The short answer is "The default is the default for no better reason that it
meets Luca's needs. For your site, create a customized file, use the -p
command line parameter and live happily ever after".
Long answer:
Here is what the ntop default list is at present (It's not perfect, but it
has served a lot of people well):
void addDefaultProtocols(void) {
handleProtocolList("FTP", "ftp|ftp-data|");
handleProtocolList("HTTP", "http|www|https|3128|"); /* 3128 is HTTP
cache */
handleProtocolList("DNS", "name|domain|");
handleProtocolList("Telnet", "telnet|login|");
handleProtocolList("NBios-IP", "netbios-ns|netbios-dgm|netbios-ssn|");
handleProtocolList("Mail", "pop-2|pop-3|pop3|kpop|smtp|imap|imap2|");
handleProtocolList("DHCP/BOOTP", "67-68|");
handleProtocolList("SNMP", "snmp|snmp-trap|");
handleProtocolList("NNTP", "nntp|");
handleProtocolList("NFS", "mount|pcnfs|bwnfs|nfsd|nfsd-status|");
handleProtocolList("X11", "6000-6010|");
/* 22 == ssh (just to make sure the port is defined) */
handleProtocolList("SSH", "22|");
/* Peer-to-Peer Protocols */
handleProtocolList("Gnutella", "6346|6347|6348|");
handleProtocolList("Morpheus", "1214|");
handleProtocolList("WinMX", "6699|7730|");
handleProtocolList("Audiogalaxy", "41000-41900|");
/* handleProtocolList("Napster", "8888|8875|"); */
}
The truth is that ANY list is highly customized to a location and your list
serves you, but that's about it. Personally? I added 5190 for AOL IM and
tftp because I worry about forgetting to turn it off after the occasional
update to an access point's firmware. And I don'r run P2P stuff nor NFS.
So I have my own personal file...
! tFTP=tftp
AOL IM=5190
DHCP/BOOTP=bootps|bootpc
DNS=domain
File Transfer=ftp|ftp-data
Mail (POP/IMAP)=pop2|pop3|pop3s|imap|imap3|imaps
Mail (SMTP)=25
NetBIOS=netbios|netbios-dgm|netbios-ssn
News (nntp)=nntp
PPTP=1723
SMB=microsoft-ds
SNMP=snmp|snmptrap
Secure Shell (sftp)=sftp
Secure Shell (ssh)=ssh
Time (ntp)=ntp
WINS replication=42
Web (NTop)=3000
Web (Squid cache)=3128
Web=http|https
Let's see... From a "fit's everyone" perspective, what's wrong with your
list (or ANY personalized list?)? Some OS and/or Linux distributions
versions of /etc/services are very cut down or highly customized. So many
of the names might not work across the ntop user base...
Port assignments are listed at http://www.iana.org/assignments/port-numbers,
albeit widely ignored, overloaded, etc. If you check out the #s you've
used, you will find that:
* some are assigned for purposes other than you've grouped them (which
often means that YOU have software running on YOUR site where a vendor
picked a port and uses it without bothering to get a well-known number
assigned, often because the actual assignee isn't widely deployed)
* there are missing, albeit similar assigned ports (e.g. why mySQL and not
postgres, MS SQl, IBM DB2, Sybase, Oracle and Informix grouped into an "SQL"
category? Because you use and care about mySQL, not the others)...
When I first started working with ntop, -p was a pain. The nice thing about
the way that (I finally tuned ntop to work) is that if you do give it a
file, it can have multiple lines and comments, and if there is anything in
it, the default list steps completely aside...
I think you will find creating a customized file, and distributing it across
your site is the best answer, especially when the next "great" P2P network
pops up...
-----Burton
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of
Rainer Schoenen
Sent: Saturday, June 15, 2002 6:02 AM
To: [EMAIL PROTECTED]
Subject: [Ntop] Default protocol list
Hello,
I would just like to propose the following changes for the "Default protocol
list":
FTP=ftp|ftp-data|3121,
HTTP=http|www|https|3128|8000|8080|8088|3000-3001,
Mail=pop-2|pop-3|pop3|pop3s|kpop|smtp|imap|imap2|imaps,
Print=515,
MYSQL=3306,
LDAP=389|636,
eDonkey=4662-4663,
Yours,
Rainer Schoenen
_______________________________________________
Ntop mailing list
[EMAIL PROTECTED]
http://lists.ntop.org/mailman/listinfo/ntop
_______________________________________________
Ntop mailing list
[EMAIL PROTECTED]
http://lists.ntop.org/mailman/listinfo/ntop
