Dear Ntop People
Thanks for the project
I have a pair of questions which might be a bugreport but I am not sure
;-)
QUESTION #1:
amd64:
internal interface is bond0 (bonded eth0,eth1) and has MTU size set to
9000. external interface eth2 has standard mtu of 1500. Also there is
secondary interface on eth2:
bond0 UP BROADCAST RUNNING MASTER MULTICAST MTU:9000 Metric:1
eth0 UP BROADCAST RUNNING SLAVE MULTICAST MTU:9000 Metric:1
eth1 UP BROADCAST RUNNING SLAVE MULTICAST MTU:9000 Metric:1
eth2 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
eth2:1 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
lo UP LOOPBACK RUNNING MTU:16436 Metric:1
ntop thinks
Name Device Type Speed Sampling Rate MTU Header Address IPv6
Addresses
eth2 eth2 Ethernet 0 1514 14 XXX.XXX.XXX.XXX
::/0
eth2:1 eth2:1 No link-layer encapsulation virtual 0 8232
4 192.168.22.16
bond0 bond0 Ethernet 0 1514 14 10.0.0.1
::/0
cmdline
/usr/sbin/ntop -d -L -u ntop -P /var/lib/ntop --skip-version-check -a
/var/log/ntop/access.log -i eth2,bond0,lo -p /etc/ntop/protocol.list -O
/var/log/ntop -w 0 -W 3011 --trace-level 1
ia64:
Similar story is on the other box (ia64 arch), where interface is not bonded
but has
MTU 9000, ntop reports 1514 for it and 8232 for virtual external interface and
lo
eth0 UP BROADCAST RUNNING MULTICAST MTU:9000 Metric:1
eth1 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
eth1:1 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
lo UP LOOPBACK RUNNING MTU:16436 Metric:1
ntop:
Name Device Type Speed Sampling Rate MTU Header Address IPv6
Addresses
eth1 eth1 Ethernet 0 1514 14 XXX.XXX.XXX.XXX
::/0
eth1:1 eth1:1 No link-layer encapsulation virtual 0 8232
4 192.168.22.18
eth0 eth0 Ethernet 0 1514 14 10.0.0.111
::/0
/usr/sbin/ntop -d -L -u ntop -P /var/lib/ntop --skip-version-check -a
/var/log/ntop/access.log -i eth1,eth0,lo -p /etc/ntop/protocol.list -O
/var/log/ntop -w 0 -W 3011 -w 0 -W 3011 --trace-level 1
Am I missing something or ntop simply got confused?
I am running Debian etch on both of them, and version is
3:3.2-8 (so it is upstream version 3.2)
QUESTION #2:
Also I got a flood of warnings in syslog stating
ntop[24624]: **WARNING** packet truncated (9014->8232)
for different original packet sizes. I had to lower --trace-level to 1. I guess
I can find the source service for those messages somewhere in ntop reports,
don't I? :-) I wish there was a way just to elect to don't display this
specific warning message.
Thanks very much in advance
--
Yaroslav Halchenko
Research Assistant, Psychology Department, Rutgers-Newark
Student Ph.D. @ CS Dept. NJIT
Office: (973) 353-5440x263 | FWD: 82823 | Fax: (973) 353-1171
101 Warren Str, Smith Hall, Rm 4-105, Newark NJ 07102
WWW: http://www.linkedin.com/in/yarik
_______________________________________________
Ntop-dev mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-dev
