Gary Gatten wrote:
Generally speaking nTop is fairly accurate from my experience - at least
the "real-time" data. Some of the history / rrd data is WAY off.
Compare the data ntop and sflow plugin display to your interface
counters. Assume your interface counters are correct and work outwards
from there. Be certain the sflow config on your devices is accounting
ingress and egress traffic on the appropriate interfaces. If you have a
number of virtual interfaces, NAT, etc. - it's EASY to have packets
counted two, three, or four times - or maybe not at all.
G
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
mario.carassale
Sent: Tuesday, November 13, 2007 11:42 AM
To: [email protected]
Subject: [Ntop] Ntop shows only received data
Hi Guys,
i have been running Ntop for 2 days now and all looks good.
I have got one question tought.
Why Ntop only shows data going out when monitoring sFlow devices.
Basically i am monitoring three transit interfaces in our network and i
can only see data coming in our AS number and not going out. Why is
that?
Also. if i look at the amount of data processed in the sFlow plugin
interface i can see that there about 1.3 TBytes but the actual data
being processed by Ntop is far less than this. For instance, the amount
of HTTP traffic is being shown as 500Mbytes which is absolutely
impossible. Do you thyink there is a configuration mistake somewhere? I
just cannot see how to change this behaviour.
Thank you for all the support.
_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
<font size="1">
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in
1.0pt 0in'>
</div>
"This email is intended to be reviewed by only the intended recipient
and may contain information that is privileged and/or confidential.
If you are not the intended recipient, you are hereby notified that
any review, use, dissemination, disclosure or copying of this email
and its attachments, if any, is strictly prohibited. If you have
received this email in error, please immediately notify the sender by
return email and delete this email from your system."
</font>
_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
Hi Gary,
Thank you for your email.
I still don't understand if i am doing something wrong.
I have attached two graph for better understanding.
This is what is being received from a 10 gigabit interface and you can
see the total data is in GBytes
41 Gigabit Ethernet 10 Gbit full-duplex Administrative
Operational 1 24.3 GBytes
54.8 GBytes 48,184,919
57,397,718 430
413 0
0 0
0 0
0 0
Now this is the total IP traffic on the repoirt for this interface. Then
this is breakdown into different protocol.
Total 12.1 MBytes [15,657 Pkts]
IP Traffic 12.1 MBytes [15,655 Pkts]
Fragmented IP Traffic 486.0 KBytes [3.9%]
Non IP Traffic 20.6 KBytes
The data just doesn't match.
Please let me know if you think i am doing something wrong.
Thank you for your time.
Mario
_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
