Yeah I think I've figured it out now. When ntop sees remote traffic from separate IP addresses but the same mac address it assumes that the mac belongs to a router and treats them as separate hosts. When it sees local traffic that uses the same mac address with separate IP address it assumes it's the same host. Makes sense I guess.
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
