WRT to your ntop question, "Virtual Netflow Interface", is discussed in the docs/FAQ and the back traffic.
Quoting: Q. What's Virtual NetFlow Interface? A. Be sure and set it. It's important for pseudo-local classification, which affects L R reporting. You need to set it to the (network) and mask for the netFlow collector. So ntop knows 'where' the data is coming from. Q. 'splain some more, Lucy... A. OK. It's best to think of netFlow like this: The physical interface which is monitoring the packets is like a temperature probe you stick into a roast. Even though the display of the data can be right there at the probe, or the other end of a (long) wire, or somewhere entirely elsewhere via a wireless connection, the probe is monitoring at the tip. If it says 145F, that's the temperature of the meat - not the oven and not the kitchen. Similarly, the netFlow data ntop is receiving is based on the probe location. So, if you have a router and are monitoring a single interface to collect netFlow data, then the ip address you want to give to ntop is that of the router interface. If you are monitoring a router with more than one interface, you will need to give ntop ONE of those addresses and use the -m | --local-subnets option to tell it that the other addresses are also local. For a single probe, it's the address the probe would have if it were physically cabled instead of netFlow. For multiple probes, you'll need to also use the -m|--local-subnets option to tell ntop to treat the other ranges as local also. -----Burton > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of > Dunlop, Sean > Sent: Wednesday, January 07, 2004 9:57 PM > To: NTOP Mailing List (E-mail) > Subject: [Ntop] NTOP netflow plugin > > > > OK Im confused, too much reading. > > How many netflow probes can NTOP handle? > > I have 6 x 3550 ciscos all netflow logging to the one NTOP box - > is this ok? > > The netflow plugin asks for a "Virtual Netflow Interface" and I > dont know what to use for this address. > > Ive read some comments that it is the 'probes' address (if so > what mask? and what affect will different mask have?) > > If it is 'the probes' address then how do I apply this to the 6 > probes (or 3550 routing switches). > > My networks are: > 172.20.0.0 > 172.21.0.0 > 172.22.0.0 > 172.23.0.0 > 203.18.184.0 > 203.18.185.0 > 203.20.255.0 > > My netflow probes are: > Campus 1 (Users/Firewall/ISA/Servers) > C3550 172.20.0.2 -> HSRP 172.20.0.1 > C3550 172.20.0.3 -> HSRP 172.20.0.1 > C3550 172.20.0.4 > > Campus 2 (Users/Servers) > C3550 172.21.0.2 -> HSRP 172.21.0.1 > C3550 172.21.0.3 -> HSRP 172.21.0.1 > > Campus 3 (Users) > C3550 172.22.1.80 > > All six C3550 are netflow pumps to NTOP > All Vlans on all C3550 are "ip route-cache flow" > > What is the 'Virtual Netflow Interface' and mask? > > Why am I not seeing all the traffic - mostly seeing Telnet, SNMP > (Switch monitoring), DNS (nameserver), NBios-IP and DHCP-BOOTP > (not much though)? > > > Sean Dunlop > Network & Security Consultant > Department of Treasury & Finance > 200 St Georges Tce > Perth WA 6000 > Phone - (08) 9262 1405 > Fax - (08) 9262 1496 > Email - [EMAIL PROTECTED] > Web - www.dtf.wa.gov.au > > > > _______________________________________________ > Ntop mailing list > [EMAIL PROTECTED] > http://listgateway.unipi.it/mailman/listinfo/ntop > > _______________________________________________ > Ntop mailing list > [EMAIL PROTECTED] > http://listgateway.unipi.it/mailman/listinfo/ntop > _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
