Your boss is an PHB. Or an idiot. Or not playing with a full deck... Has lost the fries from his happy meal... Is a 10 story elevator in a 20 story building... You pick.
That said, how about showing him the articles in docs/FAQ on Switches. At 110 pages, I didn't write it for MY health... Q. ntop doesn't report any traffic at all And the 3 or 4 after Q. So what's a hub vs. a Switch FWIW, I have a 3C16985XM at home too. It's a great unit (after I replaced the fans so it doesn't sound like a 747 spooling up for takeoff). However, it does not provide all of the features of a Cisco Span port. In fact, 3Com's roving analysis port provides more and less. More in that you can copy the contents of any single ports, and if you're fiendishly clever, you can dedicate a port to that mix, which allows you to mix together stuff from the switch's backplane in ways that should curl your toes. Less in that you don't have the control of what's on the RA/Span port at the protocol level. But he's wrong - switches have backplanes, but nobody brings that out to the end user. A switch may have a 1, 2 or 4 Gbps backplane/fabric - there's no way to stuff that down a 100 Mbsp port... Specific answers: 1. No 2. Only people with Cisco taste and 3Com budgets 3. not without seeing your command line... but when you say "listening for all the data I am interested in" I worry. You probably have a more restrictive filter on ntop than on nProbe. And when you say "traverses the NTOP machine", I also worry - nothing should be traversing the machine, it should just be listening. -----Burton > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of > Michael Handiboe > Sent: Monday, March 15, 2004 5:01 PM > To: [EMAIL PROTECTED] > Subject: [Ntop] plea for information > > > NTOPsters, > > I joined today .... under pressure. > > I have been working with NTOP for a while, trying to get it to see > "all" network traffic on our network. My boss has concluded that > all NTOP can see is broadcast traffic and therefore he has a low opinion > of what I believe to be a fine product (I'm not so quick to accuse PhD's > of lousy software, Luca) and I have discovered that, by-golly, NTOP > does report what it sees and it only sees what traverses the computer > system it's actually running on. (hang on ....) > > My boss is also convinced that all switches (yeah ...) have > the feature where all traffic occuring via that switch will be visible to > all ports on the switch, and, since NTOP is plugged into a switch > (a 3Com 3300TM), all traffic on that switch should be reported > by NTOP. He uses the word "backplane" a lot. > > The NTOP machine is Fedora Core 1 with the "pre1" rpm from > SourceForge. I have it listening for all the data I am interested in > and I know that it can see whatever traverses the NTOP machine. > I also presently have the NIC forced to promiscous mode. > > I also have a separate machine running > NetProbe, it's on Slackware 9.1 and the NIC is not in > promiscous mode. > > Both machines are plugged into the same 3Com switch. > > NetProbe sees much more traffic/activity. > > Question 1: Is it true that NTOP must be plugged into a hub to see > "all" network traffic? > > Question 2: Does anyone else think of switches like my boss does? > > Question 3: Anyone willing to comment as to why NetProbe sees much > more than NTOP on our 3Com switch? > > Thanks to anyone willing to take this one. Feel free to call names > and be mean, if necessary. > _______________________________________________ > Ntop mailing list > [EMAIL PROTECTED] > http://listgateway.unipi.it/mailman/listinfo/ntop > _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
