Help answer threads with 0 replies.
Go Back > Forums > Linux Forums > Linux - Networking
User Name
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.


  Search this Thread
Old 03-05-2009, 08:45 PM   #1
LQ Newbie
Registered: Jul 2005
Location: boston, ma
Distribution: CentOS 5.2
Posts: 1

Rep: Reputation: 0
Question ntop v.3.3.10 packets dropped by pf_ring enabled libpcap

I'm having an issue where Ntop shows majority of packets dropped by libpcap.
This is odd cause I've recompiled a kernel to include PF_RING pathes, as well as pcap library and fresh ntop v.3.3.10 from SVN. Ntop have been also compiled with -lpfring -lpthread (amongst other flags), removing -lpcap is not an option (otherwise it won't "make" it).

Kernel module is inserted and while ntop is running I see that a new PF_RING interface is being created (and used as it shown in /proc/net/pf_ring and via "lsmod | grep ring").

I start ntop as follows:
ntop -x 4294967296 -g -i eth5 -4 -o -d

This is a ldd output for ntop..
[root@locahost ~]# ldd /usr/local/bin/ntop => (0xb7f38000) => /usr/local/lib/ (0xb7e64000) => /usr/local/lib/ (0xb784b000) => /usr/local/lib/ (0xb781b000) => /lib/ (0x00637000) => /lib/ (0x0022b000) => /usr/lib/ (0x00c18000) => /usr/lib/ (0x00bbb000) => /usr/lib/ (0x00b8d000) => /usr/local/lib/ (0xb780f000) => /usr/lib/perl5/5.8.8/i386-linux-thread-multi/CORE/ (0xb76dd000) => /lib/ (0x00dd1000) => /lib/ (0x00ba2000) => /lib/ (0x00ad8000) => /lib/ (0x00ade000) => /lib/ (0x00c9c000) => /lib/ (0x04257000) => /lib/ (0x00b07000) => /lib/ (0x00993000) => /usr/lib/ (0x00427000) => /usr/lib/ (0x0036a000) => /lib/ (0x00dcc000) => /usr/lib/ (0x003ff000) => /usr/lib/ (0x00596000) => /usr/lib/ (0x0085f000) => /usr/lib/ (0x049dc000)
/lib/ (0x00975000) => /usr/lib/ (0x00457000) => /lib/ (0x00dc7000) => /lib/ (0x00b20000) => /lib/ (0x00b3a000)
Can't quite figure this out after being at it for 10 hours..
Any input is appreciated.

All builds were successful, so it's not like I've been ignoring errors left and right

running latest and greatest CentOS 5.2

when running included pfcount binary on the same interface packets dropped is nearly 0
[root@localhost ntop_svn]# cat /proc/net/pf_ring/*eth5*
### ntop ###
Bound Device : eth5
Version : 9
Sampling Rate : 1
IP Defragment : No
BPF Filtering : Disabled
# Filt. Rules : 0
Cluster Id : 0
Channel Id : -1
Tot Slots : 4096
Bucket Len : 8232
Slot Len : 8302 [bucket+header]
Tot Memory : 34009088
Tot Packets : 113347473
Tot Pkt Lost : 111643664
Tot Insert : 1703809
Tot Read : 1699713

### pfcount ###
Num Free Slots: 0
Bound Device : eth5
Version : 9
Sampling Rate : 1
IP Defragment : No
BPF Filtering : Disabled
# Filt. Rules : 0
Cluster Id : 0
Channel Id : -1
Tot Slots : 4115
Bucket Len : 128
Slot Len : 198 [bucket+header]
Tot Memory : 815104
Tot Packets : 4859623
Tot Pkt Lost : 12
Tot Insert : 4859611
Tot Read : 4859606
Num Free Slots: 4110
I do see some differences in Slot and Bucket length, but ntop doesn't seem to allow specifying these

Last edited by anastas; 03-06-2009 at 11:20 AM. Reason: additional info / corrections


centos, centos5, centos52, dropping, ntop, packets

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
libpcap error while compiling ntop from source noir911 Linux - Server 1 07-24-2008 03:08 AM
how can use libpcap to send packets,just like winpcap do? tassadaque Fedora 1 06-05-2008 12:43 PM
dropping and forwarding packets using libpcap escorp Linux - Networking 2 04-08-2006 09:18 PM
Building libpcap with pf_ring Machiaveli Linux - Software 1 12-15-2005 06:58 AM
Can't sniff packets using libpcap masterm Linux - Networking 0 05-17-2005 06:58 PM > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 12:43 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration