Interesting idea. I'm not sure you're right, however... Note that the whole idea
behind pseudo-local is that you have told ntop (via the -m parameter) to treat that
range of addresses EXACTLY like it was local.
In the case where you simply have multiple networks on the same wire - with their host
and destination, then the MAC addresses are unique.
In the case where you actually have a gateway handling the traffic (and thus
re-writing the packet's MAC addresses, but leaving the higher level protocols alone),
then I think you have the situation where you're getting multiple (remote) IPs
collapsed into one MAC address.
It may be that you have to use -j | --border-sniffer-mode for this, but then (at
present) you lose a number of other MAC sensitive capabilities... Fixing that is on
the list post 2.1...
I'm going to leave the isPseudoLocal stuff to Luca - he's much more intimately
familiar with that area of the code than I am. I'll look at the URL stuff when I get
upstairs after my breakfast and shower...
-----Burton
---------- Original Message ----------------------------------
From: Olivier Castan - CERTA <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Date: Mon, 8 Jul 2002 17:52:48 +0200
>Hello
>
>First of all many thanks for providing ntop. Here are a few problems
>I've noticed, with, in some cases, a patch proposal :
>- I've used the -m flag and I've noticed that all my local traffic is
>reported under 1 host (the first one seen ?). Digging into the code I
>understand that the function isPseudoLocalAddress (util.c which
>returns TRUE for local networks) is used in hash.c to index using the
>MAC address. For local hosts on different subnets, their informations
>are mixed being stored using their gateway MAC address... Turning
>some calls to isPseudoLocalAddress in isLocalAddress seems to work
>- I understand you don't want to cope with % escaping in URLs. For
>ethernet hosts, the character ':' is replaced by '_' in the "Info
>about host" page URL but not in the corresponding graphics URL. I've
>made the correction.
>
>Just remarks with no corrections for the moment :
>- the -S option description in the community page FAQ is not coherent
>with the source and the man page ;)
>- I had a bad surprise discovering "shell" traffic involving what I
>believed was a bastion. In fact shell "shell" is 514/tcp and my host
>was only exporting its logs ("syslog" 514/udp). 2 solutions are
>possible : modify the function getAllPortByNum to report both tcp and
>udp names if they are different, or keep statistics about tcp and udp
>(I have no idea of the program memory usage). For example, I think it
>would be interesting to see both tcp and udp traffics for DNS
>(current vs xfer/"inefficient")
>- a cosmetic problem which is not usually visible : printHTMLheader
>(http.c) use its title argument to fill both the title in the header
>and in the body of an HTML page. If some HTML tags are passed they
>won't be interpreted by the browser in the title bar (visible if you
>open directly the frame for "Info about host...")
>- which one is the right mailing list : [EMAIL PROTECTED] (program),
>[EMAIL PROTECTED] (www.ntop.org), ntop-coders (sf.net)... ?
>
>Thanks
>
>Olivier Castan
>
>
__________________________________________________
D O T E A S Y - "Join the web hosting revolution!"
http://www.doteasy.com
_______________________________________________
Ntop mailing list
[EMAIL PROTECTED]
http://lists.ntop.org/mailman/listinfo/ntop
