Danny,
please consider posting your messages about nprobe on the ntop-misc list.
1. what version of nProbe did you use? v3?
2. how did you start nprobe?
3. how did you replay the stream with tcpreplay?
Cheers, Luca
Danny Muizebelt wrote:
>Hi,
>
>I hope nprobe is also discussed here because I have a problem with it.
>
>I'm testing nprobe for complete traffic statistics for a cable provider.
>Currently we have about 1Gbit/s of traffic to scan but will be divided
>over 4 nprobe servers in it's final implementation.
>
>Anyway, with initial iperf tests and nprobe everything seemed okay but
>with the first tests on live traffic the nprobe process was allocating
>memory like a madman. About 1MB per second. After there wasn't any
>memory left, the server crashed. (The server had 2500MB of memory)
>Initially I blamed weird dual Xeon Compaq setup and/or/even RedHat but
>back in our Office I set up a new nprobe server (dual Pentium Pro-200
>with 64MB of memory) based on Slackware 9.1 and captured on the live
>nprobe server a pcap stream of 91MB (1.000.000 packets) and copied it to
>the new machine.
>
>Replaying the captured stream with tcpreplay I saw the nprobe memory
>footprint rise to 21MB. This means the memory increase was cause by the
>amount of different flows. (I'm talking here about 1500 exported flows
>per second)
>Playing the stream again DIDN'T increase the allocated nprobe memory
>size. I would figure nprobe keeps memory allocated for each unique flow
>even if the flow has already expired.
>
>Is this the normal behaviour of nprobe or do I have a situation which
>hasn't tested before?
>
>Any help would be welcome.
>
>Thanks,
>
>Danny
>_______________________________________________
>Ntop-dev mailing list
>Ntop-dev@unipi.it
>http://listgateway.unipi.it/mailman/listinfo/ntop-dev
>
>
--
Luca Deri <deri@ntop.org> http://luca.ntop.org/
Hacker: someone who loves to program and enjoys being
clever about it - Richard Stallman
please consider posting your messages about nprobe on the ntop-misc list.
1. what version of nProbe did you use? v3?
2. how did you start nprobe?
3. how did you replay the stream with tcpreplay?
Cheers, Luca
Danny Muizebelt wrote:
>Hi,
>
>I hope nprobe is also discussed here because I have a problem with it.
>
>I'm testing nprobe for complete traffic statistics for a cable provider.
>Currently we have about 1Gbit/s of traffic to scan but will be divided
>over 4 nprobe servers in it's final implementation.
>
>Anyway, with initial iperf tests and nprobe everything seemed okay but
>with the first tests on live traffic the nprobe process was allocating
>memory like a madman. About 1MB per second. After there wasn't any
>memory left, the server crashed. (The server had 2500MB of memory)
>Initially I blamed weird dual Xeon Compaq setup and/or/even RedHat but
>back in our Office I set up a new nprobe server (dual Pentium Pro-200
>with 64MB of memory) based on Slackware 9.1 and captured on the live
>nprobe server a pcap stream of 91MB (1.000.000 packets) and copied it to
>the new machine.
>
>Replaying the captured stream with tcpreplay I saw the nprobe memory
>footprint rise to 21MB. This means the memory increase was cause by the
>amount of different flows. (I'm talking here about 1500 exported flows
>per second)
>Playing the stream again DIDN'T increase the allocated nprobe memory
>size. I would figure nprobe keeps memory allocated for each unique flow
>even if the flow has already expired.
>
>Is this the normal behaviour of nprobe or do I have a situation which
>hasn't tested before?
>
>Any help would be welcome.
>
>Thanks,
>
>Danny
>_______________________________________________
>Ntop-dev mailing list
>Ntop-dev@unipi.it
>http://listgateway.unipi.it/mailman/listinfo/ntop-dev
>
>
--
Luca Deri <deri@ntop.org> http://luca.ntop.org/
Hacker: someone who loves to program and enjoys being
clever about it - Richard Stallman