LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Networking (http://www.linuxquestions.org/questions/linux-networking-3/)
-   -   ntop v.3.3.10 packets dropped by pf_ring enabled libpcap (http://www.linuxquestions.org/questions/linux-networking-3/ntop-v-3-3-10-packets-dropped-by-pf_ring-enabled-libpcap-709503/)

anastas 03-05-2009 07:45 PM

ntop v.3.3.10 packets dropped by pf_ring enabled libpcap
 
I'm having an issue where Ntop shows majority of packets dropped by libpcap.
This is odd cause I've recompiled a kernel to include PF_RING pathes, as well as pcap library and fresh ntop v.3.3.10 from SVN. Ntop have been also compiled with -lpfring -lpthread (amongst other flags), removing -lpcap is not an option (otherwise it won't "make" it).

Kernel module is inserted and while ntop is running I see that a new PF_RING interface is being created (and used as it shown in /proc/net/pf_ring and via "lsmod | grep ring").

I start ntop as follows:
ntop -x 4294967296 -g -i eth5 -4 -o -d


This is a ldd output for ntop..
[root@locahost ~]# ldd /usr/local/bin/ntop
linux-gate.so.1 => (0xb7f38000)
libntopreport-3.3.10.so => /usr/local/lib/libntopreport-3.3.10.so (0xb7e64000)
libntop-3.3.10.so => /usr/local/lib/libntop-3.3.10.so (0xb784b000)
libGeoIP.so.1 => /usr/local/lib/libGeoIP.so.1 (0xb781b000)
libssl.so.6 => /lib/libssl.so.6 (0x00637000)
libcrypto.so.6 => /lib/libcrypto.so.6 (0x0022b000)
librrd_th.so.2 => /usr/lib/librrd_th.so.2 (0x00c18000)
libgdbm.so.2 => /usr/lib/libgdbm.so.2 (0x00bbb000)
libz.so.1 => /usr/lib/libz.so.1 (0x00b8d000)
libpfring.so => /usr/local/lib/libpfring.so (0xb780f000)
libperl.so => /usr/lib/perl5/5.8.8/i386-linux-thread-multi/CORE/libperl.so (0xb76dd000)
libresolv.so.2 => /lib/libresolv.so.2 (0x00dd1000)
libnsl.so.1 => /lib/libnsl.so.1 (0x00ba2000)
libdl.so.2 => /lib/libdl.so.2 (0x00ad8000)
libm.so.6 => /lib/libm.so.6 (0x00ade000)
libcrypt.so.1 => /lib/libcrypt.so.1 (0x00c9c000)
libutil.so.1 => /lib/libutil.so.1 (0x04257000)
libpthread.so.0 => /lib/libpthread.so.0 (0x00b07000)
libc.so.6 => /lib/libc.so.6 (0x00993000)
libgssapi_krb5.so.2 => /usr/lib/libgssapi_krb5.so.2 (0x00427000)
libkrb5.so.3 => /usr/lib/libkrb5.so.3 (0x0036a000)
libcom_err.so.2 => /lib/libcom_err.so.2 (0x00dcc000)
libk5crypto.so.3 => /usr/lib/libk5crypto.so.3 (0x003ff000)
libfreetype.so.6 => /usr/lib/libfreetype.so.6 (0x00596000)
libpng12.so.0 => /usr/lib/libpng12.so.0 (0x0085f000)
libart_lgpl_2.so.2 => /usr/lib/libart_lgpl_2.so.2 (0x049dc000)
/lib/ld-linux.so.2 (0x00975000)
libkrb5support.so.0 => /usr/lib/libkrb5support.so.0 (0x00457000)
libkeyutils.so.1 => /lib/libkeyutils.so.1 (0x00dc7000)
libselinux.so.1 => /lib/libselinux.so.1 (0x00b20000)
libsepol.so.1 => /lib/libsepol.so.1 (0x00b3a000)
Can't quite figure this out after being at it for 10 hours..
Any input is appreciated.

P.S.
All builds were successful, so it's not like I've been ignoring errors left and right

P.P.S.
running latest and greatest CentOS 5.2

P.P.P.S
when running included pfcount binary on the same interface packets dropped is nearly 0
[root@localhost ntop_svn]# cat /proc/net/pf_ring/*eth5*
### ntop ###
Bound Device : eth5
Version : 9
Sampling Rate : 1
IP Defragment : No
BPF Filtering : Disabled
# Filt. Rules : 0
Cluster Id : 0
Channel Id : -1
Tot Slots : 4096
Bucket Len : 8232
Slot Len : 8302 [bucket+header]
Tot Memory : 34009088
Tot Packets : 113347473
Tot Pkt Lost : 111643664
Tot Insert : 1703809
Tot Read : 1699713

### pfcount ###
Num Free Slots: 0
Bound Device : eth5
Version : 9
Sampling Rate : 1
IP Defragment : No
BPF Filtering : Disabled
# Filt. Rules : 0
Cluster Id : 0
Channel Id : -1
Tot Slots : 4115
Bucket Len : 128
Slot Len : 198 [bucket+header]
Tot Memory : 815104
Tot Packets : 4859623
Tot Pkt Lost : 12
Tot Insert : 4859611
Tot Read : 4859606
Num Free Slots: 4110
I do see some differences in Slot and Bucket length, but ntop doesn't seem to allow specifying these


All times are GMT -5. The time now is 12:58 PM.