RE: [Ntop] ntop on a pcap file

Burton Strauss Mon, 28 Feb 2005 08:48:53 -0800

Neither ... ntop reads the file until it finds eof and that's it. There's no ability to pipe.

ntop has the ability to read packet captures to help w/ debugging. We don't try to sync time or anything. Just process packets from the file and display reports.

Why are you trying this? It's bogus - just use -B "filter" for the ntop instance.

-----Burton

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Didier Benza
Sent: Monday, February 28, 2005 9:50 AM
To: [email protected]
Subject: [Ntop] ntop on a pcap file

Hello,

Here what I tried :

I started a tcpdump -w file.pcap dst host my_host and dst port 2055 &
A few minutes later, I launched ntop as a daemon with the -f file.pcap argument, the tcpdump was still (and is still) running. Ntop complained a little because it find the file.pcap to be a truncated file, but it processed it.

Now this very instance of ntop I launched on the pcap file a few hours ago displays in (Summary->Network load) a graph with the last hour. A long time after the moment I first launched ntop.

My question is : does ntop rescan the pcap file and display the evolution or does it display the actual time by error ?

I hope that I made myself clear :-[ .

-- 
Didier Benza                            [EMAIL PROTECTED]
Tel : +33 492 38 7167 /  Fax : +33 492 38 7602 
INRIA 2004, Route des Lucioles, BP  93, 06902 Sophia Antipolis Cedex

_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop

RE: [Ntop] ntop on a pcap file

Reply via email to