Not sure without more info on the physical network layout... Thoughts:
Are you seeing the traffic before or after any NAT?? If they're using the same physical interface, then ntop is correct. It's multi-homed. Look into the -o | --no-mac parameter - it will lose some information, but it uses only the ip addresses. -----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Darren Bentley Sent: Tuesday, March 25, 2003 6:29 PM To: [EMAIL PROTECTED] Subject: [Ntop] clumping ips together, showing as multihomed? Hello, Our main gateway router: ntop-2.1.90-0 / RH 7.3 Here is my ntop.conf: -u ntop -P /usr/share/ntop -i eth1 -w 0 -W 3005 -m 204.244.XXX.0/24,204.244.XXX.0/24,204.244.XXX.0/24,204.244.XXX.0 -d We have 3 dial-up communities and each are showing as 1 ip in NTOP. Why is it clumping them all together? It shows the "multihomed" image beside the address. Any help would be appreciated. Thanks, - Darren _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
