It's simple and you just need to think about what ntop sees Packets... flowing over wires...
Packets have a source address & port and a destination address & port... How does Apache handle virtual hosts? It analyzes the flow at the application level (layer 4) not the wire/packet/protocol (layers 1, 2 and 3). It does this by re-assembling packets into a layer 4 message (e.g. GET http://virtual.host.name.com/page.html)... So, the basic answer is NO, ntop can't do that. It's a NETWORK analyzer, not an application level one. Which is not to say you couldn't create a plugin that did the layer 4 analysis... Or, you could patch Apache to feed the data back to ntop through NetFlow or sFlow using some sort of pseudo addresses. -----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Matthew Boeckman Sent: Friday, May 17, 2002 9:24 AM To: [EMAIL PROTECTED] Subject: [Ntop] name virtual hosts question Hello List. sorry if this has already been answered before, but I didn't see it in the FAQ, the manual/overview/manpage, and can't find the maillist archives! My question is: we have a typical namebased virtual hosts apache setup, dozens of sites listening on one IP. How can I use ntop to breakout or list traffic to those named hosts as opposed to just the IP? In other words, I'd like to see either what percentage of traffic is going to x.something.com and what percentage is going to y.something.com, etc. I'm sure it's something simple I'm just not seeing... all the same any help is appreciated. -- Matthew Boeckman (816) 777-2160 Manager - Systems Integration Saepio Technologies == == ...Many say that DOS is the dark side, but actually UNIX is more like the dark side: It's less likely to find the one way to destroy your incredibly powerful machine, and more likely to make upper management choke. -Lore Sjoberg _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
