Hi Michael, Michael Weidel wrote: [..] > On my system (Dual-Pentium 3, Linux, ntop compiled with tcpwrapper), the > current snapshot (01-12-17) doesn't work as expected: > First of all, some bugs which appear with all accuracy levels: > ntop doesn't show the "Global TCP/UDP Protocol Distribution" in Stats - > Traffic (see attached file) It doesn't happen to me. How did you start ntop? I feel that ntop crashes before to render the page (see below)
> ntop doesn't use the "-m" command line switch as expected. If I define > my local net, which is connected through a router, via "-m <local net>" > only exactly one computer (I suppose the first ntop sees) appears in the > stats with all the traffic of the local net. Normally you want to see > all your local boxes. Please explain better and make an example. > Not always but most of the time, ntop only show a nearly empty html page > when clicking on "Data Sent - TCP/UDP" or "Data Rcvd - TCP/UDP". The > last html line is: > <TH ><A HREF=/sortDataSentIP.html?98>Domain</A></TH><TH COLSPAN=2><A > HREF=/sortDataSentIP.html?-0>Sent <IMG SRC=arrow_down.gif > BORDER=0></A></TH> It seems that there's a bug, ntop crashes and the rest of the page is not rendered.(see below) > ntop often crashes when I want to have a closer look at a host and look > at a html file <host IP addr.>.html, for example 1.0.0.0.html. Same as before. Please add "-K" to ntop, generate the core and send me a gdb log so that I can find the problem. > With accuracy level 0 ntop declares much traffic (half of the traffic) > as multicast, but it isn't multicast (see attached file). It doesn't show up here. Do you have a way to reproduce the problem (e.g. a pcap file I could use). > With accuracy level 1 ntop doesn't map the non-local hosts to the one > host 0.1.2.3, as expected, but it works as level 2 except protocol > handling. Please explain better and make an example. > My experiences show that the protocol handling is not the important > thing when ntop has to handle much traffic, the session handling and the > much computers are important. The protocol handling indeed doesn't take > much CPU time and provides a lot of information, the protocol handling > is in my opinion one of the most important features of ntop. I think it > would be better to let the protocol handling untouched and perhaps to > provide an accuracy level 3 without protocol handling, but I think this > isn't necessary. I agree but protocol handling takes time too that's why I have created 3 levels. > Did other mailinglist users make the same experience or have other > suggestions? > > CU, > > Michael > -- > Michael Weidel, University of Ulm > Computing Center Network Administration > EMAIL: [EMAIL PROTECTED] > WWW (PGP-KEY): http://www.weidel.org/ Please let me know about the ntop crashes. Cheers, Luca -- Luca Deri NETikos S.p.A. Via Matteucci 34/B 56124 Pisa, Italy. Ph. +39/050/968.639 Fax. +39/050/968.626 Personal: [EMAIL PROTECTED] Business: [EMAIL PROTECTED] WWW: http://www.lucaderi.org/ ICQ: 68183632 Hacker: someone who loves to program and enjoys being clever about it - Richard Stallman _______________________________________________ Ntop-dev mailing list [EMAIL PROTECTED] http://listmanager.unipi.it/mailman/listinfo/ntop-dev
