[Ntop] ntop on a pcap file

Mon, 28 Feb 2005 07:51:20 -0800

Hello,

Here what I tried :
  • I started a tcpdump -w file.pcap dst host my_host and dst port 2055 &
  • A few minutes later, I launched ntop as a daemon with the -f file.pcap argument, the tcpdump was still (and is still) running. Ntop complained a little because it find the file.pcap to be a truncated file, but it processed it.
Now this very instance of ntop I launched on the pcap file a few hours ago displays in (Summary->Network load) a graph with the last hour. A long time after the moment I first launched ntop.

My question is : does ntop rescan the pcap file and display the evolution or does it display the actual time by error ?

I hope that I made myself clear :-[ .

-- 
Didier Benza                            [EMAIL PROTECTED]
Tel : +33 492 38 7167 /  Fax : +33 492 38 7602 
INRIA 2004, Route des Lucioles, BP  93, 06902 Sophia Antipolis Cedex

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop

Reply via email to