Generated by ntop v.2.0.0 MT [i686-pc-linux-gnu] (10/30/01 10:10:24 AM build) listening on [eth0]
All that I can say is that this version is known to have issues with traffic classification and also a security problem. I would recommend you download one of the recent builds - I'm presently recommending 12Apr2002 - from http://snapshot.ntop.org (13 and 14 Apr are the same as 12). I'd stay away from 15/16 Apr. Run it for a couple of days/hours and check the values... let us know if it solves the problem! That said, I see what you're talking about - if 12.4.195.5's 624.8 MB is 2.9% of the received total, then you should be seeing ~ 21.5GB of received data. However, you haven't shown the "Global Traffic Statistics" page - which has traffic totals - so I can't be sure... Note that you have been running a while - [6 day(s) 13:59:12], and is it possible that hosts have dropped off the active dataset? Check the log for messages: Apr 17 15:20:07 tigger ntop[25031]: Purging completed in 0 sec [16 hosts deleted] Apr 17 15:25:11 tigger ntop[25031]: Purging completed in 0 sec [11 hosts deleted] Apr 17 15:30:15 tigger ntop[25031]: Purging completed in 0 sec [3 hosts deleted] Apr 17 15:35:19 tigger ntop[25031]: Purging completed in 0 sec [1 hosts deleted] Apr 17 15:40:23 tigger ntop[25031]: Purging completed in 0 sec [3 hosts deleted] Apr 17 15:45:27 tigger ntop[25031]: Purging completed in 0 sec [1 hosts deleted] (Although, IIRC, that's from the new version) -----Burton -----Original Message----- From: Toyin Bakare - McLean [mailto:[EMAIL PROTECTED]] Sent: Wednesday, April 17, 2002 1:02 PM To: '[EMAIL PROTECTED]' Cc: Davinder Singh - McLean Subject: RE: [Ntop] Stat in NTOP Hi, Your explanation is logical and it does make sense, but the problem with my stat is that the summation of the percent column for data sent and data received is nowhere near 100%, it actually came down to about 25% and i was not sure what happened to the remaining 75%. I have attached a report, could you please take a look at it. thanks toyin bakare spacenet, Inc -----Original Message----- From: Davinder Singh - McLean Sent: Wednesday, April 17, 2002 1:43 PM To: Toyin Bakare - McLean Subject: FW: [Ntop] Stat in NTOP Here are your answers. -----Original Message----- From: Burton M. Strauss III [mailto:[EMAIL PROTECTED]] Sent: Wednesday, April 17, 2002 13:20 To: Ntop Cc: Davinder Singh - McLean Subject: RE: [Ntop] Stat in NTOP Division IIRC it's not rounded, so a number of small flows can be hidden in the 'noise'... As with any fixed point calc it's possible for "values may not total 100% due to rounding" (or truncation in this case). Here's some #s from my ntop instance: Local IP Traffic Host IP Address Data Sent Data Rcvd 192.168.42.6 192.168.42.6 97.8 KB 71.5 % 39.1 KB 28.5 % piglet 192.168.42.1 7.2 KB 5.3 % 5.3 KB 3.9 % swallowtail 192.168.42.3 31.9 KB 23.3 % 92.4 KB 67.6 % Total Traffic Data Sent Data Rcvd Used Bandwidth 136.8 KB 136.8 KB 136.8 KB 59.0 Kbps The actual "total" is 136.9 KB and the sum of the %s is 100.1 Also remember, these are scaled figures - check the suffix for KB vs MB vs GB vs nothing (bytes) I had at once point a patch to scale all of these the same, but nobody was interested... -----Burton -----Original Message----- From: Davinder Singh - McLean [mailto:[EMAIL PROTECTED]] Sent: Wednesday, April 17, 2002 11:20 AM To: 'Burton M. Strauss III' Subject: RE: [Ntop] Stat in NTOP How is that % value calculated?? -----Original Message----- From: Burton M. Strauss III [mailto:[EMAIL PROTECTED]] Sent: Wednesday, April 17, 2002 12:11 To: [EMAIL PROTECTED] Cc: Davinder Singh - McLean Subject: RE: [Ntop] Stat in NTOP Because one value, "Report created on Wed Apr 17 10:51:55 2002 [4 day(s) 2:39:21]" ^^^^^^^^^^^^^^^^^ is for the current run of ntop While the second, The value reported for a specific host (e.g. "Info about host swallowtail") is taken from the HostsTraffic entry, which may - if you're using the -S (--store-mode) flag options - have information stored from a previous run of ntop. -----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Davinder Singh - McLean Sent: Wednesday, April 17, 2002 9:55 AM To: '[EMAIL PROTECTED]' Subject: [Ntop] Stat in NTOP The % in data received and sent does not match to 100%.There are some hosts that show the bytes but 0% in received percentage. Can someone tell me the way the percentage is calculated. The other thing is ntop at end of data received/sent says it has been up and running for 1 day but when we open a host , it indicates running for two days. _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listmanager.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listmanager.unipi.it/mailman/listinfo/ntop
