Now, what would the answer to the SAME question be when using the no-mac option doesn't affect the problem? Thats the case that I'm seeing.
-----Original Message----- From: Burton M. Strauss III [mailto:[EMAIL PROTECTED] Sent: 22 December 2003 07:24 To: [EMAIL PROTECTED] Subject: RE: [Ntop] Misidentified ip addresses [same here] Same answer - try turning off the MAC address switch - read man ntop and docs/FAQ... -o | --no-mac ntop is a hybrid layer 2/3 network monitor. That is, it uses both the lower level, physical device address - the MAC (Media Access Control) address - and the higher level, logical, tcp/ip address (the familiar www.ntop.org or 131.114.21.9 address). This allows ntop to link the logical addresses to a physical machine with multiple addresses (This occurs with virtual hosts or additional addresses assigned to the interface, etc.) to present consolidated reporting. This parameter specifies that ntop should not trust the MAC addresses but just use the IP addresses. Normally, since the MAC address must be globally unique, the dual nature of ntop is a benefit and provides far better information about the network than is available via a pure layer 2 or pure layer 3 moni- tor. Under certain circumstances - whenever ntop is started on an interface where MAC addresses cannot be really trusted - you may require this option. Situations which may require this option include port/VLAN mirror, some cases with switches and spanning tree protocol, and (reportedly) some specific models of Ethernet switches which re-write MAC addresses of the packets they process. Normally, you discover that this option is necessary when you observe that hosts seem to change their addresses or information about different machines get lumped together. Note that with this option, information which is dependent upon the MAC addresses (non tcp/ip protocols like IPX) will not be collected nor displayed. -----Burton > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Egger > Lothar > Sent: Monday, December 22, 2003 3:21 AM > To: '[EMAIL PROTECTED]' > Subject: AW: [Ntop] Misidentified ip addresses [same here] > > > hi > > wrong entries here too! > > my startup: > /usr/local/bin/ntop -u ##### -i eth0 -w3000 --sticky-hosts --mapper > --enable-external-tools > --domain ##### -p /usr/local/etc/ntop.proto.all -P /usr/local/ntop/var > > -----Urspr�ngliche Nachricht----- > Von: Fischman, Reuben [mailto:[EMAIL PROTECTED] > Gesendet: Friday, December 19, 2003 5:43 PM > An: '[EMAIL PROTECTED]' > Betreff: [Ntop] Misidentified ip addresses > > > In my list of hosts and who they're communicating with, I have several > entries for the same host. For example: > > I0.0 bps 0.0 bps 0.0 bps 0.0 Pkts/sec 0.0 Pkts/sec 0.0 Pkts/sec > 172.16.137.50 </172.16.145.254.html> 0.0 bps 0.0 bps 0.0 bps 0.0 Pkts/sec > 0.0 Pkts/sec 0.0 Pkts/sec 172.16.137.50 </172.16.146.254.html> 0.0 bps 0.0 > bps 0.0 bps 0.0 Pkts/sec 0.0 Pkts/sec 0.0 Pkts/sec 172.16.137.50 > </172.16.136.151.html> 0.0 bps 0.0 bps 0.0 bps 0.0 Pkts/sec 0.0 > Pkts/sec 0.1 > Pkts/sec 172.16.137.50 </172.16.136.240.html> > > > As can be seen from the snapshot above, the URLs actually point to hosts > other than what the display shows. > > It gets even more bizarre when I click on one of those hosts: > Info about 172.16.137.50 <http://172.16.137.50/> > IP Address 172.16.145.254 [unicast] > > It displays a different IP Address than what the "info about" title > displays. > > This running off a netflow collector. This problem also extends to trying > to open up the RRD graphs, and causes URL security to take effect. > > What might I have configured incorrectly here? Below is a copy of the > startup command that was used (based on settings in the ntop.conf file and > how it parsed out) > > /usr/bin/ntop -i none --user #### --daemon --db-file-path > /usr/local/share/ntop --domain ##########-i none -M -m 172.16.0.0/16 > --trace-level 3 --use-syslog=local3 --http-server 3000 > --disable-schedyield > -d > Thanks in advance > > Reuben > _______________________________________________ > Ntop mailing list > [EMAIL PROTECTED] > http://listgateway.unipi.it/mailman/listinfo/ntop > _______________________________________________ > Ntop mailing list > [EMAIL PROTECTED] > http://listgateway.unipi.it/mailman/listinfo/ntop > _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
