Hello all, I am still pretty new to Ntop but am getting more familiar. I have read a lot of the docs and some posts but could not find this addressed.
My setup is a mirrored port on a "glue" network, that is I am sniffing a port on a layer 3 Dell switch that is untagged on VLAN 150. The only other thing on this VLAN, is the LAN interface of our firewall. The VLAN is only on this one switch, the switch doubles as the core router for the LAN networks. When I view "All Protocols, Throughput", it defaults me to "All". I sort by current bandwidth, and view the list of top users. Then I change the VLAN to 150, and the list completely changes, drastically different throughputs from completely different hosts, all with (150) after their name or IP. I don't understand why this traffic would be different, at least so drastically different. I have verified it's not just timing of usage and refreshes. Someone can be downloading something large, and not appear on All, yet I change to VLAN 150, and they are #1. I don't get it or know which to believe. Thanks! Mark
_______________________________________________ Ntop mailing list Ntop@unipi.it http://listgateway.unipi.it/mailman/listinfo/ntop
