Hmmm... I would say sticky hosts is not working correctly. I've tried it a few times, and it works well, but I was using a different version and on *nix.
Beware of this option. When it works "correctly" hosts never go away. If you're monitoring traffic to/from the internet, you'll eventually need to restart ntop to get rid of the 250K hosts that have accumulated! Even just with "local" hosts I've seen scans of various sorts generate ARPs which are then hosts in ntop. Suddenly I had 64K hosts on my 3K host network. A "better" option *may* be to set the host idle_purge time to something like 36 - 48 hours? At least that way idle hosts will eventually go away and you'll still get your 24 hr info. Changing this setting however requires a source tweak and recompile, can you do that in your environment? If so, check out the various options in "globals-defines.h". Amongst other things will be the idle purge settings. G -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Wojtek Mitus Sent: Wednesday, April 14, 2010 11:47 AM To: [email protected] Subject: [Ntop] Problem with sticky hosts (?) Hello, I'm using commercial ntop for windows (3.3.11.1), and I have the following problem: I want to collect "top 100 remote hosts" summary report on a daily basis. I've set "Sticky Hosts (-c)" to "Yes" in the startup options of ntop, and i've restarted ntop process. My problem is that remote hosts are not persistent on the IP->Summary->Traffic report regardless of sticky setting. They dissapear almost at once after the tcp session seems to be closed. It seems like IP->Summary->Traffic shows me the "current active ip traffic," instead of accumulating the data over time. What else i should do to make ntop accumulate tcp-ip traffic data over time? thanks, WM _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
