Mailing List Archive: Questions on ntop performance and optimization

I'd like to try ntop on both 100Mbps and 1Gbps ethernet segments.

Q: It appears to me that ntop is a "poor mans RMONv2". Is this correct?
I'm interested in the header information only.

Q: What level of performance have people seen with ntop?

Q: What hardware and software features do I need to optimize ntop performance?

- Operating System (Linux 2.4, FreeBSD, OpenBSD, ... ) ?
- processor type (AMD/Intel/...) and speed? Or perhaps dual processors?
- more than 1 GB of RAM ?
- RAM-disk?
- stripped disks ?

At the moment I'm thinking to use Linux or FreeBSD or OpenBSD with a
1.3GHz Athlon or a 1.7GHz P4.

Q: Are there particular vendor NICs recommended for optimal ntop capture
with 100Mbps (FastEthernet)?

How about 1Gbps (GigE)?

Q: Would it be best to capture the traffic on one (or more) host and
then pass it to another box for analysis and web display?
(This layout would preclude realtime.)

Hi Mike,
thanks for your mail.

Mike wrote:
>
> I'd like to try ntop on both 100Mbps and 1Gbps ethernet segments.
>
> Q: It appears to me that ntop is a "poor mans RMONv2". Is this correct?
> I'm interested in the header information only.
It's not quite true. RMON doesn't report you detailed information as
ntop does. On the other hand ntop is not SNMP-manaageable.

> Q: What level of performance have people seen with ntop?
I run it on a 100Mbit network with no packet loss. Other users can
provide you different figures.

> Q: What hardware and software features do I need to optimize ntop performance?
>
> - Operating System (Linux 2.4, FreeBSD, OpenBSD, ... ) ?
> - processor type (AMD/Intel/...) and speed? Or perhaps dual processors?
> - more than 1 GB of RAM ?
> - RAM-disk?
> - stripped disks ?
My PC is Pentium III 550 with 128 Mb of RAM and Solaris/i386

> At the moment I'm thinking to use Linux or FreeBSD or OpenBSD with a
> 1.3GHz Athlon or a 1.7GHz P4.
>
> Q: Are there particular vendor NICs recommended for optimal ntop capture
> with 100Mbps (FastEthernet)?
I use a 3Com.

> How about 1Gbps (GigE)?
No clue. Some people repoted me that ntop won't be able to capture all
data when network speed is abve 200-300 Mbit

> Q: Would it be best to capture the traffic on one (or more) host and
> then pass it to another box for analysis and web display?
> (This layout would preclude realtime.)
This could be an option I have to evaluate this fall as I need to run
ntop on a Gigabit network.

Cheers, Luca

> _______________________________________________
> Ntop mailing list
> Ntop@unipi.it
> http://listmanager.unipi.it/mailman/listinfo/ntop

--
Luca Deri NETikos S.p.A.
Via Matteucci 34/B 56124 Pisa, Italy.
Ph. +39/050/968.639 Fax. +39/050/968.626
Personal: luca@lucaderi.org Business: luca.deri@netikos.com
WWW: http://www.lucaderi.org/ ICQ: 68183632
Software is about stuff, about getting hands dirty - Jim Coplien