I could be wrong, but I don't think you get MAC addresses with netflow? I use netflow exclusively, but also have --no-mac set, so haven't really worried about.
Knowing what netflow was designed for, I doubt MAC addresses are even in the netflow records to begin with - but as mentioned, I could be wrong! I guess you could google for netflow record info or analyze a netflow packet and see if the MAC address is in there somewhere. ? - Why do you care about MAC's? I just get them from the switches bridging table or arp table when needed. G -----Original Message----- From: ntop-boun...@unipi.it [mailto:ntop-boun...@unipi.it] On Behalf Of Brett Spedale Sent: Tuesday, June 09, 2009 5:50 PM To: ntop@unipi.it Subject: [Ntop] MAC addresses will not display when using netflow Hello, When using netflow, I cannot get MAC addresses to display for hosts local to the remote probe (for example, in the "Summary->Hosts" list on the web GUI). Everything else, except for the MAC issue, works great. I have verified that when running ntop on a physical local interface, MAC addresses do display. Likewise, when running ntop in place of the remote probe (on the remote box itself), MAC addresses also display. I've tried two different remote probes, and I've verified that ntop is not starting with the --no-mac option. Netflow plugin configuration: Interface address is set to the network I'm monitoring (10.3.0.0/255.255.0.0), flow aggregation is turned off, my local network is in the white list (10.3.0.0/16), nothing is in the black list. Also, I've tried using netflow v5 as well as v9 with the same result. I'm using version 3.2 of ntop. As the remote probe, I've used nprobe v5.0.0 and fprobe-ulog v1.1. Are there any recommended troubleshooting steps that I could take to see what's going on? Thanks _______________________________________________ Ntop mailing list Ntop@unipi.it http://listgateway.unipi.it/mailman/listinfo/ntop <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font> _______________________________________________ Ntop mailing list Ntop@unipi.it http://listgateway.unipi.it/mailman/listinfo/ntop
