From owner-freebsd-questions Thu Feb 20 9: 8:28 2003 Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id AD3D437B401 for ; Thu, 20 Feb 2003 09:08:27 -0800 (PST) Received: from dan.emsphone.com (dan.emsphone.com [199.67.51.101]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0B93243F75 for ; Thu, 20 Feb 2003 09:08:27 -0800 (PST) (envelope-from dan@dan.emsphone.com) Received: (from dan@localhost) by dan.emsphone.com (8.12.6/8.12.6) id h1KH8QFE065897; Thu, 20 Feb 2003 11:08:26 -0600 (CST) (envelope-from dan) Date: Thu, 20 Feb 2003 11:08:26 -0600 From: Dan Nelson To: Will Saxon Cc: questions@FreeBSD.ORG Subject: Re: network tuning Message-ID: <20030220170826.GO13096@dan.emsphone.com> References: <0E972CEE334BFE4291CD07E056C76ED8DB2B69@bragi.housing.ufl.edu> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <0E972CEE334BFE4291CD07E056C76ED8DB2B69@bragi.housing.ufl.edu> X-OS: FreeBSD 5.0-CURRENT X-message-flag: Outlook Error User-Agent: Mutt/1.5.3i Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG In the last episode (Feb 20), Will Saxon said: > I am trying to use ntop in the 'border filter' mode to get some > statistics on that link, which is a gigE link typically seeing > 40-120Mbps sustained traffic (varies throughout the day). The > capturing interface is an intel pro/100+ server adapter, plugged into > another port on the switch set to mirror the gigE interface. > > Obviously there ought to be some drops due to serialization > differences, etc. But ntop is reporting upwards of 2/3 packets > dropped in the kernel and running tcpdump on that interface for any > length of time reports usually 50% drops in the kernel. You first need to determine what is being overloaded. Run top. Is ntop running at 100% cpu? If so, you'll need a faster machine. If it's close to 100%, bumping debug.bpf_bufsize might help. What are the user/system/irq CPU percentages while ntop is running? -- Dan Nelson dnelson@allantgroup.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message