Slackware - Segmentation fault when listening on eth1 [In reply to]

On 7/8/08 7:25 AM, "Steve Clark" <sclark[at]netwolves.com> wrote:

> James Lay wrote:
>> On 7/8/08 6:17 AM, "Andrei-Florian Staicu" <andrei.staicu[at]ipso.ro> wrote:
>>
>>
>>> Hello all,
>>>
>>> I seem to have a small problem when running ntop 3.3.6, listening on
>>> interfaces other than eth0.
>>> For example:
>>> /usr/bin/ntop -u nobody --sticky-hosts --use-syslog=local6 -i eth0
>>> will run for ages, while
>>> /usr/bin/ntop -u nobody --sticky-hosts --use-syslog=local6 -i eth1
>>> on the same machine
>>> will run for 5-30 seconds and yield Segmentation fault.
>>> The same is true for another machine: on eth0 it works, on eth3 I get
>>> Segmentation fault.
>>> The machines have different hardware configurations; one of them is a
>>> Slackware 12.1 and the latter is a Slackware 12.0.
>>>
>>> Do you have any ideas on why this could happen?
>>> If you need any more information, such as the logs, please let me know
>>> and I will post them, although I don't see differences between the logs
>>> between the two runs.
>>>
>>> Thanks in advance.
>>>
>>>
>>> _______________________________________________
>>> Ntop mailing list
>>> Ntop[at]unipi.it
>>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>
>>
>>
>> Do interfaces eth1 or eth3 have a valid IP assigned to them?
>>
>>
>> _______________________________________________
>> Ntop mailing list
>> Ntop[at]unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>
>>
> In my experiencing running NTOP on FreeBSD I have found it to be a great tool,
> but it seems to be very fragile.
>
> My $.02
> Steve

I'm don't believe the OP was running a FreeBSD box, but my experience with
nTop on FreeBSD lead me to run nTop with on Linux +PF_RING. My distance
varied with FreeBSD 7.0 RELEASE (i386 and amd64) +libpcap and a Intel PT
quad port card.

It seems it only ran for about 13-20 hours and then just "gave up". The
binary would still be running, and the web pages would still be active, but
the libpcap dropped packets skyrocketed up to about 90%. The listening card
would still be in promisc, and off of a mirrored port. If I stopped the
daemon, and restarted it, it would start working immediately.

My mileage also varied using the Intel quad cards under -RELEASE and
-CURRENT, so I switched from what I was raised on for this instance. I have
seven sensors, and nTop has been up on each for 10+ days now after the
latest OS patch.

Regards,
David

_______________________________________________
Ntop mailing list
Ntop[at]unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

sclark at netwolves

Jul 8, 2008, 8:44 AM

Post #7 of 12 (325 views)
Permalink

Re: Slackware - Segmentation fault when listening on eth1 [In reply to]

David Ziemba wrote:
> On 7/8/08 7:25 AM, "Steve Clark" <sclark[at]netwolves.com> wrote:
>
>
>>James Lay wrote:
>>
>>>On 7/8/08 6:17 AM, "Andrei-Florian Staicu" <andrei.staicu[at]ipso.ro> wrote:
>>>
>>>
>>>
>>>>Hello all,
>>>>
>>>>I seem to have a small problem when running ntop 3.3.6, listening on
>>>>interfaces other than eth0.
>>>>For example:
>>>>/usr/bin/ntop -u nobody --sticky-hosts --use-syslog=local6 -i eth0
>>>>will run for ages, while
>>>>/usr/bin/ntop -u nobody --sticky-hosts --use-syslog=local6 -i eth1
>>>>on the same machine
>>>>will run for 5-30 seconds and yield Segmentation fault.
>>>>The same is true for another machine: on eth0 it works, on eth3 I get
>>>>Segmentation fault.
>>>>The machines have different hardware configurations; one of them is a
>>>>Slackware 12.1 and the latter is a Slackware 12.0.
>>>>
>>>>Do you have any ideas on why this could happen?
>>>>If you need any more information, such as the logs, please let me know
>>>>and I will post them, although I don't see differences between the logs
>>>>between the two runs.
>>>>
>>>>Thanks in advance.
>>>>
>>>>
>>>>_______________________________________________
>>>>Ntop mailing list
>>>>Ntop[at]unipi.it
>>>>http://listgateway.unipi.it/mailman/listinfo/ntop
>>>
>>>
>>>
>>>Do interfaces eth1 or eth3 have a valid IP assigned to them?
>>>
>>>
>>>_______________________________________________
>>>Ntop mailing list
>>>Ntop[at]unipi.it
>>>http://listgateway.unipi.it/mailman/listinfo/ntop
>>>
>>>
>>
>>In my experiencing running NTOP on FreeBSD I have found it to be a great tool,
>>but it seems to be very fragile.
>>
>>My $.02
>>Steve
>
>
>
> I'm don't believe the OP was running a FreeBSD box, but my experience with
> nTop on FreeBSD lead me to run nTop with on Linux +PF_RING. My distance
> varied with FreeBSD 7.0 RELEASE (i386 and amd64) +libpcap and a Intel PT
> quad port card.
>
> It seems it only ran for about 13-20 hours and then just "gave up". The
> binary would still be running, and the web pages would still be active, but
> the libpcap dropped packets skyrocketed up to about 90%. The listening card
> would still be in promisc, and off of a mirrored port. If I stopped the
> daemon, and restarted it, it would start working immediately.
>
> My mileage also varied using the Intel quad cards under -RELEASE and
> -CURRENT, so I switched from what I was raised on for this instance. I have
> seven sensors, and nTop has been up on each for 10+ days now after the
> latest OS patch.
>
> Regards,
> David
>
> _______________________________________________
> Ntop mailing list
> Ntop[at]unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
>
>
Hi David,

