tcpdump host (your router ip / netflow source) or tcpdump udp 9001 (or whatever netflow is using)
I'd start with the first and see what is coming from your router. Maybe it's not sending to 9001? You should definitely see traffic from your routers if netflow is configured correctly there. Post those configs too, but make sure your route-cache is flow on the interfaces you want netflow info from. Gary >>> [EMAIL PROTECTED] 10/17/2006 11:22 AM >>> tcpdump, watching that NIC, is bringing back mostly igrp requests - what am I looking for as far as the netflows go? On 10/17/06, Gary Gatten <[EMAIL PROTECTED]> wrote: > Also, run > tcpdump, snoop, whatever and make sure your router(s) are sending > netflow to your ntop box. > > Gary _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop =========================================================================== "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
