Well, there's your problem I think. If you just have a trunk port configured and plugged in, you'll only see broadcasts and such. What you need to do is SPAN a trunk port leading to another switch over to the port that Ntop is connected to. Of course, if you have more than one trunk port, you'll only see the traffic that passes over that particular trunk. And of course you won't see all the traffic within the switch either.....
Chris -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Willy, Andrew Sent: Friday, August 05, 2005 12:50 PM To: '[email protected]' Subject: RE: [Ntop] VLANs and NTOP Error in this post. Not using Cisco SPAN. Span is how I mirrored whatever VLAN to the ntop box. Now it is trunk port. Andrew -----Original Message----- From: Willy, Andrew [mailto:[EMAIL PROTECTED] Sent: Friday, August 05, 2005 11:16 AM To: '[email protected]' Subject: RE: [Ntop] VLANs and NTOP After reading this I tapped a trunk port. ntop obligingly began picking up VLAN tags, but the traffic statistics aren't correct. All the expected hosts appear but are reported as sending and receiving far less than when listening to an access port. For example, a host on VLAN 20 that on average moves a gig or so on hour has its traffic properly reported by ntop when the sensor is listening just to VLAN 20. When listening to a trunk port that includes VLAN 20, the host is seen but ntop only reports the host having moved 500k in the last three hours (which I know to be incorrect.) Thought I may have overwhelmed the little box ntop is running on, but I don't see that it has dropped any packets. Is it possible the NIC can't keep up? There is 250+ hosts transmitting on the vlans being monitoring. Using Cisco SPAN on a 100mb link. Andrew -----Original Message----- From: Burton Strauss [mailto:[EMAIL PROTECTED] Sent: Thursday, August 04, 2005 8:04 PM To: [email protected] Subject: RE: [Ntop] VLANs and NTOP Depends on your LAN setup. If ntop sees the tags (say it's tapping a trunk), then it reports them. If it doesn't see the VLAN tagged packets, it won't (can't) report them. -----Burton _______________________________________________ NOTICE OF CONFIDENTIALITY-The information in this email, including attachments, may be confidential and/or privileged and may contain confidential health information. This email is intended to be reviewed only by the individual or organization named as addressee. If you have received this email in error please notify Scottsdale Medical Imaging, an affiliate of Southwest Diagnostic Imaging, LTD immediately - by return message to the sender or to [EMAIL PROTECTED] - and destroy all copies of this message and any attachments. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Scottsdale Medical Imaging. Confidential health information is protected by state and federal law, including, but not limited to, the Health Insurance Portability and Accountability Act of 1996 and related regulations. _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop ********************************************************************** Confidential/Proprietary Note The information in this email is confidential and may be legally privileged. Access to this email by anyone other than the intended addressee is unauthorized. If you are not the intended recipient of this message, any review, disclosure, copying, distribution, retention, or any action taken or omitted to be taken in reliance on it is prohibited and may be unlawful. If you are not the intended recipient, please reply to or forward a copy of this message to the sender and delete the message, any attachments, and any copies thereof from your system. Thank you. Guardian Mtg Documents, Inc. 225 Union Boulevard, Suite 200 Lakewood, CO 80228. ********************************************************************** _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
