Burton Strauss wrote: > Nope. Smurf has nothing to do with ntop, since except in reply to web > requests, ntop doesn't send anything. So worry about smurf and a > compromised box, not ntop... Right. So this means that a computer somewhere is compromised somehow and is smurfing other machines. And it's more or less impossible to tell which machine is the culprit, right?
> In fact it's absolutely necessary for ntop to place interfaces in > promiscuous mode (just like snort, etc.) - otherwise ntop doesn't see all > the traffic. Read docs/FAQ. Yes, I get it. But still. Putting ethx in promisc means that it reads all packages passing by. Does that leave the machine more vulnerable? Does it change the traffic in any way? Should I only poll one interface, given my configuration? Thank you for your quick answer! //Niels _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
