Hmmmm - sounds like you've done the basics and then some. Have you checked the netflow statistics for each instance to ensure they're both receiving the same number of flows, etc? Maybe post some of your config info - I've had typo's before that 5 people missed. After dozens of hours trying to fix it someone discovers a missing "." or whatever.
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Redder,Greg Sent: Tuesday, May 06, 2008 11:24 AM To: [email protected] Subject: Re: [Ntop] Network Load graphs Hi Gary, et al, Based on my past experiences, I was a little afraid/embarrassed to even post again ;-) However, this was different. I have two identical processes running - receiving identical streams of flows from the router and one just looks at 129.82.236.0/22 and one looks at all of 129.82.0.0/16. The one for the /22 has more traffic than the one for the /16 when you look at the network load graphs! It is possible that the data files are corrupt - I can try clearing things out and checking again, but I've actually duplicated this problem on several different ntop boxes and different source routers(I have one for each of our 5 core routers) and I see the same results. I'm pretty sure, with your previous help, I have the routers configured properly as I analyzed one of the network's traffic to ensure the proper throughput. It seems to be right each time....it's just that this problem really made me start to question it again. I'll have to look at host clusters too - haven't done that yet ;-) Thanks again and as always!! --Greg -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary Gatten Sent: Tuesday, May 06, 2008 9:54 AM To: [email protected] Subject: Re: [Ntop] Network Load graphs Hey Greg - same issue again huh? The graphs can definitely be frustrating - they seem to have various and sometime numerous issues. Just for kicks, how about wiping the data files/directories and restarting? Maybe something is corrupted? If you want the existing data you can always rename it instead of wiping it. If I remember you have quite a complex config. Are you certain netflow is configured correctly everywhere - capturing the right traffic in the directions you want on the interfaces you want? Have you tried "Host Clusters"? Might give you some of what you want - generic "network wide" type stats - convenient for grouping and stuff. G -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Redder,Greg Sent: Tuesday, May 06, 2008 8:51 AM To: [EMAIL PROTECTED] Subject: [Ntop] Network Load graphs Hello, I'm running ntop3.2 compiled from code on an FC6 box. I have several ntop processes running one one box and listening for flows on separate ports. This is to provide separate information for "subnets" under our larger Class B network range. For example, we are interested in seeing stats specific to the network for our Veterinary School as compared to the stats for our Education school...each of which resides on separate address spaces in our Class B network but "reside" off the same physical router. These processes have their "local-subnets" defined as the network range corresponding to the various colleges. I also have a process which defines a local-subnet as our entire Class B as I'm curious to get a picture of all traffic going in/out of the router. The odd thing is that the network load graph (Summary -> Network Load) for the entire ClassB is *less* than that for each of the colleges. This doesn't make sense to me. You'd think that the various subnets under our Class B would add up to the total for the Class B!? So, for example, our Veterinary School's network load graph shows an average of 16.2 Mbits, but the total for our entire Class B off that same router shows 16.0Mbits. Given these are different processes, each analyzing flow data from the same router, they should be seeing the same thing, yet they are coming up with conflicting reports. I'm not sure why this is, and was wondering if anyone had any ideas or has seen similar results? Thank you --Greg Redder ======================================================================== ======= Greg Redder Academic Computing & Networking Services Colorado State University, ACNS Phone:(970)491-7222 FAX: (970)491-1958 601 S. Howes, Room 625 E-mail: [EMAIL PROTECTED] Fort Collins, CO 80523 PGP Fprint:CD62EAE6227D96FC7C232B16DFE3B5D9B2F64352 ======================================================================== ======= _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font> _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font> _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
