That (unfortunately) is perfectly normal. Doubly so.
First off, ntop does NOT merge interfaces when they are virtual (netFlow/sFlow). The merge option applies only to multiple physical interfaces. Secondly, netFlow packets are pure IP, they do not have the MAC address. Unless you use the -o | --no-mac option, ntop is a hybrid layer2(MAC)/layer3(IP) analyzer WRT traffic it captures from the interface. Accordingly, it sees this as two hosts. If you go into things like the host details page, which data you see depends on which interface is set (via Admin | Switch NIC) as the current reporting interface. But, as a general rule, giving ntop two views of ANY traffic is pretty much guaranteed to confuse things. -----Burton > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf > Of Markus Rehbach > Sent: Friday, February 27, 2004 4:13 PM > To: [EMAIL PROTECTED] > Subject: [Ntop-dev] Duplicated name entries in the eth0 host lists > (orig. from eth0 and NerFlow-Device) > > > Developers, > > checked out the cvs a few minutes ago. And tested a little bit eth0 vs. > NetFlow. For that comparison (want to see whether the results are > identical) > I started ntop on eth0 on my machine. After a while I started > nprobe on my > machine on eth0 and created a NetFlow-Device in ntop collecting > the data of > nprobe. > > Effect: The (DNS;-)-names of my systems are duplicated in the > lists for the > eth0-Device. One time with the MAC address and another without. > The entries > without MAC were appearing in the lists for eth0 in the moment I started > nprobe. For the NetFlow-Device everthing is fine. > > After a while some duplicated entries (ok, in my case there is one other > entry) was deleted from the list, but the entry of my machine remains > duplicated. > > Enough Information or more needed? > > Markus > > _______________________________________________ > Ntop-dev mailing list > [EMAIL PROTECTED] > http://listgateway.unipi.it/mailman/listinfo/ntop-dev > _______________________________________________ Ntop-dev mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop-dev
