Hi, With NtopNG relying on paywall'ed nprobe, I need to use the last stable version of ntop to get an overview of whats going on in my network. I mainly need it to identify bandwidth hogs and for the most part hang out in the "Top Talkers" area.
I used to have ntop setup on SPAN ports. Recently, I installed a Cisco 891 router and am exporting netflow from all my VLANs (I have about 5) with "ip flow ingress" and "ip flow egress" on each vlan. Ntop reads this data, but I realized the top talkers list is completely wrong and I can't explain its behavior. I've tried several renditions of ntop and even tried compiling it on the machine its running on (CentOS 32bit). It seems as though once a host reaches the top, it stays on the top talkers list and reports its top peak usage, as the current minute usage (if looking at top talkers by hour). So for instance, my public IP host will shoot to the top of the list doing ~2Mbit /sec. Despite KNOWING that the throughput is different (viewing stats on the Cisco or generating even more traffic), as the toptalkers list populates with future data/minutes - the host will stay there and report ~2Mbit /sec. I tried netflow v5, v9. Setting low timeouts, etc. I REALLY need this to work as I don't know of any other good open source solution for such a good birds eye view of the status of my live network. I managed a very limited pipe and need to be able to answer who is hogging my bandwidth. Appreciate any help. Daniel Dudkin IT Business/System Specialist // American Auto-Matrix One Technology Lane // Export, PA 15632 www.aamatrix.com<http://www.aamatrix.com/> * [email protected]<mailto:[email protected]> Ph #: 724-733-0381 [both] Confidential: This electronic message and all contents contained may be privileged, confidential or otherwise protected from disclosure. The information is intended to be for the addressee only. If you are not the addressee, any disclosure, copy, distribution or use of the contents of this message is prohibited. If you have received this electronic message in error, please notify me immediately by return email and destroy the original message and all copies.
<<inline: image001.png>>
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
