Nothing intentional. It's probably an artifact of the listen()/select()/bind() et al calls - that you can only have ONE active connection to a port at a time. It's most likely the last, but I guess it could be any - being undefined behavior and all.
Chris is right - if you need to differentiate among netFlow streams, then send them to different ports. Otherwise, just configure ONE listener and it will 'magically' aggregate everything. -----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Chris Moore Sent: Thursday, March 31, 2005 3:39 PM To: [email protected]; MT Morales Subject: RE: [Ntop] Multiple Virtual Netflow interfaces problem The main difference between virtual interfaces is by the port. Data gets sent to a virtual interface, THEN gets analysed. So when you configure several virtual interfaces with the same port, Ntop just picks one and sends all the recieved data to it, then analyses it. The others just error out or get ignored - not sure what mechanism is used. C -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of MT Morales Sent: Thursday, March 31, 2005 1:53 PM To: [email protected]; [email protected] Subject: [Ntop] Multiple Virtual Netflow interfaces problem I'm using ntop to analyze netflow data only. The instructions to configure Netflow are very straight forward from the netflow plugin menu, however I have problems when more than one virtual interface is configured and there is only ONE (cisco core switch) sending netflow to ntop: Netflow activity is only reported for the last interface configured. So far I can only on virtual netflow interface work per netflow sender. Let me explain what I'm trying to accomplish (perhaps I'm asking too much): - Send netflow data(version 5) from ONE Cisco core device - Configure Ntop virtual interfaces for as many network segments as this Cisco device is configured for (currently no more than 4). - Have Ntop split the netflow data for analysis through its virtual interface switching so each interface reports on every segment. After configuring the above, I found that only the last interface configured is the one reporting netflow activity. (verified by checking: rrd graphs truncated, ntop log show netflow received on last "deviceId=4" only, editing ntop netflow interface plugin for previous three shows no netflow stats) Again, so far I've only succeeded by having multiple Cisco devices sending netflow data to ntop on different destination udp ports. I tried this using compiled ntop 3.1.1 (from cvs March 29, 05) and using ntop rpm 3.1 for Linux, both with the same result. Any suggestions or recommendations will be appreciated. -Tomas _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop ********************************************************************** Confidential/Proprietary Note The information in this email is confidential and may be legally privileged. Access to this email by anyone other than the intended addressee is unauthorized. If you are not the intended recipient of this message, any review, disclosure, copying, distribution, retention, or any action taken or omitted to be taken in reliance on it is prohibited and may be unlawful. If you are not the intended recipient, please reply to or forward a copy of this message to the sender and delete the message, any attachments, and any copies thereof from your system. Thank you. Guardian Mortgage Documents, Inc. 225 Union Boulevard, Suite 200 Lakewood, CO 80228. ********************************************************************** _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
