1. http://www.gmane.org - it's in the docs/FAQ for ntop.
2. 'Cooked' sockets are unique to Linux. They're not quite raw, but they're not quite a real protocol level socket library, they're something in between. Don't let the terminology scare you. It doesn't sound like an ntop problem, it's sounds like a problem with the underlying packet capture library (libpcap) that doesn't support the arptype. But since you've cut & pasted only part of the log message, it's hard to tell. If you google for arptype "not supported by libpcap" -- you'll see some entries referring to using an old libpcap. So updating might help. If you want to pursue this further, use the ntop problem report form - you should be able to get ntop up long enough to generate the skeleton if you don't point ntop at the problem interface. However - There's no support in ntop right now for HDLC. And you need to understand how you're using 'HDLC'. HDLC covers a lot of ground. HDLC operates at the same network layer as TCP/IP, it's a complete layer 2 communications protocol. See, for example, http://www2.rad.com/networks/1994/hdlc/hdlc.htm and http://members.tripod.com/~vkalra/hdlc.html While it's conceptually feasible to extend ntop to support another layer 2 and higher protocol, it would be very difficult to coerce into ntop's Ethernet/TCPIP model of MAC and IP addresses. Difficult, but not impossible. Precisely what reports and such would be available would have to be determined. HDLC can also be used to encapsulate IP traffic for point to point links. If that's the situation, then (assuming you can update to a libpcap that supports the interface), we could train ntop to ignore the HDLC headers and just process the IP portion (like we do today with PPP and PPPoE). HDLC is a dying protocol - so if you're not willing to sponsor development, I doubt anyone else will. I'll warn you, that either way, this will entail a fair amount of work, just to get to the point of giving you a cost quotation. If you're interested in sponsoring the development, contact me off list. -----Burton US-based commercial support for ntop: http://www.ntopsupport.com mailto:[EMAIL PROTECTED] Search the ntop mailing lists at gmane: http://search.gmane.org HowTo Ask for Help at http://snapshot.ntop.org/faq.php#83 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Adam Henry Sent: Friday, June 06, 2003 11:30 AM To: [EMAIL PROTECTED] Subject: [Ntop] Warning: arptype 15 not supported by libpcap - falling back to cooked socket Greetings, First I must mention that I have failed in my search for a list archive. Please forgive me if I ask a question in a manner that isn't consistent with the list's expectations. I come before you to discover how I can listen to traffic pulled from an HDLC encoded line. Specifically, the adaptor is a 600/800 8-port T1 WANic (6-0073 rev. A) made by SDL Communications Inc. The error I receive is below, and Ntop fails to start: Warning: arptype 513 not supported by libpcap - falling back to cooked socket Another error for using Frame Relay: Warning: arptype 15 not supported by libpcap - falling back to cooked socket What can I do to help? Must I obtain the cooperation of the vendor, or am I able to get this working myself? This could best be addressed to those in -dev, but I wanted to pass it through the general list first to gather opinions. Cordially, Adam _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
