I have Ntop up and running, it has been running quite well for some time for me. However, I am running Ntop in sniffing mode off of a router, which strips the MAC addresses of hosts prior to hitting the mirrored port, and thus Ntop.
The problem that this causes is that Ntop can see all the packets on my network, but it cannot generate a full picture of the network as it is not aware of which hosts belong to my network. It may be possible to place Ntop in between two routers on two separate interfaces of a bridge, but again, the MAC addresses will be stripped by the routers. Is it possible to inform Ntop of which hosts are part of my network in some manner so it can continue to build a picture of the network? What options do I have if I cannot place Ntop in a situation where it can capture MAC addresses? (And no, using a hub is not an option unfortunately.) I would really like to acccess the advanced features of Ntop, but I cannot think of a way to do so. (A little additional background about the Ntop setup I am using.) There are a number of hosts on various subnets that connect through a number of "dumb" switches, finally terminating in the router. Ntop is currently running off of a mirrored port on the router. Given that there are at least 14 subnets coming into the router, I do not see a way of placing Ntop before the router, and a hub would cause far too many collisions - and therefore be unacceptable in this environment. _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
