-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi all,
Just another small question about the hash size of nprobe: Is this size in terms of "buckets" (positions) or in terms of bytes/bits? It would be just good to know to do some basic consideration. Regards, Daniel > Hi all, > let me explain this in detail. > > A hash is a contiguous array of list pointers. Incoming flows are hashed > (using > the 5 tuples) and the obtained hash_id value is used to identify the array > index. As hashes are a way to "compress" information, it might happen that > two > different flows have the same hash_id, thus the list pointer is used to > maintain a list of "collisions". With -w you set the array size, whereas the > list size can be as long as necessary. This said, in order to set an upper > limit, nprobe via > > [--max-num-flows|-M] <max num flows>| Limit the number of active flows > > defines the max number of flows it can handle > > This said, you must choose -w according to the number of flows you expect to > have in your network. The value must be a good compromise between number of > flows and memory usage. We suggest to set it to twice the expected number of > concurrent flows, but as I have explained it, in case of large flow number, > you > won't drop flows (except you will specify a low value for -M) but just have a > slower probe as it has to maintain long collision lists. If you start nprobe > with "-b 1" you can see some stats like > > 13/Mar/2011 11:30:13 [nprobe.c:1475] Flow Buckets: > [active=11401][allocated=11401][toBeExported=0][frags=0] > 13/Mar/2011 11:30:13 [nprobe.c:1511] Processed packets: 24834 (max bucket > search: 3) > > In this case nProbe says that > 1. your flow cache has 11401 entries (= flows) > 2. the longest collision list is 3 that's still acceptable. If you exceed 8, > you better use a bigger value for -w next time you start nProbe. > > I hope I have clarified the details. > > Regards Luca > > On Mar 10, 2011, at 11:31 AM, Maurizio Molina wrote: > >> >> >> On 10.03.2011 11:16, Yuri Francalacci wrote: >>> Daniel >>> the meaning of "hash size is static" means that once you decide its size, >>> this size is fixed. >>> The meaning of "tunable" means that is the default hash size does not fit >>> your requirements (due traffic conditions), >> >> and how can you realize that you run into that condition? I mean, will >> nprobe >> log somewhere flow accounting losses due to a too small hash size? >> Thanks, >> Maurizio >> >> you can choose to set the size >>> you prefer/need, but this allocation is done up on nprobe statup. >>> Regards, Yuri >>> >>> >>> On Thu, 10 Mar 2011 11:12:15 +0100, Daniel Aschwanden<[email protected]> wrote: >>>> Ciao Luca and community, >>>> >>>> I have a question about the allocation of the hash in nProbe. >>>> >>>> On page 28 of your documentation (section 2.4 Tuning nProbe >>>> Performance), you state that the hash size is static, but on the >>>> footnote you mention that the hash "can grow as needed according to >>>> traffic". Does this mean that one have to set the -w flag according to >>>> the traffic (which makes sense) or does nProbe grow his hash according >>>> to traffic? >>>> >>>> Sorry about this fuzzy question, but in my eyes the footnote contradicts >>>> the statement of static allocation. >>>> >>>> Thanks a lot for your clarification. >>>> >>>> Cheers >>>> >>>> Dani >>>> _______________________________________________ >>>> Ntop-misc mailing list >>>> [email protected] >>>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc >>> >> >> -- >> _______________________________________________ >> Ntop-misc mailing list >> [email protected] >> http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > --- > Due to lack of interest, tomorrow is cancelled - Kaiser Chiefs > > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc - -- daniel aschwanden junior engineer open systems ag raeffelstrasse 29 ch-8045 zurich t: +41 44 455 74 00 f: +41 44 455 74 01 [email protected] http://www.open.ch -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iF4EAREIAAYFAk2kczgACgkQxIzmH53Qg6GtkAD/RKcAvnEGn0jCh59dKXOXrZPN QJ4CvSad+uTJg+k2ZRQA/0Aw8KBZRA3QZaS1cEmHldM8CrMbfLQr1CjOvDJ+Ww7R =flaW -----END PGP SIGNATURE----- _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
