# vnstat vs. ntop

## jconner

I have been using both vnstat and ntop to measure recieved traffic on a specific host (both are running on the host).

When viewing vnstat -h for a given hour, it reported that the machine had recieved 175MB of traffic.  I also ran ntop for the same time period; however, it said I had received only 10MB of traffic.

I'm not sure where to start looking to reconcile the difference.  Any thoughts would be much appreciated.

I run vnstat in cron (every 5 minutes) with the following command:

   vnstat -u

I run nstop by:

   ntop -w 4444 -W 0 -s

Thanks,

 - JC

----------

## d_m

Are they actually monitoring the same interfaces?

I haven't looked at the commands you're using, but, if one of them is monitoring *all* interfaces (including the loopback, lo0) and the other is just monitoring one (i.e. eth0) then that would easily explain the disparity.

Anyway, good luck.

EDIT: also, are you sure those commands are going to give you what you want. I know that certain commands will give you the amount of traffic seen say in the last X seconds. If you check that too often or too infrequently you'll be wrong.

----------

