Hi Luca, Can't figure out why the below is being labeled as Unknown instead of Citrix? Any tips for debugging?
From nDPI/src/lib/ndpi_main.c
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_CITRIX, "Citrix",
ndpi_build_default_ports(ports_a, 1494, 2598, 0, 0,
0) /* TCP */
Active Flows
10
Info Application L4 Proto Client Server Duration Bytes
Info
<http://172.16.10.65:3000/lua/flow_details.lua?interface=any&flow_key=558278832&label=whipcit44xa.local.intrasp.com:2598%20%3C-%3E%2010.254.57.135:60012>
Unknown TCP whipcit44xa.local.intrasp.com
<http://172.16.10.65:3000/lua/host_details.lua?interface=any&host=172.23.12.154>:2598
<http://172.16.10.65:3000/lua/port_details.lua?interface=any&port=2598> 10.254.57.135
<http://172.16.10.65:3000/lua/host_details.lua?interface=any&host=10.254.57.135>:60012
<http://172.16.10.65:3000/lua/port_details.lua?interface=any&port=60012> 00:21:22 1.78 MB
DCE_RPC
<http://172.16.10.65:3000/lua/host_details.lua?host=10.254.57.135&page=historical&rrd_file=DCE_RPC.rrd>
1.34 KB 0
Sent
Rcvd
1.34 KB 0.05 %
DNS
<http://172.16.10.65:3000/lua/host_details.lua?host=10.254.57.135&page=historical&rrd_file=DNS.rrd>
832 0
Sent
Rcvd
832 0.03 %
HTTP
<http://172.16.10.65:3000/lua/host_details.lua?host=10.254.57.135&page=historical&rrd_file=HTTP.rrd>
6.07 KB 13 KB
Sent
Rcvd
19.07 KB 0.74 %
LDAP
<http://172.16.10.65:3000/lua/host_details.lua?host=10.254.57.135&page=historical&rrd_file=LDAP.rrd>
11.4 KB 0
Sent
Rcvd
11.4 KB 0.45 %
SMB
<http://172.16.10.65:3000/lua/host_details.lua?host=10.254.57.135&page=historical&rrd_file=SMB.rrd>
248.62 KB 0
Sent
Rcvd
248.62 KB 9.71 %
Unknown
<http://172.16.10.65:3000/lua/host_details.lua?host=10.254.57.135&page=historical&rrd_file=Unknown.rrd>
256.69 KB 1.98 MB
Sent
Rcvd
2.23 MB 89.02 %
--
Stephen Clark
*NetWolves*
Director of Technology
Phone: 813-579-3200
Fax: 813-882-0209
Email: [email protected]
http://www.netwolves.com
_______________________________________________ Ntop-dev mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-dev
