SPANning will get you slightly more info, which may or may not be useful. Host Fingerprinting, tcp handshake latency, some other minor stuff. The main thing is it will require more power on your switch and nTop box as you'll be processing every frame. If you have the horsepower and are dealing with < 50-80Mb/s, should be no problem.
I'm still willing to fly out and look at your config :) Gary >>> [EMAIL PROTECTED] 10/24/2006 2:01 PM >>> I re-installed 3.1 (which came with the SuSE CDs) and have tried again to configure netflows, unsuccessfully. What are the differences between what you can see with a netflow and what you can see with just a NIC plugged into a span or rspan port? _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop =========================================================================== "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
