If the processor is sufficient to keep up - i.e. you're not losing packets, then all you need is memory. If you're also losing packets, well, then ... you can guess the response.
Move EVERYTHING else off the host to free up as much room for ntop as possible. Buy memory. Seriously, if the motherboard will handle it (and my servers are all 440BXes still and do just fine), a stick (256MB - SDRAM, PC133 � CL=2 � Unbuffered � Non-parity � 7.5ns � 3.3V � 32Meg x 64, P/N CT32M64S4D7E) is $52.99 at crucial. The current cvs has a lot more info in the info.html/textinfo.html reports, including memory usage, host sizes, etc. Tons of bug fixes. As to hosts, if you have to track them, well, you have to track them - figure 12-13K per host unless they have a lot of sessions. But for basic users, that seems to be about the right #. Base load is around 15MB. 47MB is on the edge. It might give you the ability to around 2400 hosts (unless there are a lot of open sessions), but no headroom. One Kazza user or one port scan and pow... There is a data in the textinfo.html report in ntop's cvs version about memory usage... Here's from my system: Memory allocation - data segment arena limit, getrlimit(RLIMIT_DATA, ...).....-1 Allocated blocks (ordblks).....74 Allocated (arena).....5841116 Used (uordblks).....5753020 Free (fordblks).....88096 Memory allocation - mmapped Allocated blocks (hblks).....9 Allocated bytes (hblkhd).....10817536 The mmapped allocations are the big blocks allocated during startup, the data segment stuff is used for hosts, sessions, etc. There's a startup load around 4M+ of arena space used for smaller initial allocations. I'm going to be adding a log message during startup showing (if malloc.h exists) the base memory load. Host/Session counts - global Purge idle hosts.....Enabled Purged hosts.....394 Maximum hosts to purge per cycle.....512 DEFAULT_MAXIMUM_HOSTS_PURGE_PER_CYCLE.....512 Terminated Sessions.....1,451 Host/Session counts - Device 0 (eth1) Actual Hash Size.....512 Stored hosts.....92 [17 %] Sessions.....4 Max Num. Sessions.....22 Host/Session counts - Device 1 (eth2) Actual Hash Size.....512 Stored hosts.....41 [8 %] Sessions.....30 Max Num. Sessions.....30 Host/Session counts - Device 2 (NetFlow-device) Actual Hash Size.....32 Stored hosts.....1 [3 %] Sessions.....0 Max Num. Sessions.....0 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Juan Puchalski Sent: Sunday, March 09, 2003 8:50 PM To: [EMAIL PROTECTED] Subject: RE: [Ntop] NTOP eating memory without stopping Thanks for your quick reply! >What's your traffic flow - is the a DLS/Cable/dial w/ a few hosts? I run 2x384 frame relay links, which average a 50% usage on a 24h period. >1. Get a real system... Doesn't have to be a P$-3.06g w/ 2GB of ram, but >something a little beefier - add memory - it's cheap today ... After the >OS >and all the other cr*p running, how much is really available to ntop w/o >swapping - that's the critical measurement. Once ntop starts to swap, >you're dead - walking the tables to compute throughput etc. puts a big load >on the system. Yeah, I can see your point. When NTOP isn't running, there's around 47 megs free in the server. When I run it, it gobbles it up quickly and starts to swap. The thing is, I'm pretty much cash/hardware strapped. I live in a south american country going thru an almost-civil-war, and getting new hardware is next to impossible right now. I saw textinfo.html, and doesn't include any memory usage info. Altho I just noticed I never did update to .55! I'm still running .3. Do I gain anything by upgrading to the latest CVS? >3. Don't track external hosts (use the flag to turn it off). People >connecting to you can add a big # of hosts you may not think of. I thought of this, but it brings a small question. The most important thing I track with NTOP is the network usage by each host. How many megs has client A downloaded, who was the culprit of the huge upload spike i just saw in MRTG and that sort of thing. By not tracking external hosts, does NTOP still capture the entire traffic each of my hosts do, or just the L-L traffic inside the network? Juan Puchalski _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
