Trying to do what you want in a fully switched environment is not as easy as you might think. If you have common aggregation points, such as uplinks to server farms, WAN routers, etc. you can start there and catch most everything "important", but you still won't see "all" traffic an end node might be involved in - such as PtP with another end node on the LAN.
Netflow / xflow / IPFix / whatever might work OK if your equipment supports it. Not all classes of cisco switches do. Trying to SPAN/RSPAN EVERY port would be problematic at best. You can also try implementing RMON and using the feature therein, such as Topn. Yet another option would be configuring RMON alerts and events on each port based on throughput and/or doing SNMP collections on each port using Openview, MRTG, or any of the other ten thousand SNMP utils out there. I personally use a combination of most everything I mentioned. Each approach accomplishes a slightly different goal - it seems to work OK. Guess it all depends on exactly what you want to accomplish. Define your goals and implement the best solution(s). Gary >>> [EMAIL PROTECTED] 4/25/2006 5:09:46 AM >>> Hello We are running a fully switched Cisco network and want to be able to see who are the top talkers both on our site and on remote sites. Now I've just set Ntop up had it running for a few hours. Its looks to be gathering info. We don't have NetFlow or anything like that configured on our routers. So Ntop is really just running in its default config. Would I be right in think that: a) Ntop is only reporting traffic that is on the LAN segment, it can't tell what is going on at a remote site b) The traffic is sees is only stuff that come though its network interface. So its not really giving me a true reflection of how busy the LAN is? _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
