You have multiple real interfaces and one netflow nic? I'm not sure which real nic/ip the virtual netflow nic will bind to. All of them maybe, or perhaps just the first one it finds. That's why netstat -a and sockstat -l will help determine if the netflow plugin process is running and listening on which ip and which port. Post the netflow plugin configs and I'll see if I can tell anything wrong. Also, run tcpdump, snoop, whatever and make sure your router(s) are sending netflow to your ntop box.
Gary >>> [EMAIL PROTECTED] 10/17/2006 10:41 AM >>> If only I could get it to work that easily. :) This is UDP, so the fact that my NIC isn't able to respond (all traffic from the ntop box is routed through a seperate NIC) shouldn't effect this, right? Perhaps I should just ask how NTop knows where to look for incoming flows. If I define a "virtual" netflow device and have mulitple NICs installed on the box, is it just looking for anything coming in on the configured port to all NICs? On 10/17/06, Gary Gatten <[EMAIL PROTECTED]> wrote: > There's a basic doc on the ntop home page and of course cisco has many. > It's really only a couple lines in the router and some point and clicks > on ntop. I adjusted the timeouts on the router so I get stream/session > details more frequently. In lower bandwidth situations you may want > less frequently - depends I guess. > > If you need specific help let me know and I'll try. > > Gary _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop =========================================================================== "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
