Hi all, Lemme first say : I love NTOP, great work guys! *suckup*
I'm completely new to the list and I have done some searching through the history but I did not find answers to my questions. (well, perhaps some that are related) Feel free to flame me if I'm addressing things that are already know/reported. I run NTOP (2.0) on my internet router which is a modified RedHat in- stallation of Linux. I have a nice ADSL connection and I wanted to mo- nitor all different traffic to my machine. My internal network is connected to one ethernet interface (eth0) and the other one is connected to my ADSL modem (eth1). For the actual con- nection I use PPTP which creates a tunnel through the ADSL modem which encapsulates PPP. This PPP device is the device I want to monitor since this will contain all internet traffic. Monitoring the eth1 is pretty useless since only PPTP traffic goes though that, and I am not that concerned with my internal network (eth0) either (yet). When I run NTOP, the first odd thing is that marks my local gateway as 'High Risk' because it found more than one MAC address for the same IP. This could very well be, since the host has at least 2 inter- faces. But isn't it possible to 'tell' ntop to see these as one and mark it as 'multihomed' ? Also, how does NTOP react to tunneling in general, has anyone got experience with this ? I even tried to let NTOP monitor all interfaces so it could correlate, but is doesn't ;) Another strange thing is that is keeps logging multiple entries for my external IP address and also adds entries for my external IP address but then resolved to my external hostname. All with different traffic satistics. What is causing this ? I saw a previous posting which this problem but no reply. And last I would like to know if it is possible to make NTOP masquerade /NAT aware so it actually can show what NAT sessions are currently used since now all my internal traffic shows up as if it originated from my local gateway. I know this is not easy and I will look into this myself also, but if anyone else is already working on this, please lemme know. Well, that's it for now. Cheers, Martijn Schoemaker _______________________________________________ Ntop-dev mailing list [EMAIL PROTECTED] http://listmanager.unipi.it/mailman/listinfo/ntop-dev
