Answers are "Not real sure" and "one".
People persist in thinking that the two, 'local' and -m are independent.
They're not.
All that -m does is to load additional networks into the table used to
determine 'pseudoLocal'. The test everywhere is 'pseudoLocal', not 'real
local' or '-m'.
The filtering process occurs when you use the -g | --track-local-hosts
option. That's when ntop decides whether to place hosts into the tables or
drop them. The logic is essentially:
New Host?
Yes? -> pseudoLocal?
Yes? --> create it, count it
No? --> create it, count it
No? -> pseudoLocal?
Yes? --> store it, count it
No? --> store it, count it
vs.
New Host?
Yes? -> pseudoLocal?
Yes? --> create it, count it
No? --> store it in 'other' bucket.
No? -> pseudoLocal?
Yes? --> store it, count it
No? --> store it in 'other' bucket.
-----Burton
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of
Schoplocher Peter (Student at Congleton)
Sent: Monday, September 15, 2003 3:59 AM
To: '[EMAIL PROTECTED]'
Subject: RE: [Ntop] --local-subnets & --no-mac
So why do hosts that show up without -m no longer appear when local subnets
are defined? Is there a limit how many IPs ntop can pick up for one MAC?
PS: I did not expect anyone to figure out whether or not a MAC is local.
Certainly, specifying a few gateway-MACs via command line would be a nice
feature.
Regards
Peter
-----Original Message-----
From: Burton M. Strauss III [mailto:[EMAIL PROTECTED]
Sent: 14 September 2003 18:31
To: [EMAIL PROTECTED]
Subject: RE: [Ntop] --local-subnets & --no-mac
That's actually harder - there's no lookup 'table', it's all stored in the
hosts data structure.
Basically, ntop creates a host entry when it sees a new MAC or IP and then
populates it with information as things are discovered and adds counts to it
as packets are received.
-----Burton
_______________________________________________
Ntop mailing list
[EMAIL PROTECTED]
http://listgateway.unipi.it/mailman/listinfo/ntop
_______________________________________________
Ntop mailing list
[EMAIL PROTECTED]
http://listgateway.unipi.it/mailman/listinfo/ntop
