Mailing List Archive

I've installed and implemented the PF_RING code using the 2.4x kernel
compiled by Luca and released on sourceforge, recompiled libpcap, ntop is
working as advertised, mostly. Ring is working, as far as I can tell from
the status messages. I just need to get it to quit segfaulting. I have
successively disabled more and more features to relieve load and capture the
most packets with the least overhead. Am still getting about 99% CPU usage
in most cases.

The machine never gets around to start using swap before it segfaults, so it
is hard to tell if it's getting just too much to keep track of in memory and
it pukes when it starts trying to keep up on disk, but I'm new at this.

Anyway, I'm trying to figure out whether I'm just getting too much traffic
thrown at me, or just need more (or better) memory, CPU, disk...?

I've been testing with both the NTOP 3.0 release code as well as CVS, and
have been getting the same results. I've not tried compiling my own kernels
with RING as of yet, have folks had any better results with custom compiles?

I'm running a current SuSE 9.0, 512M of memory, P-4 1.3Ghz, 100MB traffic
directed to
NTOP via mirrored/spanned ports to a 3Com905C. Ntop segfaults after about
5-10 minutes.

Thanks, in advance, for any suggestions.


My options:

/usr/local/bin/ntop -i eth0 -g -o --no-fc -K -j -q --disable-schedyield -b
-a /usr/local/share/ntop/access_log --skip-version-check -t 5 -D oclc.org -u
ntop -P /usr/local/share/ntop/ -m our_class_b,192.168.0.0/16,10.0.0.0/8

Here is the last message from NTOP:

Wed Mar 31 10:11:27 2004 CMPFCTN_DEBUG: setResolvedName(0x454760e8) 0 ->
19 our.numeric.address - hash.c(1169)
Wed Mar 31 10:11:27 2004 CMPFCTN_DEBUG: setResolvedName(0x45478600) 0 ->
19 our.numeric.address - hash.c(1169)
Wed Mar 31 10:11:27 2004 CMPFCTN_DEBUG: setResolvedName(0x4547abb8) 0 ->
19 our.numeric.address - hash.c(1169)

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 49156 (LWP 5966)]
0x4127a1f9 in free () from /lib/i686/libc.so.6

And my gdb trace of the event:

(gdb) list
918 int ntop_main(int argc, char *argv[]) {
919 #else
920 int main(int argc, char *argv[]) {
921 #endif
922 int i, rc, userSpecified;
923 #ifndef WIN32
924 int effective_argc;
925 char **effective_argv;
926 #endif
927 char ifStr[196] = {0};




(gdb) info stack
#0 0x4127a1f9 in free () from /lib/i686/libc.so.6
#1 0x400e6f79 in ntop_safefree (ptr=0x2, file=0x4011a308 "hash.c",
line=422) at leaks.c:612
#2 0x400dfacf in freeHostInfo (host=0x453ced60, actualDeviceId=0) at
hash.c:422
#3 0x400e0425 in purgeIdleHosts (actDevice=0) at hash.c:774
#4 0x400e8305 in scanIdleLoop (notUsed=0x0) at ntop.c:630
#5 0x41160f60 in pthread_start_thread () from /lib/i686/libpthread.so.0
#6 0x411610fe in pthread_start_thread_event () from
/lib/i686/libpthread.so.0
#7 0x412e2327 in clone () from /lib/i686/libc.so.6



(gdb) bt full
#0 0x4127a1f9 in free () from /lib/i686/libc.so.6
No symbol table info available.
#1 0x400e6f79 in ntop_safefree (ptr=0x2, file=0x4011a308 "hash.c",
line=422) at leaks.c:612
No locals.
#2 0x400dfacf in freeHostInfo (host=0x453ced60, actualDeviceId=0) at
hash.c:422
i = 720
#3 0x400e0425 in purgeIdleHosts (actDevice=0) at hash.c:774
idx = 23
numFreedBuckets = 23
numHosts = 102
startTime = 1080745887
noSessionPurgeTime = 1080745287
withSessionPurgeTime = 1080744087
lastPurgeTime = {1080745887, 0 <repeats 31 times>}
firstRun = 0 '\0'
theFlaggedHosts = (HostTraffic **) 0x8475270
maxHosts = 103
scannedHosts = 104
hiresTimeStart = {tv_sec = 1080745887, tv_usec = 704139}
hiresTimeEnd = {tv_sec = 60, tv_usec = 282720}
el = (HostTraffic *) 0x0
prev = (HostTraffic *) 0x0
next = (HostTraffic *) 0x0
#4 0x400e8305 in scanIdleLoop (notUsed=0x0) at ntop.c:630
i = 0
#5 0x41160f60 in pthread_start_thread () from /lib/i686/libpthread.so.0
No symbol table info available.
#6 0x411610fe in pthread_start_thread_event () from
/lib/i686/libpthread.so.0
No symbol table info available.
#7 0x412e2327 in clone () from /lib/i686/libc.so.6
No symbol table info available.