And you can add the proper unix switch for identifying localsubnets. i think it's "-m" iirc.
________________________________________ From: [email protected] [[email protected]] On Behalf Of Gary Gatten [[email protected]] Sent: Monday, May 31, 2010 8:55 AM To: '[email protected]'; '[email protected]' Subject: Re: [Ntop] Switch mirroring port - Display both incoming and utgoing A *typical* config would be a mirror/span port which copies both Tx and Rx data to the monitor port. This gives nTop the complete view. You may want to try the "ignore MAC" arg, I think it's "-o", but check the man page. Also, you *could* setup multiple interfaces in your ntop host, one for Rx and on for Tx. From there you can have ntop merge the data or keep it seperate. ----- Original Message ----- From: [email protected] <[email protected]> To: [email protected] <[email protected]> Sent: Mon May 31 06:59:49 2010 Subject: [Ntop] Switch mirroring port - Display both incoming and utgoing Hi We are trying out to fetch data into ntop. Currently we use a mirror port on a switch to catch all data. The disadvantage in this is that all data is displayed as Incoming. I can understand that because all traffic is just coming in on one interface and then dropped (promise mode). Is there anyway to get Incoming and Outgoing data separated in ntop with mirroring ports on a switch? In our switch we can have many mirroring ports that transfer only rx, only tx or both. _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
