Not a clue, since you haven't posted the information about your environment, etc. The command line you DID post doesn't have -o | --no-mac...
If you assume that all I see is what's in the actual message(s) you post - and that I don't remember (nor refer back to) what you posted six messages ago, nor care (unless you're interested in paid support, which I do care about - a lot), you won't be far wrong. The next step is to capture a SMALL packet trace file that shows the flip/flop behavior. You may want to use the -B filter to limit ntop to monitoring a single host that's flipping. And then look at the tcpdump output to see what ntop's seeing. If it's ONLY related to netFlow, then look at using flow-tools (search the web) to capture the flows received from the switch. It may not have anything to do with the input, it also could be that ntop is mixing up the internal pointers. Again, only if we have a small trace that replicates the problem can we diagnose it. If you can't capture it, you'll have to do some massive instrumentation of the code via traceEvent() messages. -----Burton > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of > Fischman, Reuben > Sent: Monday, December 22, 2003 8:18 AM > To: '[EMAIL PROTECTED]' > Subject: RE: [Ntop] Misidentified ip addresses [same here] > > > Now, what would the answer to the SAME question be when using the no-mac > option doesn't affect the problem? Thats the case that I'm seeing. > > -----Original Message----- > From: Burton M. Strauss III [mailto:[EMAIL PROTECTED] > Sent: 22 December 2003 07:24 > To: [EMAIL PROTECTED] > Subject: RE: [Ntop] Misidentified ip addresses [same here] > > > Same answer - try turning off the MAC address switch - read man ntop and > docs/FAQ... > > -o | --no-mac > ntop is a hybrid layer 2/3 network monitor. That is, it uses both the > lower level, physical device address - the MAC (Media Access Control) > address - and the higher level, logical, tcp/ip address (the familiar > www.ntop.org or 131.114.21.9 address). This allows ntop to link the > logical addresses to a physical machine with multiple addresses (This > occurs with virtual hosts or additional addresses assigned to the > interface, etc.) to present consolidated reporting. > > This parameter specifies that ntop should not trust the MAC addresses > but just use the IP addresses. > > Normally, since the MAC address must be globally unique, the dual > nature of ntop is a benefit and provides far better information about > the network than is available via a pure layer 2 or pure layer 3 moni- > tor. > > Under certain circumstances - whenever ntop is started on an interface > where MAC addresses cannot be really trusted - you may require this > option. > > Situations which may require this option include port/VLAN mirror, > some cases with switches and spanning tree protocol, and (reportedly) > some specific models of Ethernet switches which re-write MAC addresses > of the packets they process. Normally, you discover that this option > is necessary when you observe that hosts seem to change their > addresses or information about different machines get lumped together. > > Note that with this option, information which is dependent upon the > MAC addresses (non tcp/ip protocols like IPX) will not be collected > nor displayed. > > -----Burton > > > -----Original Message----- > > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Egger > > Lothar > > Sent: Monday, December 22, 2003 3:21 AM > > To: '[EMAIL PROTECTED]' > > Subject: AW: [Ntop] Misidentified ip addresses [same here] > > > > > > hi > > > > wrong entries here too! > > > > my startup: > > /usr/local/bin/ntop -u ##### -i eth0 -w3000 --sticky-hosts --mapper > > --enable-external-tools > > --domain ##### -p /usr/local/etc/ntop.proto.all -P /usr/local/ntop/var > > > > -----Urspr�ngliche Nachricht----- > > Von: Fischman, Reuben [mailto:[EMAIL PROTECTED] > > Gesendet: Friday, December 19, 2003 5:43 PM > > An: '[EMAIL PROTECTED]' > > Betreff: [Ntop] Misidentified ip addresses > > > > > > In my list of hosts and who they're communicating with, I have several > > entries for the same host. For example: > > > > I0.0 bps 0.0 bps 0.0 bps 0.0 Pkts/sec 0.0 Pkts/sec 0.0 Pkts/sec > > 172.16.137.50 </172.16.145.254.html> 0.0 bps 0.0 bps 0.0 bps > 0.0 Pkts/sec > > 0.0 Pkts/sec 0.0 Pkts/sec 172.16.137.50 </172.16.146.254.html> > 0.0 bps 0.0 > > bps 0.0 bps 0.0 Pkts/sec 0.0 Pkts/sec 0.0 Pkts/sec 172.16.137.50 > > </172.16.136.151.html> 0.0 bps 0.0 bps 0.0 bps 0.0 Pkts/sec 0.0 > > Pkts/sec 0.1 > > Pkts/sec 172.16.137.50 </172.16.136.240.html> > > > > > > As can be seen from the snapshot above, the URLs actually point to hosts > > other than what the display shows. > > > > It gets even more bizarre when I click on one of those hosts: > > Info about 172.16.137.50 <http://172.16.137.50/> > > IP Address 172.16.145.254 [unicast] > > > > It displays a different IP Address than what the "info about" title > > displays. > > > > This running off a netflow collector. This problem also > extends to trying > > to open up the RRD graphs, and causes URL security to take effect. > > > > What might I have configured incorrectly here? Below is a copy of the > > startup command that was used (based on settings in the > ntop.conf file and > > how it parsed out) > > > > /usr/bin/ntop -i none --user #### --daemon --db-file-path > > /usr/local/share/ntop --domain ##########-i none -M -m 172.16.0.0/16 > > --trace-level 3 --use-syslog=local3 --http-server 3000 > > --disable-schedyield > > -d > > Thanks in advance > > > > Reuben > _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
