Hello First of all many thanks for providing ntop. Here are a few problems I've noticed, with, in some cases, a patch proposal : - I've used the -m flag and I've noticed that all my local traffic is reported under 1 host (the first one seen ?). Digging into the code I understand that the function isPseudoLocalAddress (util.c which returns TRUE for local networks) is used in hash.c to index using the MAC address. For local hosts on different subnets, their informations are mixed being stored using their gateway MAC address... Turning some calls to isPseudoLocalAddress in isLocalAddress seems to work - I understand you don't want to cope with % escaping in URLs. For ethernet hosts, the character ':' is replaced by '_' in the "Info about host" page URL but not in the corresponding graphics URL. I've made the correction.
Just remarks with no corrections for the moment :
- the -S option description in the community page FAQ is not coherent
with the source and the man page ;)
- I had a bad surprise discovering "shell" traffic involving what I
believed was a bastion. In fact shell "shell" is 514/tcp and my host
was only exporting its logs ("syslog" 514/udp). 2 solutions are
possible : modify the function getAllPortByNum to report both tcp and
udp names if they are different, or keep statistics about tcp and udp
(I have no idea of the program memory usage). For example, I think it
would be interesting to see both tcp and udp traffics for DNS
(current vs xfer/"inefficient")
- a cosmetic problem which is not usually visible : printHTMLheader
(http.c) use its title argument to fill both the title in the header
and in the body of an HTML page. If some HTML tags are passed they
won't be interpreted by the browser in the title bar (visible if you
open directly the frame for "Info about host...")
- which one is the right mailing list : [EMAIL PROTECTED] (program),
[EMAIL PROTECTED] (www.ntop.org), ntop-coders (sf.net)... ?
Thanks
Olivier Castan
hash.c.diff
Description: Binary data
reportUtils.c.diff
Description: Binary data