Thanks for the info. Mine seems to run pretty well but, sometimes the web server gives up after
an indeterminate period of time - could be hours could be days, also sometimes when I click on a column
to change the sort order it dies, other times clicking on the same column works.

It just doesn't seem to be a real robust application. I don't know if that is because of the components
it uses, or the infrastructure that ties it altogether.

Just my $.02

Steve
_______________________________________________
Ntop mailing list
Ntop[at]unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

michael at horizonbroadband

Jul 8, 2008, 8:58 AM

Post #8 of 12 (324 views)
Permalink

Re: Slackware - Segmentation fault when listening on eth1 [In reply to]

Years back when I first discovered ntop, it ran like a champ and never
'quit'. I've tried to install new versions and it works and then starts
dropping zillions of packets. In both/all situations, all I ever did
was what I was told by ... can't remember his name ... oh, Burton ...
but it was always, "read the directions"! So I did, and it worked.

Not anymore. And I don't have time to figure out why. I keep
subscribed only to see if/when it stabilizes again.

I feel bad about this because I know that Luca and many others have
dumped many hours of work into this product ... for little or no
compensation. ntop is wonderful and great ... but it's not useful to me
in its current form. (well, I haven't tried the latest build ... or
maybe I have ... it was about a year ago last I installed it).

Steve Clark wrote:

> Thanks for the info. Mine seems to run pretty well but, sometimes the web server gives up after
> an indeterminate period of time - could be hours could be days, also sometimes when I click on a column
> to change the sort order it dies, other times clicking on the same column works.
>
> It just doesn't seem to be a real robust application. I don't know if that is because of the components
> it uses, or the infrastructure that ties it altogether.
>
> Just my $.02

_______________________________________________
Ntop mailing list
Ntop[at]unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

David.Ziemba at ColoradoCollege

Jul 8, 2008, 9:13 AM

Post #9 of 12 (326 views)
Permalink

Re: Slackware - Segmentation fault when listening on eth1 [In reply to]

On 7/8/08 9:58 AM, "Michael Handiboe" <michael[at]horizonbroadband.net> wrote:

> Years back when I first discovered ntop, it ran like a champ and never
> 'quit'. I've tried to install new versions and it works and then starts
> dropping zillions of packets. In both/all situations, all I ever did
> was what I was told by ... can't remember his name ... oh, Burton ...
> but it was always, "read the directions"! So I did, and it worked.
>
> Not anymore. And I don't have time to figure out why. I keep
> subscribed only to see if/when it stabilizes again.
>
> I feel bad about this because I know that Luca and many others have
> dumped many hours of work into this product ... for little or no
> compensation. ntop is wonderful and great ... but it's not useful to me
> in its current form. (well, I haven't tried the latest build ... or
> maybe I have ... it was about a year ago last I installed it).

I can only say positive about my experiences after switching to Linux with
PF_RING from FreeBSD 7.0-RELEASE. The only time I've had to restart nTop
was after a box reboot after OS patches or to build the latest release of
nTop.

I firmly believe nTop is extremely robust for what I'm using it for, and
tremendously robust for it's intended use.

