Thanks Gary. You are right -- this is due to a limitation in netflow. Version 5 doesn't have any support for MACs, however version 9 supposedly does. This morning I tried to use nprobe to export a version 9 template with the source and destination MAC address but ntop doesn't use this, or at least doesn't display it as the host's MAC address.
> ? - Why do you care about MAC's? I just get them from the switches > bridging table or arp table when needed. I'm setting up ntop to provide troubleshooting information for some "hotspot" style networks that we run. The local IPs of the clients that connect to the network can very well change from day to day. So, we keep track of everything by MAC address -- i.e. we use cacti to graph signal levels for each MAC connected to the network, etc. I'd like to do the same thing with traffic -- it would be great if we could keep a month's worth of traffic archived by MAC address instead of IP. If anyone has any recommendations for how ntop could be used for this purpose please let me know. It looks like I might need two separate tools for what I want to do. Thanks! _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
