Ntop has been multithreaded for some time now. I run ntop on a VM and don't have admin access to the hypervisor, but I'm pretty sure there's nothing within ntop that would restrict ntop as a whole to a single core. That said, there may be a single thread doing a bulk of the work that may be bound to a single core.
-----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Adrian Rapa Sent: Friday, January 07, 2011 9:18 AM To: [email protected] Cc: Luca Deri; [email protected] Subject: Re: [Ntop] ntop +pf_ring hi, so it can use only one core? Cu respect, Adrian Rapa Millennium IT tel.: 0372-168.638 fax.: 021-569.79.99 e-mail: [email protected] web: www.mitnet.ro On 07.01.2011 15:02, Luca Deri wrote: > Adrian > ntop is CPU bound that means that even if you accelerate packet capture, ntop > performance will not increase much. Please use nprobe are preprocessor of > packets that are converted to flows and analyzed by ntop > > Regards Luca > > On Jan 1, 2011, at 6:48 PM, Adrian Rapa wrote: > >> hi, >> i am trying to do a ntop pfring setup. >> I compiled pf_ring, e1000e and libpcap drivers from svn. >> I compiled ntop with ./configure --with-rrd-home=/opt/rrdtool-1.4.5/ >> --with-pcap-root=/kit/pf_ring/PF_RING/userland/libpcap-1.0.0-ring/ >> LIBS="-lpcap -lpfring -lpthread" >> I have eth1 which is a port mirror with about 700Mb of trafic RX+tx. >> >> If i start ntop -i eth1 i have a lot of packet loss. If i use top, i see >> that a single cpu is used to capture packets. >> As i know pf_ring should increase the packet capture rate, but it is acting >> as normal linux pcap. >> >> is it normal for ntop to use a single cpu, or can i do somenthing to use all >> 8 CPU? >> >> >> -- >> Cu respect, >> Adrian Rapa >> Millennium IT >> >> tel.: 0372-168.638 >> fax.: 021-569.79.99 >> e-mail: [email protected] >> web: www.mitnet.ro >> >> >> _______________________________________________ >> Ntop mailing list >> [email protected] >> http://listgateway.unipi.it/mailman/listinfo/ntop > --- > > "Debugging is twice as hard as writing the code in the first place. > Therefore, if you write the code as cleverly as possible, you are, by > definition, not smart enough to debug it. - Brian W. Kernighan > > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop > <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font> _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
