Sweet - I like easy (one reply) fixes! -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Eric Rogers Sent: Thursday, March 11, 2010 3:28 PM To: [email protected] Subject: Re: [Ntop] WAN traffic reporting/collecting problem...
Yes, this was the fix, I had in fact made the change to not trust MAC addresses, but didn't restart the PC. Once I restarted the PC I was seeing the results. Thanks for the help! -Eric >>> [email protected] 3/11/2010 2:37:37 PM >>> Check out "-o", I think... It's in the man / doc, about not trusting the MAC address. G -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Eric Rogers Sent: Thursday, March 11, 2010 2:35 PM To: [email protected] Subject: [Ntop] WAN traffic reporting/collecting problem... Hello list! I am running the ntop v.3.4-pre3 (32 bit) [WinNT/2K/XP/Vista/Win7] version, and the associated included LIBs/. My problem: All the hosts on the far side of my MPLS WAN are displayed as a single host in ntop. The remote WAN subnet: 10.60.20.0/22 The local subnet: 10.60.4.0/22 All the local traffic is correct and shows all hosts. But in the list for WAN range I see a single IP: 10.60.22.15 and the statistics seem to a collective value for all traffic on the WAN subnet. I think this maybe due the fact that all the traffic from the Cisco WAN router is being tagged with the same MAC address? I have all ready turned off the "trust MAC" option in the configuration of Ntop. There is also a barracuda webfilter in the mix, and I will now crudely show my devices and how they interconnect. LAN: ISP -> Cisco Router -> Cisco PIX 515 -> Barracuda Webfilter -> HP Procurve gig switch -> mirrored webfilter port -> Ntop collector WAN: Cisco Router -> HP Procurve gig switch I am trying to find some problem hosts, and I think they are on the WAN side, so currently I can't solve the problem at hand. I can upload configs or the like if it will help in finding the solution. Thanks for any help you can provide! -Eric _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font> _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font> _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
