You might check your switch port mirroring configuration and make sure it supports this. Your switch may be the problem here ... not NTOP.
--- loic <[EMAIL PROTECTED]> wrote: > Hi, > description of the situation : i've got a server (RH > 7.3) with ntop 2.1.55 > running on it. I've got 2 network interfaces eth0 > and eth1. > I start ntop by : ntop -P /usr/share/ntop -u ntop > -C -i eth1 > I sniff in promiscius mode what's pass thrue eth1 a > network node. This > interface is connected to a port that is in mirrored > from the switch's port > (xylan 10/32 omnistack) where goes all the traffic I > want to have a look. > I use the eth0 to keep on communicate with the web > interface. > So every thing is fine ntop is running ok I can see > all the trafic that's > interest me. My netcork conf is ok. > BUT cause of course there is a but, the information > for usage, session, and > matrix give me the unique answer : no traffic yet > (than all the other info > give me a loads of details like stats etc ...) > So I just assume that is because I am an a mirrored > port which might disable > the tracking .. I've tested to monitor an a hub or a > non mirrored port and I > got all the infos. > I was just currious to understand why in this > situation this 3 fonc couldn't > appear (usage, sesssions an matrix). > > > > -------Original Message------- > > From: Blake > Date: dimanche 02 mars 2003 23:41:05 > To: [EMAIL PROTECTED] > Subject: Re: [Ntop] Port mirroring pb ... > > > first msg > > I monitor a network node, with ntop 2.1.55 which > is > > connected on the > > mirrorred port. My problem is that I don't get any > > more the precious > > informations of : "usage" "sessions" and "matrix". > > When i'm an a normal port > > I get all of the informations. > > > First of all you really are not providing enough > information to answer your question?? What do you > mean when you say 'I monitor a network node"?? > > 1) is NTOP running on the node you want to monitor > or > 2) is NTOP running on a seperate server connected to > a > switch port which you are configuring port mirroring > to capture traffic from another port? > 3) if #2 is correct then is the port you are > monitoring have a server connected to it or a > router? > 4) if this is a Cisco switch ?? then what model is > it? > > This kind of information helps. > > I have a question for you, how do you get "all the > information" when you are collecting statistics on a > port that is configured for port spanning or > monitoring of another port? That statement does not > make sense to me because if you connect a server to > a > switch without this then all you will get is > broadcast > traffic from other devices (and of course the > traffic > generated from the that server). > > > > Is there any > > solutions to get all of the > > informations when I sniff on a mirrorred port ? > > what is the port configured to mirror? what is > connected to the source port? If you connect NTOP to > a port which is montoring another port ... you will > get all the traffic (depending on how you configure > the port span or mirror). If the port is not > mirrored, you will only get broadcast traffic unless > you specifically are looking for protocol stats sent > and received from the machine running NTOP. > > > > Thanks again for your time, > > regards > > > > __________________________________________________ > Do you Yahoo!? > Yahoo! Tax Center - forms, calculators, tips, more > http://taxes.yahoo.com/ > . __________________________________________________ Do you Yahoo!? Yahoo! Tax Center - forms, calculators, tips, more http://taxes.yahoo.com/ _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
