Yeah, well, Mr. H knows what I think of his *adequate* hardware... sort of "please don't shoot the piano player, he's doing the best he can". But let's look at things...
Seriously, there's a quantum difference here - both in expectations, capacity and traffic. First off, I believe that ntop should be run on a dedicated box for the dedicated purpose of monitoring traffic. Both for practical reasons (contention) and security (if somebody compromises the box through an ntop problem, all they get is ntop, vs. all the other services). (Not that I'm aware of ANY problems with ntop security, but I do understand - and have documented - it's limitations. Hardware wise, there's the P3 vs P difference - while ntop shouldn't make too much use of the new P3 instructions, there are core differences (clocks per instruction), such that the difference in capability is much more than the raw 4.4x difference. (look here: http://www.tomshardware.com/cpu/20030217/) As part of the difference, there's also a major difference in memory bandwidth. A P3-733 is probably running PC133 memory. A P-166 probably runs 66Mhz EDO See here http://www.dewassoc.com/performance/memory/how_to_id_pc133.htm for an interesting article. The amount of bits per packet is the same, so there's at least another 2x difference... although caching helps, so let's call it 5x difference in raw processing. There's also differences that affect overall performance in the Linux kernel (and I assume FreeBSD) for P vs P3... MTRR for one. There's also interesting stuff on context switching - dated but interesting that is - at http://www.cs.berkeley.edu/~laik/projects/os_benchmarks/publications/usenix1 996.bench.pdf. It seems to say that the box actively running ntop and thus doing frequent context changes between a small # of processes will perform significantly slower under FreeBSD (3.0 albeit) than Linux (1.2!). There are also gcc options - benefits, etc. unclear - see http://gcc.gnu.org/onlinedocs/gcc/i386-and-x86-64-Options.html#i386%20and%20 x86-64%20Options. There are alignment differences P vs P3, which might impact us because of the unsigned long long counters used. Somebody might try -malign-double. Anyway, put it all together and while you clearly don't explain everything about the differences, it is a big start. Other things you need to look at are what that 128K or 10M stream is - the # of packets is going to be more important than the # of bits per second. -----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of David Touitou Sent: Monday, November 10, 2003 7:48 AM To: [EMAIL PROTECTED] Subject: Re: [Ntop] openbsd 1st comments: zombie, much cpu Burton Strauss wrote: > Given you're both playing with the fxp driver, and the only diff > seems to be D_P, it's worth a try, right? And CPU/bandwidth... I'm sniffing 10Mbps bandwidth with a P3-733. I consider CPU usage (30%) not that big. Stanley is sniffing less than 128kbps with a Pentium 166... He finds 30-50% CPU usage too high 8-/ David. _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
