I will try and use the -p option, as you suggest . It will probably be very easy because the SAP R/3 is using TCP , and I know the port numbers used ( 3200, and some more , it depends on the version ..) . So, thank you for indicating me this option, I just did not thought at first that configuring the ports would be possible, I will look better next time.
When it will work, I will try to gather my informations about SAP monitoring and send them, it could be useful .
I am sure my question can become a F.A.Q. , don't overlook this protocol . I am not promoting SAP , but this system is widely used now (more than NFS, I guess) and it is very sensible to network load . This drives companies to acquire network monitors , and this is what made me look towards NTOP ... Normally, companies equiped with SAP would also be equiped with HP Openview, or Tivoli ; but they may also have SAP and no money left for the network monitor . This is the kind of new members that you get in the NTOP club .
To be continued .. Thanks again
At 09:09 17/03/03 -0800, you wrote:
For network people, SAP is Server Advertizing Protocol...
Yes, I know SAP the application, my next door neighbor works for 'em
You would have to figure out how SAP communicates with it's clients, i.e. what is the layer 4 protocol used? (I'm assuming it's tcp/ip based, probably tcp).
So the question becomes what ports does SAP listen on and what's the internal format of the messages. Without a lot more understanding of SAP's internals I can't answer it.
SAP has both mainframe (R/2), client server (R/3) and web versions (mySAP). The issues for each would be different (e.g. sniffing the stuff out of the tn3270 traffic, off a unique port or out of http: traffic).
So it really comes down to what version and what your needs are.
It could be as simple as a single port (the SAP R/3 server listens on port nnnn, so all tcp/ip traffic to/from that port can be classified as 'SAP'). You can do that with ntop's existing -p parameter.
But, if you have to dig into the code and figure out from the fields in the packets, that's a) more work and b) not in ntop and c) has to be done in c language coding.
If you're a licensed user of SAP, they might give you that info or it might already be documented in something you have (look for instructions on punching SAP through a firewall - that's usually the clues you need).
Regardless, I doubt that anyone would be interested in coding this, unless you're interested in sponsoring the work.
Contact Luca or I off-list if you are...
-----Burton
---------- Original Message ---------------------------------- From: Barthelemy BOGAERT <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Date: Mon, 17 Mar 2003 17:04:29 +0100
>There might be some misunderstanding .
>
>SAP , Service Access Point between network layers ! Or for the Netware layer .
>I guess that is what a highly technical network guy could think ... But I
>am not searching so precise .
>
>I am talking about the SAP application that some companies run for finance,
>order-processing ...
>It is a client server application running over TCP .
>What I know are the port number of the clients and the servers . Would
>there be a way to configure NTOP in order to monitor the trafic addressed
>to/from these ports ?
>
>Thanks
>
>
>At 07:18 17/03/03 -0800, you wrote:
>>There's code to handle NetWare SAP, but I don't know what displays come
>>from it. You would have to look in there (protocol.s?) and then grep the
>>field names in the reporting modules.
>>
>>-----Burton
>>
>>For US-based commercial support for ntop, see
>> http://www.ntopsupport.com
>>
>>To search the ntop mailings lists, see
>> http://www.gmane.org
>>
>>ntop home page: http://www.ntop.org
>>Source and binary downloads at SourceForge
>>
>>
>>
>>
>>
>>---------- Original Message ----------------------------------
>>From: Barthelemy BOGAERT <[EMAIL PROTECTED]>
>>Reply-To: [EMAIL PROTECTED]
>>Date: Mon, 17 Mar 2003 11:27:18 +0100
>>
>> >Hi !
>> >
>> >Do you know if there is any enhancement of NTOP in order to monitor the SAP
>> >traffic ?
>> >
>> >We are using this application in my company (like so many others..) and
>> >this is the feature that my bosses would like to see , at least as a
>> feature .
>> >
>> >
>> >
>> >_______________________________________________
>> >Ntop mailing list
>> >[EMAIL PROTECTED]
>> >http://listgateway.unipi.it/mailman/listinfo/ntop
>> >
>>
>>
>>____________________________________________________________
>>Free 20MB Web Site Hosting and Personalized E-mail Service!
>>Get It Now At Doteasy.com http://www.doteasy.com/et/
>>_______________________________________________
>>Ntop mailing list
>>[EMAIL PROTECTED]
>>http://listgateway.unipi.it/mailman/listinfo/ntop
>
>_______________________________________________
>Ntop mailing list
>[EMAIL PROTECTED]
>http://listgateway.unipi.it/mailman/listinfo/ntop
>
____________________________________________________________ Free 20MB Web Site Hosting and Personalized E-mail Service! Get It Now At Doteasy.com http://www.doteasy.com/et/ _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
_______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
