If all you want to monitor are the links, yes.
H hub, S switch, less typing
<externalrouter>
|
H---->ntop(1)
|
backbone-S----servers
| |
(2)ntop<---H H--->ntop(3)
| |
S2 S3
| |
users users
(1) Sees all traffic to/from the external router
(2) Sees all traffic to/from S2's users and
* S3's users
* S1's users (e.g. servers)
* The internet
(3) is left as a exercise for the reader
The problem is that you're now seeing traffic twice ... (S2)user-internet is
seen by both (2) and (1)
To fix that either drop (1) (Meaning you don't see server<->internet)
or add a filter on (1) to ignore traffic you've already seen.
In neither case do you see intra-switch traffic. However, if you have a
span/mirror/rap port on S1, you could use that and will see that collection
of intra-switch traffic.
But for many users, the 3ports w/ filter is good enough.
-----Burton
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of
> Michael Handiboe
> Sent: Friday, March 26, 2004 12:18 PM
> To: [EMAIL PROTECTED]
> Subject: Re: [Ntop] plea for information::Update
>
>
> So, with my 3 switches, I would need 2 hubs, aye?
>
>
>
> > +----------+
> > | Backbone |
> > | Switch |
> > +----------+
> > |
> > |
> > +----------+
> > | Switch |
> > +----------+
> >
> > Into this:
> >
> > +----------+
> > | Backbone |
> > | Switch |
> > +----------+
> > |
> > +---+
> > +HUB+------------------>ntop (***UNNUMBERED PORT***)
> > +---+
> > |
> > +----------+
> > | Switch |
> > +----------+
> >
> > -----Burton
>
> _______________________________________________
> Ntop mailing list
> [EMAIL PROTECTED]
> http://listgateway.unipi.it/mailman/listinfo/ntop
>
_______________________________________________
Ntop mailing list
[EMAIL PROTECTED]
http://listgateway.unipi.it/mailman/listinfo/ntop
