Thanks for the help. "ignore MAC" did the trick! On 06/01/2010 03:17 AM, Ken Felix wrote: > And you can add the proper unix switch for identifying localsubnets. i > think it's "-m" iirc. > > ________________________________________ > From: [email protected] [[email protected]] > On Behalf Of Gary Gatten [[email protected]] > Sent: Monday, May 31, 2010 8:55 AM > To: '[email protected]'; '[email protected]' > Subject: Re: [Ntop] Switch mirroring port - Display both incoming and utgoing > > A *typical* config would be a mirror/span port which copies both Tx and Rx > data to the monitor port. This gives nTop the complete view. > > You may want to try the "ignore MAC" arg, I think it's "-o", but check the > man page. > > Also, you *could* setup multiple interfaces in your ntop host, one for Rx and > on for Tx. From there you can have ntop merge the data or keep it seperate. > > ----- Original Message ----- > From: [email protected] <[email protected]> > To: [email protected] <[email protected]> > Sent: Mon May 31 06:59:49 2010 > Subject: [Ntop] Switch mirroring port - Display both incoming and utgoing > > Hi > We are trying out to fetch data into ntop. Currently we use a mirror > port on a switch to catch all data. > The disadvantage in this is that all data is displayed as Incoming. I > can understand that because all traffic is just coming in on one > interface and then dropped (promise mode). > > Is there anyway to get Incoming and Outgoing data separated in ntop with > mirroring ports on a switch? In our switch we can have many mirroring > ports that transfer only rx, only tx or both. > > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop >
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
