Burton and Chris are correct. Many thanks.
Andrew -----Original Message----- From: Burton Strauss [mailto:[EMAIL PROTECTED] Sent: Friday, August 05, 2005 1:14 PM To: [email protected] Subject: RE: [Ntop] VLANs and NTOP Well, that's probably your problem. Think basic switch logic: What is sent out a trunk? Only those packets which the switch knows need to - which would be learned MAC addresses on that port and broadcasts... -----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Willy, Andrew Sent: Friday, August 05, 2005 1:50 PM To: '[email protected]' Subject: RE: [Ntop] VLANs and NTOP Error in this post. Not using Cisco SPAN. Span is how I mirrored whatever VLAN to the ntop box. Now it is trunk port. Andrew -----Original Message----- From: Willy, Andrew [mailto:[EMAIL PROTECTED] Sent: Friday, August 05, 2005 11:16 AM To: '[email protected]' Subject: RE: [Ntop] VLANs and NTOP After reading this I tapped a trunk port. ntop obligingly began picking up VLAN tags, but the traffic statistics aren't correct. All the expected hosts appear but are reported as sending and receiving far less than when listening to an access port. For example, a host on VLAN 20 that on average moves a gig or so on hour has its traffic properly reported by ntop when the sensor is listening just to VLAN 20. When listening to a trunk port that includes VLAN 20, the host is seen but ntop only reports the host having moved 500k in the last three hours (which I know to be incorrect.) Thought I may have overwhelmed the little box ntop is running on, but I don't see that it has dropped any packets. Is it possible the NIC can't keep up? There is 250+ hosts transmitting on the vlans being monitoring. Using Cisco SPAN on a 100mb link. Andrew NOTICE OF CONFIDENTIALITY-The information in this email, including attachments, may be confidential and/or privileged and may contain confidential health information. This email is intended to be reviewed only by the individual or organization named as addressee. If you have received this email in error please notify Scottsdale Medical Imaging, an affiliate of Southwest Diagnostic Imaging, LTD immediately - by return message to the sender or to [EMAIL PROTECTED] - and destroy all copies of this message and any attachments. Please note that any views or opinions presented in this email are solely those of the author and do not necessarily represent those of Scottsdale Medical Imaging. Confidential health information is protected by state and federal law, including, but not limited to, the Health Insurance Portability and Accountability Act of 1996 and related regulations. _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
