RE: [Ntop] Newb Question - adding protocols and filtering them

Burton Strauss Thu, 31 Mar 2005 09:16:32 -0800

Title: Message

Quoting from the ntop man page:

       -p | --protocols
        This parameter is used to specify the TCP/UDP protocols that ntop will monitor. The format is <label>=<protocol list> [,
        <label>=<protocol list>], where label is used to symbolically identify the <protocol list>. The format of <protocol list>
        is <protocol>[|<protocol>], where <protocol> is either a valid protocol specified inside the /etc/services file or a
        numeric port range (e.g. 80, or 6000-6500).

A simple example is --protocols="HTTP=http|www|https|3128,FTP=ftp|ftp-data", which reduces the protocols displayed on the
"IP" pages to three:

        Host                      Domain Data          HTTP   FTP   Other IP
        ns2.attbi.com             <flag> 954 63.9 %      0     0        954
        64.124.83.112.akamai.com <flag> 240 16.1 %    240     0          0
        64.124.83.99.akamai.com   <flag> 240 16.1 %    240     0          0
        toolbarqueries.google.com <flag>   60 4.0 %      60     0          0

If the <protocol list> is very long you may store it in a file (for instance protocol.list). To do so, specify the file
name instead of the <protocol list> on the command line. e.g. ntop -p protocol.list

If the -p parameter is omitted the following default value is used:

          Peer-to-Peer Protocols
          ----------------------
          Gnutella=6346|6347|6348
          Kazaa=1214
          WinMX=6699|7730
          DirectConnect=0      Dummy port as this is a pure P2P protocol
          eDonkey=4661-4665

          Instant Messenger
          -----------------
          Messenger=1863|5000|5001|5190-5193

        NOTE: To resolve protocol names to port numbers, they must be specified in the system file used to list tcp/udp protocols
        and ports, which is typically /etc/services file. You will have to match the names in that file, exactly.   Missing or
        unspecified (non-standard) ports must be specified by number, such as 3128 in our examples above.

If you have a file named /etc/protocols, don't get confused by it, as that's the Ethernet protocol numbers, which are not
what you're looking for.

-----Burton

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tim Weid
Sent: Thursday, March 31, 2005 9:16 AM
To: [email protected]
Subject: RE: [Ntop] Newb Question - adding protocols and filtering them

Look… I am NOT a unix/open source person. You are probably aware of this by now. I am sure there are many things in my world you would struggle with.

We run a Windows/Cisco shop, I do IP phones, Call manager, Unity, wireless, routers, Sniffer Distributed, switches, firewalls and Exchange. I am a little out of my element here. Please be patient.

The documentation in the man ntop does not show me a list format. It shows me a command line format and then says if you want to put it in a list type this.

There is no list example. Also in matching the list to the services file, which one? There is one in the \program files\ntop-Win32\ directory and there is one in system32\drivers\etc.

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Burton Strauss
Sent: Thursday, March 31, 2005 7:27 AM
To: [email protected]
Subject: RE: [Ntop] Newb Question - adding protocols and filtering them

Use the RIGHT format, maybe? It's not /etc/services, it's the -p format as documented in man ntop.

-----Burton

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tim Weid
Sent: Thursday, March 31, 2005 7:52 AM
To: [email protected]
Subject: RE: [Ntop] Newb Question - adding protocols and filtering them

Ok got it to read by shutting the service down manually (there is only one instance running) and then putting in the ntop /c –p qcsi.list

Now it is saying unknown protocols. I thought it was a format problem but the process I used to create the list was to copy the services.list and edit and rename it to qcsi.list

Error is: PROTO_INIT: unknown protocol ‘ftp 21/tcp ‘. It has been ignored.

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Burton Strauss
Sent: Thursday, March 31, 2005 6:43 AM
To: [email protected]
Subject: RE: [Ntop] Newb Question - adding protocols and filtering them

Yes.

gdbm is a one-write OR multiple-reader db. That message indicates that another process has the database file open or it can't be created. If you look at docs/FAQ there are two choices:

* Another ntop already running

* Some sort of file system problem (non-existent directory, permissions, etc.)

So either -P is wrong, OR another ntop is running. Hence why I suggested you check to make sure that the service is stopped before you run interactively (ntop /c).

-----Burton

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tim Weid
Sent: Thursday, March 31, 2005 7:30 AM
To: [email protected]
Subject: RE: [Ntop] Newb Question - adding protocols and filtering them

Am I missing something? Or is this a bug and you can’t add protocols with the WIN32 version. The /c switch should do the restart correct?

Tried to rename my existing file to qcsi.list, put it in the ntop-win32 directory and ran ntop /c –p qcsi.list and it get the same error. Put the file at the root of C: and tried ntop /c –p c:\qcsi.list and get the error as well

***FATAL_ERROR***… open of C:\program files\ntop-win32/prefcache.db failed: can’t be writer

Possible solution: please use ‘-P <Directory>

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Burton Strauss
Sent: Wednesday, March 30, 2005 2:55 PM
To: [email protected]
Subject: RE: [Ntop] Newb Question - adding protocols and filtering them

Yes - read the docs/FAQ file, it shows the values.

------Burton

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tim Weid
Sent: Wednesday, March 30, 2005 9:09 AM
To: [email protected]
Subject: RE: [Ntop] Newb Question - adding protocols and filtering them

Problem is there is no Protocols.list file in the Win32 version. Is the default list compiled in the app?

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of jacengel
Sent: Wednesday, March 30, 2005 8:53 AM
To: [email protected]
Subject: RE: [Ntop] Newb Question - adding protocols and filtering them

rename the file to protocol.list (seems it does not accept .txt ) and run

Ntop /c -p c:\protocol.list

Place the file protocol.list in Ntopwin32 directory and run Ntop /c -p protocol.list

cheers

Jac

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tim Weid
Sent: woensdag 30 maart 2005 15:35
To: [email protected]
Subject: [Ntop] Newb Question - adding protocols and filtering them

Just bought NTOP and need to add some protocols. I have tried using the list but I get syntax errors. I really need to track streaming protocols, and MAPI clients.

I use:

Ntop –p c:\lists.txt

And all I get is the error

What is the correct syntax and where is the default folder location?

_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop

RE: [Ntop] Newb Question - adding protocols and filtering them

Reply via email to