OK Im confused, too much reading. How many netflow probes can NTOP handle?
I have 6 x 3550 ciscos all netflow logging to the one NTOP box - is this ok? The netflow plugin asks for a "Virtual Netflow Interface" and I dont know what to use for this address. Ive read some comments that it is the 'probes' address (if so what mask? and what affect will different mask have?) If it is 'the probes' address then how do I apply this to the 6 probes (or 3550 routing switches). My networks are: 172.20.0.0 172.21.0.0 172.22.0.0 172.23.0.0 203.18.184.0 203.18.185.0 203.20.255.0 My netflow probes are: Campus 1 (Users/Firewall/ISA/Servers) C3550 172.20.0.2 -> HSRP 172.20.0.1 C3550 172.20.0.3 -> HSRP 172.20.0.1 C3550 172.20.0.4 Campus 2 (Users/Servers) C3550 172.21.0.2 -> HSRP 172.21.0.1 C3550 172.21.0.3 -> HSRP 172.21.0.1 Campus 3 (Users) C3550 172.22.1.80 All six C3550 are netflow pumps to NTOP All Vlans on all C3550 are "ip route-cache flow" What is the 'Virtual Netflow Interface' and mask? Why am I not seeing all the traffic - mostly seeing Telnet, SNMP (Switch monitoring), DNS (nameserver), NBios-IP and DHCP-BOOTP (not much though)? Sean Dunlop Network & Security Consultant Department of Treasury & Finance 200 St Georges Tce Perth WA 6000 Phone - (08) 9262 1405 Fax - (08) 9262 1496 Email - [EMAIL PROTECTED] Web - www.dtf.wa.gov.au _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
