Dear Ladies and Gentlemen,
I am writing to ask for your comments on trouble I am having with
Ntop (2.0b1).
The problem is that Ntop does not seemingly record humoungous HTTP
transactions when standard web browser clients download large amounts of
HTTP data with MIME type video/x-ms-asf.
I expected that the 'Data Rcvd' tab and IP data left menu choice (the
frame that shows clients in the left most colums than a protocol set in
the right columns with cells of data volumes for that protocol), in this
topology
Internet
| |
--------------- X -----------------|
gateway |10/8
|
|- HTTP client watching movie
would show the 4.5GB nett download of the client(in dozens of 1-10 MB
requests). But it doesn't.
The frame shows the problem client downloading less than 100 MB.
(at the end of the day. The Apache 1.3.19 proxy module also fails to log
the request properly. Here it is, way less, than what the squid cache
logs.
10.0.5.173 - cpacsw [19/Nov/2001:09:27:01 +1100] "GET
http://wmp2.ginger.com/nme?UID= HTTP/1.0" 200 32644
10.0.5.173 - cpacsw [19/Nov/2001:09:27:44 +1100] "GET
http://wmp2.ginger.com/nme?UID= HTTP/1.0" 200 32911
10.0.5.173 - cpacsw [19/Nov/2001:09:28:50 +1100] "GET
http://wmp2.ginger.com/nme?UID= HTTP/1.0" 200 38670
)
Is it because these panels only report the most recent transactions and
that old totals are aged out ? In this case however, there was no
indication whatsoever that the client was sucking bandwidth on such a
vast scale.
Ntop on the gateway/router is started like
/usr/local/ntop-2.0b/bin/ntop -d -w 3000 -P /var/log/ntop -S 1
I have checked a different ntop (2.0b1) running on the same machine as a
web server and requesting a 10 MB file with file name 'blah.html'. The
(telnet client) reported the content type as text/html, the content
lenght correctly and ntop reported the transaction amount as 10MB also.
What am I doing wrong ?
Thank you,
Yours sincerely.
--
------------------------------------------------------------------------
Stanley Hopcroft IP Australia
Network Specialist
+61 2 6283 3189 +61 2 6281 1353 (FAX) [EMAIL PROTECTED]
------------------------------------------------------------------------
Hard work may not kill you, but why take chances?
_______________________________________________
Ntop mailing list
[EMAIL PROTECTED]
http://listmanager.unipi.it/mailman/listinfo/ntop
