Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just installed ntop 1.4.4 and when I start it, it give me infinite warnings "packet truncated":

RRD_DEBUG:     umask 0066
RRD_DEBUG:     DirPerms 0700
THREADMGMT: RRD: Started thread (t2992630672) for data collection
THREADMGMT[t2992630672]: RRD: Data collection thread starting [p30923]
INIT: Created pid file (/var/run/
Now running as requested user 'nobody' (99:99)
Note: Reporting device initally set to 0 [eth0] (merged)
THREADMGMT[t3086329552]: ntop RUNSTATE: RUN(4)
THREADMGMT[t2982140816]: NPS(1): Started thread for network packet sniffing [eth0]
THREADMGMT[t2982140816]: NPS(eth0): pcapDispatch thread starting [p30923]
THREADMGMT[t2982140816]: NPS(eth0): pcapDispatch thread running [p30923]
THREADMGMT[t3047009168]: SIH: Idle host scan thread running [p30923]
THREADMGMT[t3057499024]: SFP: Fingerprint scan thread running [p30923]
**WARNING** packet truncated (8814->8232)
**WARNING** packet truncated (10274->8232)
**WARNING** packet truncated (8814->8232)
**WARNING** packet truncated (8814->8232)

Do I need to configure something?

I tried to access the web interface (http://localhost:3000) but it does not work.

Note: I'm on CentOS.


Not sure if it helps but there is my "ifconfig":

Link encap:Ethernet  HWaddr 00:16:76:BC:7E:77  
inet addr:  Bcast:  Mask:
inet6 addr: fe80::216:76ff:febc:7e77/64 Scope:Link
RX packets:15496640 errors:0 dropped:0 overruns:0 frame:0
TX packets:19256813 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000 
RX bytes:836230629 (797.4 MiB)  TX bytes:608496148 (580.3 MiB)
share|improve this question
Can you provide the ifconfig output for eth0? – chuckx Aug 25 '10 at 20:57
I'm not sure if it is what you want, but I will edit my question and add the "ifconfig". – FR6 Aug 25 '10 at 21:30
Is libpcap >= 0.8.? – Grizly Aug 26 '10 at 6:32
@Grizly I seem to have libcap 0.9.4. – FR6 Aug 26 '10 at 13:14
I got nothing, it seems the searches I did only found older versions with that error which were apparently "Fixed in the CVS".. – Grizly Aug 26 '10 at 23:48

You are receiving these warnings because it was larger than the MTU of the outgoing network interface. It isn't really a big deal, just filter those error messages if it is a big problem.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.