Mailing List Archive

Yes, I have also the same problem .
My local subnet connects via a router to another subnet,
all traffic through the router is seen as coming from one host.
In the "Host info" that host has a lot of IP addresses.
Jac

-----Original Message-----
From: ntop-admin@unipi.it [mailto:ntop-admin@unipi.it]On Behalf Of
Anders Eriksson
Sent: Friday, August 03, 2001 11:53 AM
To: ntop@unipi.it
Subject: [Ntop] Routing in Local Network & Host Discovery


Andreas.Trawoeger wrote:
> This leads to Ntop discovering packets from computers in the local
subnet
> send with the MAC address of the Cisco (because they are routed to the

> firewall in step 2). After Ntop it starting it picks the first
computers
> name and IP address which is routed through the Cisco and then adds
the
> following IP addresses (which are routed too) under that name (which
> totally screws up host discovery and the session statistic).

I have the same kind of problem.
I want to monitor the traffic flow on a link between a router and a
switch. The problem is that ntop maps all traffic to the router MAC
address or switch MAC address and see them as multihomed hosts.
Any solution to this?
Is it possible to configure ntop to identify hosts by IP address instead
of MAC address?

I'm a newbie to ntop but like what I've seen so far.

--
Anders Eriksson Telephone: +46 8 764 1772
Ericsson Radio Systems AB ECN: 850 41772
Core Networks Mobile Systems Fax: +46 8 757 1030
UMTS Integration & Verification mailto:anders.j.eriksson@ericsson.com



_______________________________________________
Ntop mailing list
Ntop@unipi.it
http://listmanager.unipi.it/mailman/listinfo/ntop

Jac Engel wrote:
>
> Yes, I have also the same problem .
> My local subnet connects via a router to another subnet,
> all traffic through the router is seen as coming from one host.
> In the "Host info" that host has a lot of IP addresses.

ok , same for me. But I'm sure this problem is recent, cause 2 month
ago, ntop worked fine with this configuration (last snapshot, Linux box
RH6.2)

I tried to rollback to some earlier release, but the problem keep going.

But if I compile on another linux box (this one being switched), all
_seems_ to run correctly.

So I guess there's something special on the first box. But I cannot
point what's changed.

What is your configuration ? (OS,ntop version,Hardware, connection type
... )



--
Frédéric Hermann | Société Ferma
Administrateur réseau, Ferma Grenoble | 31 ch. du vieux chêne
Tel : +33 (0)4 76 61 79 01 | ZIRST
Fax : +33 (0)4 76 61 79 59 | 38240 MEYLAN FRANCE

Frederic,
I am using ntop 2.0 beta, on Solaris Sparc 8.0 on SUn Sparc Ultra 10
via hme0 ether interface. It is running fine
from the 2.0 beta release date in May.

Jac
-----Original Message-----
From: ntop-admin@unipi.it [mailto:ntop-admin@unipi.it]On Behalf Of
frederic.hermann@ferma.fr
Sent: Friday, August 03, 2001 5:42 PM
To: ntop@unipi.it
Subject: Re: [Ntop] Routing in Local Network & Host Discovery




Jac Engel wrote:
>
> Yes, I have also the same problem .
> My local subnet connects via a router to another subnet,
> all traffic through the router is seen as coming from one host.
> In the "Host info" that host has a lot of IP addresses.

ok , same for me. But I'm sure this problem is recent, cause 2 month
ago, ntop worked fine with this configuration (last snapshot, Linux box
RH6.2)

I tried to rollback to some earlier release, but the problem keep going.

But if I compile on another linux box (this one being switched), all
_seems_ to run correctly.

So I guess there's something special on the first box. But I cannot
point what's changed.

What is your configuration ? (OS,ntop version,Hardware, connection type
... )



--
Frédéric Hermann | Société Ferma
Administrateur réseau, Ferma Grenoble | 31 ch. du vieux chêne
Tel : +33 (0)4 76 61 79 01 | ZIRST
Fax : +33 (0)4 76 61 79 59 | 38240 MEYLAN FRANCE
_______________________________________________
Ntop mailing list
Ntop@unipi.it
http://listmanager.unipi.it/mailman/listinfo/ntop

Jac,
please send me a traffic dump and a precise explaination of the problem.

Cheers, Luca

Jac Engel wrote:
>
> Yes, I have also the same problem .
> My local subnet connects via a router to another subnet,
> all traffic through the router is seen as coming from one host.
> In the "Host info" that host has a lot of IP addresses.
> Jac
>
> -----Original Message-----
> From: ntop-admin@unipi.it [mailto:ntop-admin@unipi.it]On Behalf Of
> Anders Eriksson
> Sent: Friday, August 03, 2001 11:53 AM
> To: ntop@unipi.it
> Subject: [Ntop] Routing in Local Network & Host Discovery
>
> Andreas.Trawoeger wrote:
> > This leads to Ntop discovering packets from computers in the local
> subnet
> > send with the MAC address of the Cisco (because they are routed to the
>
> > firewall in step 2). After Ntop it starting it picks the first
> computers
> > name and IP address which is routed through the Cisco and then adds
> the
> > following IP addresses (which are routed too) under that name (which
> > totally screws up host discovery and the session statistic).
>
> I have the same kind of problem.
> I want to monitor the traffic flow on a link between a router and a
> switch. The problem is that ntop maps all traffic to the router MAC
> address or switch MAC address and see them as multihomed hosts.
> Any solution to this?
> Is it possible to configure ntop to identify hosts by IP address instead
> of MAC address?
>
> I'm a newbie to ntop but like what I've seen so far.
>
> --
> Anders Eriksson Telephone: +46 8 764 1772
> Ericsson Radio Systems AB ECN: 850 41772
> Core Networks Mobile Systems Fax: +46 8 757 1030
> UMTS Integration & Verification mailto:anders.j.eriksson@ericsson.com
>
> _______________________________________________
> Ntop mailing list
> Ntop@unipi.it
> http://listmanager.unipi.it/mailman/listinfo/ntop
>
> _______________________________________________
> Ntop mailing list
> Ntop@unipi.it
> http://listmanager.unipi.it/mailman/listinfo/ntop

--
Luca Deri NETikos S.p.A.
Via Matteucci 34/B 56124 Pisa, Italy.
Ph. +39/050/968.639 Fax. +39/050/968.626
Personal: luca@lucaderi.org Business: luca.deri@netikos.com
WWW: http://www.lucaderi.org/ ICQ: 68183632
One's destination is never a place but rather a new way of
looking at things - Henry Miller