On Fri, Feb 15, 2002 at 06:33:11PM -0600, Burton M. Strauss III wrote: > Yes it is - and if you read the message traffic, you would have seen the > same report. But without the info, I would waste a lot of MY time on > irrelevant issues. > > The key is the traffic mirroring. > > You need to use a more recent version and use the '--border-sniffer-mode' or > '-j' option. This was added post 2.0 release to handle the special case of > mirroring traffic on a switch (basically if you turn on mirroring, the > traffic is the same at the TCP/IP level, but not at the Ethernet level - so > the parameter stops ntop from using the mac addresses). > > There is also a traffic classification patch in the later releases, but > that's for UDP. It won't help TCP. ntop does not do connection tracking > like iproute2/netfilter does... It shouldn't be non-ip, but it may not be > tagged as the ftp protocol. However, there are also a lot of post-2.0 > changes in that area, and let's see what happens when you use the more > recent code.
Thanks a lot for the useful tips. Now, I compiled the CVS version, and IP traffic reporting is correct now, without -j flag. If I do use -j, the data is not being collected at all. I noticed a couple of other things. When I start ntop, it spawn 10 children right away, and then an additional child for every web connection. On a machine with 32MB of RAM, it renders a disaster. How can I prevent 10 children? The only thing I can think of is using --disable-mt during configure. I believe when I was running 2.0-stable, I had only 1 ntop process running. Also, when I sort by data in Data Sent, it doesn't get sorted properly. On contrary, in Data Rcvd everything is fine. I compiled with gdchart support, however it only displays chart when I'm using http connection. Through https connection, it displays an empty image instead. Is it a known issue? Does URL for mapper.pl script need to be absolute, or relative to html directory? Thanks Igor _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listmanager.unipi.it/mailman/listinfo/ntop
