RE: [Ntop] ntop replicating itself and libpcap entropy

Mon, 14 Feb 2005 07:53:05 -0800

1) Yup
2) The extra 'instances' are zombies - things like page creation that failed.  Some OSes reap 'em, others don't
 
-----Burton

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Jon Dossey
Sent: Monday, February 14, 2005 9:51 AM
To: [email protected]
Subject: [Ntop] ntop replicating itself and libpcap entropy

I’ve got a couple little issues, I figured I’d see if anyone had run into these before.

 

First off, the machine running NTOP is a DL360 (dual 3ghz xeon, ultra320 scsi (0+1), dual 10/100 NIC’s) with a gig fiber NIC plugged into a 16 port switch blade in a 6509.  The other 15 ports are spanned into the last port, which is used for monitoring.  Network load according to NTOP never exceeds about 100mb/s. 

 

After several hours of processing, it seems like libpcap will start dropping packets (according to Summary -> Traffic).  It seems like the longer its running, the higher percentage of packets it will drop.  I started ntop on Friday, came back today, and libpcap was dropping over 50% of the traffic.  Also, I noticed that I had about 5 or 6 instances of ntop running (according ps aux | grep ntop), with the exact same command line options. 

 

Any insight would be appreciated.

 

Thanks,

Jon

__________________________________________________________________________

"The information transmitted is intended only for the person or entity to 
which it is addressed and may contain confidential, proprietary, and/or 
privileged material.  Any review, retransmission, dissemination or other 
use of, or taking of any action in reliance upon, this information by 
persons or entities other than the intended recipient is prohibited.  
If you received this in error, please contact the sender and delete 
the material from all computers."

_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop

Reply via email to