Because you're seeing the traffic twice
Because you're seeing the traffic twice
It depends on where you have your ntop sensors.
+-----------+
| Switch & | +------+
| netFlow |--------network----------| ntop |
| generator | | +------+
+-----------+ hostX
Host X -> www3.abc.com
ntop sees it
1) From the switch via netFlow
2) Directly
But, if you haven't set the local host addresses on the netFlow plugin, #1
isn't classified as L->R.
Using netFlow, you need to be very careful not to duplicate traffic.
-----Burton
US-based commercial support for ntop:
http://www.ntopsupport.com
mailto:[EMAIL PROTECTED]
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Eric
Greenwood
Sent: Thursday, March 06, 2003 8:40 PM
To: [EMAIL PROTECTED]
Subject: [Ntop] IP L-R traffic stats vs Host Info traffic stats
I am wondering why the L-R, R-L traffic stats are always exactly 50% of the
detailed host traffic stats ??
In the L-R screen, data sent is 664, but in the host detail screen ( info
about host) traffic is doubled at 1.3KB. Same for the received traffic
counters.
This doubling is for every host listed, and short of counting the individual
flow records, I just cant figure it out.
Any ideas please ?
Eric
Local to Remote IP Traffic
Host IP Address Data Sent Data Rcvd
HOST1 x.x.x.210 664 0.6 % 5.9 KB 11.2 %
Info about host HOST1
IP Address x.x.x.210 [unicast]
Host Location Local (inside specified/local subnet)
Total Data Sent 1.3 KB/10 Pkts/0 Retran. Pkts [0%]
Total Data Rcvd 11.8 KB/29 Pkts/0 Retran. Pkts [0%
Eric Greenwood
_______________________________________________
Ntop mailing list
[EMAIL PROTECTED]
http://listgateway.unipi.it/mailman/listinfo/ntop
_______________________________________________
Ntop mailing list
[EMAIL PROTECTED]
http://listgateway.unipi.it/mailman/listinfo/ntop
