The defn of local is the some of all the networks that you tell ntop are local, or are derived from interface address/mask, etc.
So if, in addition to the address of the netflow interface, theres a physical 192.168.111.0/24 as your management network, both are local. Classification is all based on what ntop sees. So in the above situation, a packet from 10.1.1.1 à 192.168.111.111 is (local) to (local). -----Burton Quotation # 43 When you give up drinking and high fat food -- you don't live any longer, it just feels that way. From: [email protected] [mailto:[email protected]] On Behalf Of underattack7 Sent: Monday, July 11, 2011 6:17 AM To: [email protected] Subject: [Ntop] IP traffic direction signication Hi, I would like to make sure I understand the figures correctly: I am using NTOP for collecting NETFLOW traffic. In my Netflow Device definition, I set up the "Virtual Network Interface Address" to a network address 10.0.0.0/24. My understanding is that 10.0.0./24 is considered as the LOCAL network. now in IP / traffic direction: -local to remote: I understand this is the OUTGOING traffic from 10.0.0.0/24 -remote to local: I understand this is the INCOMING traffic to 10.0.0.0/24 What then is "Data sent" and "Data received" exactly in Local to remote and Remote to Local ? Other question, is it possible to define multiple Local network ? Very often, your Local network has several IP ranges. Thanks, Regards, Fab
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
