We've emailed around this, but it's in my inbox unread, so let me respond specifically
"for the record"
1. A few packets occasionally lost isn't a big deal for most users. After all, the
network itself has losses - I've seen my AT&T
Broadband connection have spurts of 30% packet loss. Ideally in a LAN environment,
the packet loss should be down in the small
#s... the Ethernet standard allows 1 error in 100,000,000(10^8), but most vendors
beat that by a long margin (even as high as 1 in
10^12).
Of course, those are lab measurements. In the real world? Not that good. Electrical
noise can be a real bugaboo. Let's see:
eth0 Link encap:Ethernet HWaddr xx:xx:xx:xx:xx:xx
inet addr:192.168.xxx.xxx Bcast:192.168.xxx.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:3519287 errors:26 dropped:0 overruns:0 frame:27
TX packets:402403 errors:3 dropped:0 overruns:0 carrier:6
collisions:1554 txqueuelen:100
RX bytes:2150909150 (2051.2 Mb) TX bytes:68867908 (65.6 Mb)
Interrupt:11 Base address:0xc000
So 1 in 44K TX and 1 in 66K RX. Not very good... acceptable - yeah I can live with it
(that's my ntop development box and I beat on
it a lot and it's got a cheap on-board nic).
On my firewall (cheap PCI nics - NetGear IIRC):
eth0 Link encap:Ethernet HWaddr xx:xx:xx:xx:xx:xx9
inet addr:12.xxx.xxx.xxx Bcast:255.255.255.255 Mask:255.255.255.128
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:9115999 errors:0 dropped:0 overruns:0 frame:0
TX packets:5334403 errors:0 dropped:0 overruns:0 carrier:0
collisions:346997 txqueuelen:100
RX bytes:4065546013 (3877.2 Mb) TX bytes:515474630 (491.5 Mb)
Interrupt:10 Base address:0xa800
eth2 Link encap:Ethernet HWaddr xx:xx:xx:xx:xx:xx
inet addr:192.168.xxx.xxx Bcast:192.168.xxx.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:5292052 errors:0 dropped:0 overruns:0 frame:0
TX packets:7122360 errors:2 dropped:0 overruns:2 carrier:2
collisions:0 txqueuelen:100
RX bytes:527811123 (503.3 Mb) TX bytes:3890964344 (3710.7 Mb)
Interrupt:12
Losses are less than 1 in 1,000,000... Remember, at a certain point, if the nic
doesn't understand what it's seeing, it throws it
away and declares an error. The key is to keep up with the traffic.
Similarly, the Linux kernel does the same thing in it's interrupt handling. Last
resort, but better than hanging up the whole
machine.
And as I talked about in one of the messages I've sent you, ntop drops packets when
the queue gets longer than the permitted length.
You can see this in the configuration page as # Queued Pkts to Process and # Max
Queued Pkts.
Again, one or two or a small number (you pick your tollerance) is ok, but constant
losses isn't. What I'm saying is that as long as
ntop can keep up with the nic, then the data is as good as it gets... if ntop can't
keep up, then the data isn't very good.
As we've discussed, you're running a Pentium 166MMX w/ 64MB of RAM and that's probably
just not got enough CPU power nor memory to
run anything beyond a minimal ntop (i.e. very lightly used network).
2. Actually, I don't think they are rounded, but rather truncated. Regardless it's
to whatever the precision is. So 2.5 MB could
be 2500 KB or 2501 KB or 2599.999 KB
Now you can do some calculations and guess at some averages:
> Total 2.5 MB [5,502 Pkts]
So that's average of 454 bytes / packet
> IP Traffic 2.5 MB [5,422 Pkts]
That's an average of 461 bytes / packet
> Non IP Traffic 4.4 KB
4400/(5502-5422) = 55 bytes / packet
But, that doesn't tell you much does it? <grin />
-----Burton
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of
Boniforti Flavio
Sent: Saturday, April 13, 2002 3:26 AM
To: 'Burton M. Strauss III'; [EMAIL PROTECTED]
Subject: R: [Ntop] Totals for one ETH???
> Couple things:
>
> 1. Packets
>
> Total 5,502
> Dropped by the kernel 0 <-- may be non-zero
> Dropped by ntop 0
> Unicast 99.3% 5,464
> Broadcast 0.7% 38
>
> If the kernel is dropping packets, it can be because the are
> queued for
> analysis or you have a filter in place (-B option). If
> neither of those is
> true, and the # is growing over time, your machine isn't
> keeping up with
> traffic. Then all bets are off about totals...
OK, so you're telling me that's normal to have some kernel-dropped packets,
as long as they do not grow over time, right?
Well, unfortunately that's exactly my case!!! What do you think should I
improve on my machine to get this value down?
>
>
> 2. Traffic
>
> Total 2.5 MB [5,502 Pkts]
> IP Traffic 2.5 MB [5,422 Pkts]
> Fragmented IP Traffic [0.0%]
> Non IP Traffic 4.4 KB
>
> Remember, these are rounded values...
>
How much are they rounded?
>
_______________________________________________
Ntop mailing list
[EMAIL PROTECTED]
http://listmanager.unipi.it/mailman/listinfo/ntop
_______________________________________________
Ntop mailing list
[EMAIL PROTECTED]
http://listgateway.unipi.it/mailman/listinfo/ntop
