Michael Handiboe wrote: > > Question 1: Is it true that NTOP must be plugged into a hub to see > "all" network traffic?
No , its not necesary , you could mirror a vlan/group/port to a specified port(if switch supports this feature) of the switch then you listen all (especified) traffic on ntop. > > Question 2: Does anyone else think of switches like my boss does? your bosss only know that the only traffic that you can see with ntop/tcpdump (sniffers ) is only layer 2/3 broadcasts if you only conect a pc with ntop...or sniffer... I think he is little confused about switches... mirroring ports is also avaiable to see all traffic of a vlan, group or specified port.... or you can use a ettercap sniffer and you can spy all traffic beetween ports of a switch (by mac poisoning,etc) without configure it the mirroring but don 't do it !!!!!!at least you really know what you are doing!!!!!!! Many people thinks that you can' t see conversation (sniffing)in a switched enviroment.. like many people do in a hub enviroment ...but its a lie...big one... > > Question 3: Anyone willing to comment as to why NetProbe sees much > more than NTOP on our 3Com switch? I don t really beleve that you can see more ,than ntop...The Ntop that you have loose packets????(hardware problem...?) > > Thanks to anyone willing to take this one. Feel free to call names > and be mean, if necessary. > _______________________________________________ > Ntop mailing list > [EMAIL PROTECTED] > http://listgateway.unipi.it/mailman/listinfo/ntop -- Diego Carlos Boccardo Divisi�n Monitoreo y Control DEPARTAMENTO INGENIERIA DE COMUNICACIONES 4347-3131 Virtual: 3131 _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://listgateway.unipi.it/mailman/listinfo/ntop
