> Um... I don't see any examples, but the structures (look at > pluginSkeleton.c) seem to show that you can indeed see the packet contents: Yes, you can see the packet contents, but this is on IP level, while most peer-to-peer protocols are layered on top of TCP. So you need to (at least partially) implement the TCP protocol in the plugin to do a good analysis, which is a large overhead, especially since it's already done (partially) in ntop itself for listing the TCP sessions.
> Which matches icmpPlugin.c: While we're at it, maybe you can help me with another problem. I've been analysing the icmpPlugin.c code a little and apparantly it gets all of its informations through the "device" structure, however I can not find any info on this. I think the main ntop database is stored in there somewhere, however I can't find the code which actually initiates this structure and the actual definition of this "device structure". > At which point you could do the analysis and tracking to your hearts > content. I'm guessing that the Napster stuff 1) became irrelevant 2) > doesn't work very well and 3) was done in-line so you wouldn't have to go to > a plugins menu to get it... But that's all only a guess... You're right about the Napster stuff. It was scattered all over the place and really messy :) Thanks for the feedback, Peter _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listmanager.unipi.it/mailman/listinfo/ntop
