|
Hi, I was able to track down why netflow users always have the problem that nearly all remote hosts are detected as local: Adress dection works - but after lookup in plugins/netflowPlugin.c: /* All hosts with a netmask are assumed to be (pseudo)local */ if((srcHost->network_mask == 0) && record->src_mask) { srcHost->network_mask = record->src_mask; FD_SET(FLAG_SUBNET_PSEUDO_LOCALHOST, &srcHost->flags); updateHostKnownSubnet(srcHost); } if((dstHost->network_mask == 0) && record->dst_mask) { dstHost->network_mask = record->dst_mask; FD_SET(FLAG_SUBNET_PSEUDO_LOCALHOST, &dstHost->flags); updateHostKnownSubnet(dstHost); } All already remote adresses are retagged to local! (And I have no idea why this should be done?) Just uncomment this part and recompile - and remote is remote. --
Mit freundlichen
Grüßen, With best
regards, Ingo Flaschberger Geschäftsleitung ---
Besondere
Ansprüche. Individuelle Lösungen. crossip communications gmbh A-1020 Wien, Wohlmutstrasse 27 Sitz
der Gesellschaft: 1020 Wien, Österreich Firmenbuchgericht:
Handelsgericht Wien, FN 269698 s,
Umsatzsteueridentifikationsnummer (UID): ATU62080367 Haftungsausschluss
/ Disclaimer:
http://www.crossip.net/de/legal/haftungsausschluss-disclaimer |
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
