--On Tuesday, June 07, 2005 6:24 PM -0500 Burton Strauss
<[EMAIL PROTECTED]> wrote:
Well of course - ntop puts the interface into promiscuous mode... it has
to. But it doesn't do anything beyond that - if a switch is sending you
bogus traffic, that's a problem with the switch (probably overflowed it's
MAC address tables - either that or it's seen the same address on
multiple ports - stuff like that causes a switch to operate as a hub so
it doesn't lose traffic - it's your problem on the device end to throw
away junk).
Ok, thanks, just wanted to confirm that. I'm not up on the latest switch
protocols and just wanted to make sure ntop wasn't exercising a feature I
didn't know about. ;)
That tells me that either the switch is misconfigured or somebody slipped
me a hub. (This is in an office halfway across the continent, so I have no
idea what's truly outside my box except what the hoster tells me and what I
can infer from the traffic.) I've opened a trouble ticket.
Go read the driver code... :-;
Hehe, yep. That was probably going to be my next stop, downloading libpcap
and looking at its interaction with the Linux stack. Unless it turns out
that the hoster just fat-fingered something.
_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
