Ok, for my understanding: It is right looking at the eth0 interface to have the name resolutions entries for the NetFlow-Interface, too (2 hosts, 4 entries, 2 without MAC wich are 'borrowed' on eth0 from the NetFlow-Interface)?
You are right the -o will avoid the duplicated entries. Perfect that way. Markus _____________________ On Friday 27 February 2004 23:31, Burton M. Strauss III wrote: > That (unfortunately) is perfectly normal. > > Doubly so. > > First off, ntop does NOT merge interfaces when they are virtual > (netFlow/sFlow). The merge option applies only to multiple physical > interfaces. > > Secondly, netFlow packets are pure IP, they do not have the MAC address. > Unless you use the -o | --no-mac option, ntop is a hybrid > layer2(MAC)/layer3(IP) analyzer WRT traffic it captures from the interface. > Accordingly, it sees this as two hosts. > > If you go into things like the host details page, which data you see > depends on which interface is set (via Admin | Switch NIC) as the current > reporting interface. > > But, as a general rule, giving ntop two views of ANY traffic is pretty much > guaranteed to confuse things. > > -----Burton > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf > > Of Markus Rehbach > > Sent: Friday, February 27, 2004 4:13 PM > > To: [EMAIL PROTECTED] > > Subject: [Ntop-dev] Duplicated name entries in the eth0 host lists > > (orig. from eth0 and NerFlow-Device) > > > > > > Developers, > > > > checked out the cvs a few minutes ago. And tested a little bit eth0 vs. > > NetFlow. For that comparison (want to see whether the results are > > identical) > > I started ntop on eth0 on my machine. After a while I started > > nprobe on my > > machine on eth0 and created a NetFlow-Device in ntop collecting > > the data of > > nprobe. > > > > Effect: The (DNS;-)-names of my systems are duplicated in the > > lists for the > > eth0-Device. One time with the MAC address and another without. > > The entries > > without MAC were appearing in the lists for eth0 in the moment I started > > nprobe. For the NetFlow-Device everthing is fine. > > > > After a while some duplicated entries (ok, in my case there is one other > > entry) was deleted from the list, but the entry of my machine remains > > duplicated. > > > > Enough Information or more needed? > > > > Markus > > > > _______________________________________________ > > Ntop-dev mailing list > > [EMAIL PROTECTED] > > http://listgateway.unipi.it/mailman/listinfo/ntop-dev > > _______________________________________________ > Ntop-dev mailing list > [EMAIL PROTECTED] > http://listgateway.unipi.it/mailman/listinfo/ntop-dev _______________________________________________ Ntop-dev mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop-dev
