richard at mochimedia
Nov 3, 2009, 2:13 PM
Post #1 of 1
(91 views)
Permalink
|
|
Poor ntop performance with pf_ring 4.1
|
|
Hello, I'd appreciate any help possible in troubleshooting some poor
ntop performance I'm seeing. I'm seeing a lot of dropped packets both
in the ntop UI and in pf_ring's output. Here's the pf_ring info:
cat /proc/net/pf_ring/*
Bound Device : eth3
Slot Version : 10 [4.1.0]
Sampling Rate : 1
Appl. Name : <unknown>
IP Defragment : No
BPF Filtering : Disabled
# Filt. Rules : 0
Cluster Id : 0
Channel Id : -1
Tot Slots : 65535
Bucket Len : 8232
Slot Len : 8346 [bucket+header]
Tot Memory : 546959360
Tot Packets : 30752095
Tot Pkt Lost : 25111485
Tot Insert : 5640610
Tot Read : 5575075
Tot Fwd Ok : 0
Tot Fwd Errors : 0
Num Free Slots : 0
PF_RING Version : 4.1.0 ($Revision: 3982 $)
Ring slots : 65535
Slot version : 10
Capture TX : No [RX only]
IP Defragment : No
Transparent mode : Yes
Total rings : 1
Total plugins : 0
ntop sampling is currently set to 2, but it can't even keep up with
that. It's only handling about 45k pps. I think part of the problem
here might be the bucket length? Previously ntop didn't have to worry
about this because it was handled by pf_ring. Now, pf_ring lets the
apps set different capture sizes and is no longer set when loading the
module. Any idea on how to get ntop to set the bucket length to 64 or
128 bytes?
Thanks.
-richard
_______________________________________________
Ntop mailing list
Ntop[at]listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop
|
