LinuxQuestions.org
LinuxAnswers - the LQ Linux tutorial section.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
LinkBack Search this Thread
Old 03-05-2009, 07:45 PM   #1
anastas
LQ Newbie
 
Registered: Jul 2005
Location: boston, ma
Distribution: CentOS 5.2
Posts: 1

Rep: Reputation: 0
Question ntop v.3.3.10 packets dropped by pf_ring enabled libpcap


I'm having an issue where Ntop shows majority of packets dropped by libpcap.
This is odd cause I've recompiled a kernel to include PF_RING pathes, as well as pcap library and fresh ntop v.3.3.10 from SVN. Ntop have been also compiled with -lpfring -lpthread (amongst other flags), removing -lpcap is not an option (otherwise it won't "make" it).

Kernel module is inserted and while ntop is running I see that a new PF_RING interface is being created (and used as it shown in /proc/net/pf_ring and via "lsmod | grep ring").

I start ntop as follows:
ntop -x 4294967296 -g -i eth5 -4 -o -d


This is a ldd output for ntop..
[root@locahost ~]# ldd /usr/local/bin/ntop
linux-gate.so.1 => (0xb7f38000)
libntopreport-3.3.10.so => /usr/local/lib/libntopreport-3.3.10.so (0xb7e64000)
libntop-3.3.10.so => /usr/local/lib/libntop-3.3.10.so (0xb784b000)
libGeoIP.so.1 => /usr/local/lib/libGeoIP.so.1 (0xb781b000)
libssl.so.6 => /lib/libssl.so.6 (0x00637000)
libcrypto.so.6 => /lib/libcrypto.so.6 (0x0022b000)
librrd_th.so.2 => /usr/lib/librrd_th.so.2 (0x00c18000)
libgdbm.so.2 => /usr/lib/libgdbm.so.2 (0x00bbb000)
libz.so.1 => /usr/lib/libz.so.1 (0x00b8d000)
libpfring.so => /usr/local/lib/libpfring.so (0xb780f000)
libperl.so => /usr/lib/perl5/5.8.8/i386-linux-thread-multi/CORE/libperl.so (0xb76dd000)
libresolv.so.2 => /lib/libresolv.so.2 (0x00dd1000)
libnsl.so.1 => /lib/libnsl.so.1 (0x00ba2000)
libdl.so.2 => /lib/libdl.so.2 (0x00ad8000)
libm.so.6 => /lib/libm.so.6 (0x00ade000)
libcrypt.so.1 => /lib/libcrypt.so.1 (0x00c9c000)
libutil.so.1 => /lib/libutil.so.1 (0x04257000)
libpthread.so.0 => /lib/libpthread.so.0 (0x00b07000)
libc.so.6 => /lib/libc.so.6 (0x00993000)
libgssapi_krb5.so.2 => /usr/lib/libgssapi_krb5.so.2 (0x00427000)
libkrb5.so.3 => /usr/lib/libkrb5.so.3 (0x0036a000)
libcom_err.so.2 => /lib/libcom_err.so.2 (0x00dcc000)
libk5crypto.so.3 => /usr/lib/libk5crypto.so.3 (0x003ff000)
libfreetype.so.6 => /usr/lib/libfreetype.so.6 (0x00596000)
libpng12.so.0 => /usr/lib/libpng12.so.0 (0x0085f000)
libart_lgpl_2.so.2 => /usr/lib/libart_lgpl_2.so.2 (0x049dc000)
/lib/ld-linux.so.2 (0x00975000)
libkrb5support.so.0 => /usr/lib/libkrb5support.so.0 (0x00457000)
libkeyutils.so.1 => /lib/libkeyutils.so.1 (0x00dc7000)
libselinux.so.1 => /lib/libselinux.so.1 (0x00b20000)
libsepol.so.1 => /lib/libsepol.so.1 (0x00b3a000)
Can't quite figure this out after being at it for 10 hours..
Any input is appreciated.

P.S.
All builds were successful, so it's not like I've been ignoring errors left and right

P.P.S.
running latest and greatest CentOS 5.2

P.P.P.S
when running included pfcount binary on the same interface packets dropped is nearly 0
[root@localhost ntop_svn]# cat /proc/net/pf_ring/*eth5*
### ntop ###
Bound Device : eth5
Version : 9
Sampling Rate : 1
IP Defragment : No
BPF Filtering : Disabled
# Filt. Rules : 0
Cluster Id : 0
Channel Id : -1
Tot Slots : 4096
Bucket Len : 8232
Slot Len : 8302 [bucket+header]
Tot Memory : 34009088
Tot Packets : 113347473
Tot Pkt Lost : 111643664
Tot Insert : 1703809
Tot Read : 1699713

### pfcount ###
Num Free Slots: 0
Bound Device : eth5
Version : 9
Sampling Rate : 1
IP Defragment : No
BPF Filtering : Disabled
# Filt. Rules : 0
Cluster Id : 0
Channel Id : -1
Tot Slots : 4115
Bucket Len : 128
Slot Len : 198 [bucket+header]
Tot Memory : 815104
Tot Packets : 4859623
Tot Pkt Lost : 12
Tot Insert : 4859611
Tot Read : 4859606
Num Free Slots: 4110
I do see some differences in Slot and Bucket length, but ntop doesn't seem to allow specifying these

Last edited by anastas; 03-06-2009 at 10:20 AM. Reason: additional info / corrections
 
  


Reply

Tags
centos, centos5, centos52, dropping, ntop, packets


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
libpcap error while compiling ntop from source noir911 Linux - Server 1 07-24-2008 02:08 AM
how can use libpcap to send packets,just like winpcap do? tassadaque Fedora 1 06-05-2008 11:43 AM
dropping and forwarding packets using libpcap escorp Linux - Networking 2 04-08-2006 08:18 PM
Building libpcap with pf_ring Machiaveli Linux - Software 1 12-15-2005 05:58 AM
Can't sniff packets using libpcap masterm Linux - Networking 0 05-17-2005 05:58 PM


All times are GMT -5. The time now is 08:02 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration