Well, there are some places where there is a foreach device loop, but within a single device those should be totally separate - the data from the two interfaces should not be commingled. Which report is this?
If they were deleted, then they were purged as inactive, but I fail to see why they would be there at all. There was a fix in the cvs a couple of days ago, where one of the transitions wasn't being done, so items could be duplicated. Maybe try a fresh pull of the cvs... -----Burton > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf > Of Markus Rehbach > Sent: Friday, February 27, 2004 5:03 PM > To: [EMAIL PROTECTED] > Subject: Re: [Ntop-dev] Duplicated name entries in the eth0 host lists > (orig. from eth0 and NerFlow-Device) > > > Ok, for my understanding: > > It is right looking at the eth0 interface to have the name > resolutions entries > for the NetFlow-Interface, too (2 hosts, 4 entries, 2 without MAC > wich are > 'borrowed' on eth0 from the NetFlow-Interface)? > > You are right the -o will avoid the duplicated entries. Perfect that way. > > Markus > > _____________________ > > On Friday 27 February 2004 23:31, Burton M. Strauss III wrote: > > That (unfortunately) is perfectly normal. > > > > Doubly so. > > > > First off, ntop does NOT merge interfaces when they are virtual > > (netFlow/sFlow). The merge option applies only to multiple physical > > interfaces. > > > > Secondly, netFlow packets are pure IP, they do not have the MAC address. > > Unless you use the -o | --no-mac option, ntop is a hybrid > > layer2(MAC)/layer3(IP) analyzer WRT traffic it captures from > the interface. > > Accordingly, it sees this as two hosts. > > > > If you go into things like the host details page, which data you see > > depends on which interface is set (via Admin | Switch NIC) as > the current > > reporting interface. > > > > But, as a general rule, giving ntop two views of ANY traffic is > pretty much > > guaranteed to confuse things. > > > > -----Burton > > > > > -----Original Message----- > > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf > > Of Markus Rehbach > > Sent: Friday, February 27, 2004 4:13 PM > > To: [EMAIL PROTECTED] > > Subject: [Ntop-dev] Duplicated name entries in the eth0 host lists > > (orig. from eth0 and NerFlow-Device) > > > > > > Developers, > > > > checked out the cvs a few minutes ago. And tested a little bit eth0 vs. > > NetFlow. For that comparison (want to see whether the results are > > identical) > > I started ntop on eth0 on my machine. After a while I started > > nprobe on my > > machine on eth0 and created a NetFlow-Device in ntop collecting > > the data of > > nprobe. > > > > Effect: The (DNS;-)-names of my systems are duplicated in the > > lists for the > > eth0-Device. One time with the MAC address and another without. > > The entries > > without MAC were appearing in the lists for eth0 in the moment I started > > nprobe. For the NetFlow-Device everthing is fine. > > > > After a while some duplicated entries (ok, in my case there is one other > > entry) was deleted from the list, but the entry of my machine remains > > duplicated. > > > > Enough Information or more needed? > > > > Markus > > > > _______________________________________________ > > Ntop-dev mailing list > > [EMAIL PROTECTED] > > http://listgateway.unipi.it/mailman/listinfo/ntop-dev > > _______________________________________________ > Ntop-dev mailing list > [EMAIL PROTECTED] > http://listgateway.unipi.it/mailman/listinfo/ntop-dev _______________________________________________ Ntop-dev mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop-dev _______________________________________________ Ntop-dev mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop-dev
