If you read way back in the list, this is a known item. The various NICs report different things for the counters (some total, some # since last read). ntop tries to figure out which way the NIC is reporting, but can be fooled (esp. if the counts are low (and of course, we recommend running ntop on it's own system, so it should start up before there is a lot of traffic and that just makes it worse: there's no easy way to distinguish between the two types of reporting)
If you look at ifconfig, you are seeing un-interpreted counters without any smarts so it doesn't look funny. If ntop gets it wrong ... well, we check the counter when we refresh and so the 'faster you refresh the wackier it gets' is he give-away. But, that's just a pass through from the NIC it's not ntop losing them. Just ignore it, nothing other than not passing along the info can be done. -----Burton -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Mike Tremaine Sent: Wednesday, August 12, 2009 7:03 AM To: [email protected] Subject: Re: [Ntop] Libpcap counter issue? Gary Gatten wrote: > > Try not to run the dev releases unless you must, who knows what > condition they're in at any given time. > > Do you think it's actually dropping packets, just the decimal is off > by 3 (or more) places? Or, is this bug just in the way the stats are > collected and displayed and there is no significant packet loss? > I don't believe there is packet loss, this is early morning and the network is pretty quiet, I think the counter is somehow getting messed up. I probably should be running 3.3.10 but since I had already started with the dev package and got it stable [mostly] I just kept using it. -Mike _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
