Hi, all
>> This may be a na�ve question, but is there any way to get or restrict >> information for local hosts (i.e. those specified with the -m switch) >> only? For example, we have around 70 machines to monitor, mainly web >> servers, and my main priority is to measure the amount of >> traffic/bandwidth each of these machines is consuming. Information >> relating to which hosts these machines are talking to is far less >> important. I still need to monitor all the traffic sent and received by >> those machines, but I don't need to be able to analyse the same for >> non-local machines. You mean you want to see only the amount of traffic/bandwidth each of machines, not traffic matrix, session...etc? You can do it by slight modification on processIpPkt in pbuf.c. But i think it won't help much, 'cuz ntop wastes time with hash handling. I think you'd better set good filter before calling pcap_compile. I've tested pcap filtering performance, and belived that is well optimized. It can handle a hundred of hosts. ntop receives exact same argv like tcpdump. Try start ntop with following... %ntop hosts myhost1 and myhost2 and myhosts3 .... and myhosts70? if this is somewhat annoying, fix the parseTrafficFilter in Intiailize.c. Hope this can help you, Thanks, Zaharang ----------------------------------------------------------------------------------------------------------- SeungMin Lee (Zaharang) Iworld Networking, Inc. Phone: +82-2-3440-6661 e-mail: [EMAIL PROTECTED] _______________________________________________ Ntop-dev mailing list [EMAIL PROTECTED] http://listmanager.unipi.it/mailman/listinfo/ntop-dev
