Looking at the source, it appears that sessions.c maintains the session data on tcp sessions. How does ntop tell what protocol the connection is? Does it just look at dest port and say that it is a certain type of connection?
What path does the data take from the time is gets picked up from libpcap to session data being recorded? brian -- Brian Lavender http://www.brie.com/brian/ "There are two ways of constructing a software design. One way is to make it so simple that there are obviously no deficiencies. And the other way is to make it so complicated that there are no obvious deficiencies." Professor C. A. R. Hoare The 1980 Turing award lecture _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
