On Thu, 2005-10-06 at 14:18 -0500, Rader, D. Alan wrote: > After more testing, it looks like whenever I watch a mirror port is when > this happens. I have tried all the below switches: > > --no-mac > -n > --numeric-ip-addresses > --no-promiscuous > > None of which made a difference. It doesn't matter if I mirror a single > vlan, or all traffic it causes sessions to hang. If I just watch the > traffic in the subnet that em1 is in, everything is fine. It doesn't do > me any good if I can't watch all traffic coming and going to/from the > Internet. Any ideas? >
Are you sure you have enough hardware? My traffic is mostly in the 10MB range, with spikes up to 30 or so. On my 2x866MHz Xeon w/2GB RAM I had to restrict NTop pretty substantially to keep it up at all when watching our WAN link. Defining --local-subnets and then using --track-local-hosts to only watch those hosts in depth made the biggest difference, but it took the whole package in order to reach relative stability. It still crashes from time to time, but nowhere near as frequently as before. Here are the performance-related switches I use: --local-subnets --no-mac --track-local-hosts --disable-sessions --no-fc --disable-decoders HTH, -Aaron _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
