RE: [Ntop] I am having a problem, ntop doesn't detect P2P traffic. could you advice me what to do ?

Ramy Motawei Thu, 29 Dec 2005 06:33:36 -0800

Dear Sir,

Thank you for your fast reply, so is there is a site that I can download a version of ntop for windows that is not restricted to this small number of packets? Please advice.

Best Regards

Ramy mohsen Motawei

Planning and Designing Engineer

Data communication dep.

LINKdotNET

3 mussadak st. Dokki, Giza, Egypt

E-mail:[EMAIL PROTECTED]

Web: www.link.net

Tel.: +202 336 77 11 - Ext:1410

Fax: +202 336 49 10

Confidentiality: This e-mail communication and any attachments thereto contain information which is confidential and are intended only for the use of the individuals or entities named above. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution or the taking any action in reliance on the contents of these documents is strictly prohibited and may be illegal. Please notify us of your receipt of this e-mail in error and delete the e-mail and any copies of it.

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Burton Strauss
Sent: Thursday, December 29, 2005 4:29 PM
To: ntop@Unipi.IT
Subject: RE: [Ntop] I am having a problem,ntop doesn't detect P2P traffic. could you advice me what to do ?

The demo version records only 1000 packets - I think drawing ANY conclusion from that small a sample is unreliable.

-----Burton

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ramy Motawei
Sent: Thursday, December 29, 2005 2:54 AM
To: ntop@Unipi.IT
Cc: Mohamed Gamal
Subject: [Ntop] I am having a problem,ntop doesn't detect P2P traffic. could you advice me what to do ?

Dear Sir,

I am having a problem with ntop and I hope that you could tell me the reason for it. I work in a major ISP in Egypt and I was interested in discovering the amount of bandwidth consumed by P2P application in the internet traffic of the users in my network using ntop. I am deploying the windows version of ntop (ntop-3.1-demo) on a Dell machine, as a sample I configured port mirroring on an interface on a juniper router that carries the Internet traffic of some of my customers.

I used port mirroring on the interface of the juniper M5 router to mirror the internet traffic of the customers and send it to the server that hosts the ntop application. The problem is that the ntop has indicated that almost 80 % of the traffic was http traffic and almost no P2P traffic that belongs to any application was detected. Theses results were very strange as I did that test at the very early morning where most of the customers are asleep so I expected to see most of the traffic as a P2P download sessions.

So I have 2 possibilities, either my idea about the traffic types on my network was greatly mistaken (in this case our network will be the first network in the world that has no problems with the P2P trafficJ), or that something went wrong that prevented the ntop application from identifying the traffic of the P2P applications like kazaa and bit torrent…etc.

I hope that you can provide me with an advice about the reason why didn’t the ntop detect the P2P traffic, and if I can do something about that or not.

Thanks & Regards