Mathias Koerber wrote:
> [email protected] wrote:
>
>> I find that ntop reports one host as 'dav.koerber.org' but with the
>> correct IP address (192.168.0.10), but when I click on that page,
>> it shows 'about host 192.168.0.100'.
>
> The traffic shown under URL '192.168.0.43:3000/192.168.0.10.html
> is actually for 192.168.0.100 ! I verified that using tcpdump.
I stopped ntop, removed the whole /var/lib/ntop/*, restarted and
reconfigured and the same thing happened with the same host.
There seem to be a few more instances of this.
I wonder whether this is to do with some prefix issue:
192.168.0.10.html shows data about 192.168.0.100
192.168.0.1.html shows data about 192.168.0.115
in both cases the IP used in the URL is a prefix of the IP
it reports on.
(but the page 192.168.0.115.html does not exist and I get
"GET /192.168.0.115.html HTTP/1.1"
Warning
ntop does not currently have any information about host
192.168.0.115 [ Whois ]
)
The exact version of ntop is
ntop-5.0-5.el6.x86_64
About shows:
ntop Version x86_64-2.6.32-279.9.1.el6.x86_64-linux-gnu (64 bit)
Running as user ntop
Configured on Nov 26 2012 2:27:02
Built on Nov 26 2012 02:27:07
OS x86_64-2.6.32-279.9.1.el6.x86_64-linux-gnu
This version of ntop is a minimally supported but OLDER version -
please upgrade
Next version recheck is Fri Jul 4 14:54:42 2014
libpcap Version libpcap version 1.4.0
_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
