Without the -i none parameter, ntop will also classify as local anything based on the network address/mask of the default (eth0) interface.
Although both ways ought to work, I've always had better results setting additional ranges for local traffic for netflow, using the field in the pluging, not the -m parameter. ----Burton -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Brown Sent: Monday, June 18, 2007 4:50 AM To: [email protected] Subject: [Ntop] local subnets Hi All, I'm struggling with local subnets and NetFlow, I wonder if anybody can point me in the right direction? I have Netflow being sent from several Cisco routers around our network, being collected by NTOP v.3.3rc_final on a i686-pc-linux-gnu box. The NetFlow settings: local Collector UDP is set Virtual NetFlow Interface is set 111.111.111.0/255.255.255.0 (for example) All other settings are default. I am starting NTOP with: /usr/local/bin/ntop -u ntop -a /var/log/ntop_access.log -s -m "111.111.111.0/255.255.224.0,222.222.222.0/255.255.192.0" -P /var/run/ntop However when viewing 'All Protocols' > 'Traffic' and selecting 'Remote Only' I only see very small blocks (almost all private space blocks): 10.61.10.207 172.21.80.12 172.21.10.10 10.152.6.80 172.21.233.6 192.10.10.237 172.21.103.14 172.21.237.9 192.168.129.28 172.21.21.16 But yet in 'Local Only' I can see almost any IP address appearing. Using my example IP blocks above, within Local I'd then see 199.199.199.199 or 212.212.212.212 all appearing as local, however I cannot see why they are being classified as local at all. Can anyone advise where I'm going wrong here?? Many thanks! -- Andy _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.5.472 / Virus Database: 269.9.4/860 - Release Date: 6/21/2007 5:53 PM _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
