You are wrong on -j - it's really not local vs remote, it's whether or not
to use the MAC address.
As to the loading... you've still never said what your system and cpu are...
You've also not run the ntop only test I asked you to run.
But, ok, think abstract for a while... Basically, I'm asking you to use
your head and THINK about how the underlying computer and network and
protocols work. And this will be a bit abreviated - if you don't understand
it, STFW for information - there are good tutorials out there on this stuff.
Sure ntop isn't as much load as the ftp (it doesn't use the disk), but it
does a fair bit of processing to understand the packets, lookup names, etc.
which ftp doesn't... If it's 2/3 as much as the ftp, then ntop by itself
might use say 47% of the cpu.
Both running together would be more than 100% and that ain't going to fly.
Instead, BOTH get less than they could have potentially used... and how
close you come to pegging the cpu depends on the efficiency of the OS. AND
on one other thing...
ntop is passive - it's going to take packets as they come.
The ftp daemon is the destination, so it will not send acks until it can
process what's already been received. So - assuming both daemons have equal
priority - you will see a slow down in the ftp, because the sender waits for
the acks once it's filled the window.
Check the configuration report (info.html) and look at the queue (in the
latest cvs version, they are
Packet queue
Queued to Process and Maximum queue
That tells you how well ntop is keeping up.
Basically, if you're telling me that ntop can keep up with a 67% loaded
100BaseT link on a (xxxx) cpu at (yyy) MHz, that's GOOD.
-----Burton
-----Original Message-----
From: Frank Raiser [mailto:[EMAIL PROTECTED]]
Sent: Saturday, June 15, 2002 3:46 PM
To: Burton M. Strauss III
Subject: Re: [Ntop] CPU load monitoring ftp
On Sat, Jun 15, 2002 at 03:28:28PM -0500, Burton M. Strauss III wrote:
> Read the FAQs at snapshot, the code or the back traffic. While -A was
> pulled as a command line parameter, the code is still present in
> initialize.c, allowing you to - with a source change - revert to the prior
> performance. Look around line 400 in initialize.c.
Ok so from what I read using -j is the same and forces only monitoring
of local hosts. I can get the ftp rates up to 6,5MB/s with this, but
that's still far from the 9MB/s without ntop.
When ntop is not monitoring the ftpd consumes 70-80% cpu. ntop with -j
uses up 20-30%.
--
Raiser, Frank
_______________________________________________
Ntop mailing list
[EMAIL PROTECTED]
http://lists.ntop.org/mailman/listinfo/ntop
