The relevant code is in pbuf.c, from line 1975ff. It's been a long time
since I last played with IPX at a low level, so I'll have to read it
offline... (Netware 2.15 and 3.11)
-----Burton
If you want to give it a gander, it starts:
if((myGlobals.device[deviceId].datalink != DLT_PPP)
&& (myGlobals.device[deviceId].datalink != DLT_RAW)) {
if((!myGlobals.borderSnifferMode) && (eth_type == 0x8137)) {
/* IPX */
IPXpacket ipxPkt;
srcHostIdx = getHostInfo(NULL, ether_src, 0, 0, actualDeviceId);
srcHost =
myGlobals.device[actualDeviceId].hash_hostTraffic[checkSessionIdx(srcHostIdx
)];
if(srcHost == NULL) {
/* Sanity check */
traceEvent(TRACE_INFO, "Sanity check failed (5) [Low memory?]");
} else {
/* Lock the instance so that the next call
to getHostInfo won't purge it */
/* srcHost->instanceInUse++; */
}
dstHostIdx = getHostInfo(NULL, ether_dst, 0, 0, actualDeviceId);
dstHost =
myGlobals.device[actualDeviceId].hash_hostTraffic[checkSessionIdx(dstHostIdx
)];
if(dstHost == NULL) {
/* Sanity check */
traceEvent(TRACE_INFO, "Sanity check failed (6) [Low memory?]");
} else {
/* Lock the instance so that the next call
to getHostInfo won't purge it */
/* dstHost->instanceInUse++; */
}
memcpy((char *)&ipxPkt, (char *)p+sizeof(struct ether_header),
sizeof(IPXpacket));
if(ntohs(ipxPkt.dstSocket) == 0x0452) {
/* SAP */
int displ = sizeof(struct ether_header);
p1 = p+displ;
length -= displ;
goto handleIPX;
} else {
srcHost->ipxSent += length, dstHost->ipxRcvd += length;
myGlobals.device[actualDeviceId].ipxBytes += length;
updatePacketCount(srcHostIdx, dstHostIdx, (TrafficCounter)length,
actualDeviceId);
}
>From this, at the very least, unless the traffic is all SAP packets, you
should have something in ipxBytes, which is reported in the global protocol
distribution section (Stats tab, traffic report), which is in report.c
around 2509...
So, 1st ? - are you getting IPX counts in that report...
More later if I can...
-----Burton
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of
Robert Myles
Sent: Tuesday, February 19, 2002 5:51 AM
To: [EMAIL PROTECTED]
Subject: [Ntop] Bug Report - IPX traffic mis-classified as OSI
Hello to Luca and everyone else
I am running ntop 2.0 on FreeBSD 4.4-Release.
I am monitoring a network on which the traffic is TCP/IP (mostly
Netbios over TCP/IP) and IPX (802.3).
On ntop 1.1 the IPX traffic was correctly listed by the ntop web server
as IPX on the "Data Sent" and "Data Rcvd" pages, however on version
2.0 it is listed as OSI.
intop ver. 2.0 appears to list it as 'Other'.
I built the latest version of ntop (2.0.1 - 18 Feb 2002) and it behaves in
the same way.
<snip>
_______________________________________________
Ntop mailing list
[EMAIL PROTECTED]
http://listmanager.unipi.it/mailman/listinfo/ntop