Regards,
David

_______________________________________________
Ntop mailing list
Ntop[at]unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

andrei.staicu at ipso

Jul 8, 2008, 9:25 AM

Post #10 of 12 (326 views)
Permalink

Re: Slackware - Segmentation fault when listening on eth1 [In reply to]

David Ziemba wrote:
> On 7/8/08 9:58 AM, "Michael Handiboe" <michael[at]horizonbroadband.net> wrote:
>
> I can only say positive about my experiences after switching to Linux with
> PF_RING from FreeBSD 7.0-RELEASE. The only time I've had to restart nTop
> was after a box reboot after OS patches or to build the latest release of
> nTop.
>
> I firmly believe nTop is extremely robust for what I'm using it for, and
> tremendously robust for it's intended use
Ok, so: is there any way I can determine if the problem lies in some
other place but ntop? I tried running it with --trace-level 5, but
nothing useful shows. I tried --enable-debug, but doesen't seem to
recognize this option (/usr/bin/ntop: unrecognized option `--enable-debug')
I use kernel 2.6.24.5 (smp) with libpcap 0.9.8 on one machine and
2.6.21.5 (smp) with libpcap 0.9.7 on the other.

_______________________________________________
Ntop mailing list
Ntop[at]unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

Ggatten at waddell

Jul 8, 2008, 10:54 AM

Post #11 of 12 (323 views)
Permalink

Re: Slackware - Segmentation fault when listening on eth1 [In reply to]

Running it inside gdb will tell all. Check the FAQ for some tips on
this.

G

-----Original Message-----
From: ntop-bounces[at]unipi.it [mailto:ntop-bounces[at]unipi.it] On Behalf Of
Andrei-Florian Staicu
Sent: Tuesday, July 08, 2008 11:26 AM
To: ntop[at]unipi.it
Subject: Re: [Ntop] Slackware - Segmentation fault when listening on
eth1

David Ziemba wrote:
> On 7/8/08 9:58 AM, "Michael Handiboe" <michael[at]horizonbroadband.net>
wrote:
>
> I can only say positive about my experiences after switching to Linux
with
> PF_RING from FreeBSD 7.0-RELEASE. The only time I've had to restart
nTop
> was after a box reboot after OS patches or to build the latest release
of
> nTop.
>
> I firmly believe nTop is extremely robust for what I'm using it for,
and
> tremendously robust for it's intended use
Ok, so: is there any way I can determine if the problem lies in some
other place but ntop? I tried running it with --trace-level 5, but
nothing useful shows. I tried --enable-debug, but doesen't seem to
recognize this option (/usr/bin/ntop: unrecognized option
`--enable-debug')
I use kernel 2.6.24.5 (smp) with libpcap 0.9.8 on one machine and
2.6.21.5 (smp) with libpcap 0.9.7 on the other.

_______________________________________________
Ntop mailing list
Ntop[at]unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

<font size="1">
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'>
</div>
"This email is intended to be reviewed by only the intended recipient
and may contain information that is privileged and/or confidential.
If you are not the intended recipient, you are hereby notified that
any review, use, dissemination, disclosure or copying of this email
and its attachments, if any, is strictly prohibited. If you have
received this email in error, please immediately notify the sender by
return email and delete this email from your system."
</font>

_______________________________________________
Ntop mailing list
Ntop[at]unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

deri at ntop

Jul 9, 2008, 4:23 AM

Post #12 of 12 (310 views)
Permalink

Re: Slackware - Segmentation fault when listening on eth1 [In reply to]

Hi,
would you be willing to connect to your machine fro debugging?

Luca

> Hello all,
>
> I seem to have a small problem when running ntop 3.3.6, listening on
> interfaces other than eth0.
> For example:
> /usr/bin/ntop -u nobody --sticky-hosts --use-syslog=local6 -i eth0
> will run for ages, while
> /usr/bin/ntop -u nobody --sticky-hosts --use-syslog=local6 -i eth1
> on the same machine
> will run for 5-30 seconds and yield Segmentation fault.
> The same is true for another machine: on eth0 it works, on eth3 I get
> Segmentation fault.
> The machines have different hardware configurations; one of them is a
> Slackware 12.1 and the latter is a Slackware 12.0.
>
> Do you have any ideas on why this could happen?
> If you need any more information, such as the logs, please let me know
> and I will post them, although I don't see differences between the logs
> between the two runs.
>
> Thanks in advance.
>
>
> _______________________________________________
> Ntop mailing list
> Ntop[at]unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
>

_______________________________________________
Ntop mailing list
Ntop[at]unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact lists@gossamer-threads.com