http://s2.postimg.org/v0bz1mnwp/Screen_Shot_2015_10_25_at_9_50_34_AM.png
I’m seeing the same IP/device as 3 different nodes when I mirror multiple ports on my HP ProCurve 1810g. I have 3 VLANs enabled on my network 100,232,348. I have a single trunk/tagged port on the HP that goes to LAN port on box running Opensense. I also have 2 access/untagged ports for VLAN 348 and 1 for 232 on the switch, which I want to monitor to capture local traffic between clients & servers. If I only mirror the trunk I still see 2 nodes for 1 IP, 1 that shows up in 348 and one that shows up 232. VLAN 0 as in the screen is from enabling mirroring on the “local to switch" traffic, i.e traffic that does not touch the gateway. My goal is to just have a single IP per node. Does this have to do with my infrastructure or is there a switch in ntop I can apply to my startup that will only recognize a single IP per node? Thanks for any info
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
