Re: [Ntop] Please - in re bug reports...

2002-01-10 Thread Blake Sanders
What do you think about sending this message in reply to a NTOP has a bug ? Some people who need/want support from someone like you may not have read this message ( like new members to the mailing list, etc..) -- Blake --- Burton M. Strauss III [EMAIL PROTECTED] wrote: Look, I don't mind

[Ntop] monitor special ports

2002-01-10 Thread Thomas Springer
Hi, we're happily using ntop 2.0 on suse 7.3. Ntop shows traffic for several ports in the Stats-Webinterface (trafficStats.html). Is there any possibility to add any other but the standard-ports by configuration or do I have to modify the source? Background: I'd like to get a quick'n dirtya

Re: [Ntop] monitor special ports

2002-01-10 Thread Michael Weidel
Thomas Springer wrote: Hi, we're happily using ntop 2.0 on suse 7.3. Ntop shows traffic for several ports in the Stats-Webinterface (trafficStats.html). Is there any possibility to add any other but the standard-ports by configuration or do I have to modify the source? Background:

Re: [Ntop] monitor special ports

2002-01-10 Thread Peter Backx
Is there any possibility to add any other but the standard-ports by configuration or do I have to modify the source? I think you can use the -F parameter for that. Background: I'd like to get a quick'n dirtya overview about bandwithwaste for napsterkazaa on our networks. This is a lot more

RE: [Ntop] monitor special ports

2002-01-10 Thread Burton M. Strauss III
As I'm busy researching the network behaviour of such peer-to-peer applications and I think there are two options to make ntop monitor such protocols: * Write a plug-in to handle the protocol. However AFAIK a plug-in cannot access the content of reassembled TCP transmissions, which is needed for

Re: [Ntop] monitor special ports

2002-01-10 Thread Peter Backx
Um... I don't see any examples, but the structures (look at pluginSkeleton.c) seem to show that you can indeed see the packet contents: Yes, you can see the packet contents, but this is on IP level, while most peer-to-peer protocols are layered on top of TCP. So you need to (at least

Re: [Ntop] monitor special ports

2002-01-10 Thread bstrauss3
Yes, you can see the packet contents, but this is on IP level, while most peer-to-peer protocols are layered on top of TCP. So you need to (at least partially) implement the TCP protocol in the plugin to do a good analysis, which is a large overhead, especially since it's already done

RE: [Ntop] Problems using Netflow in Ntop 2.0

2002-01-10 Thread Burton M. Strauss III
Don't turn on netflow? :-) Looks like a common problem - quoting from Cisco's documentation: Cisco IOS Router-Based NetFlow Aggregation Customers can expect a large volume of export data from NetFlow when it is enabled on many interfaces on high-end routers that switch many flows per unit time

RE: [Ntop] Problems using Netflow in Ntop 2.0

2002-01-10 Thread shawn everett
How about using a filter to reduce what you're looking at? Hmmm that's a possible. What we'd really need is a filter that would provide me with an aproximate bandwidth usage that wwe could use for accounting. How would I go about setting up a filter to do this? Shawn

RE: [Ntop] Problems using Netflow in Ntop 2.0

2002-01-10 Thread bstrauss3
How would I go about setting up a filter to do this? It uses standard syntax, like tcpdump. How about a combo - (Linux only?) - use netfilter's limiting syntax to mark a small % of packets (TOS or firemark) and then the filter to select only those... -Burton If my cat allowed me to