Download ntop User`s Guide

ntop 2.3 User’s Guide
This parameter specifies that ntop should not trust the MAC addresses but just use the IP
addresses.
Normally, since the MAC address must be globally unique, the dual nature of ntop is a
benefit and provides far better information about the network than is available via a pure
layer 2 or pure layer 3 monitor.
Under certain circumstances whenever ntop is started on an interface where MAC
addresses cannot be really trusted you may require this option.
Situations which may require this option include port/VLAN mirror, some cases with
switches and spanning tree protocol, and (reportedly) some specific models of Ethernet
switches which re-write MAC addresses of the packets they process. Normally, you discover
that this option is necessary when you observe that hosts seem to change their addresses
or information about different machines get lumped together.
Note that with this option, information which is dependent upon the MAC addresses (non
tcp/ip protocols like IPX) will not be collected nor displayed.
-p | --protocols
This parameter is used to specify the TCP/UDP protocols that ntop will monitor. The format is
<label>=<protocol list> [, <label>=<protocol list>], where label is used to symbolically
identify the <protocol list>. The format of <protocol list> is <protocol>[|<protocol>], where
<protocol> is either a valid protocol specified inside the /etc/services file or a numeric port
range (e.g. 80, or 6000-6500).
A simple example is --protocols="HTTP=http|www|https|3128,FTP=ftp|ftpdata", which
reduces the protocols displayed on the "IP" pages to three:
Host Domain Data HTTP FTP Other IP
ns2.attbi.com <flag> 954 63.9 % 0 0 954
64.124.83.112.akamai.com <flag> 240 16.1 % 240 0 0
64.124.83.99.akamai.com <flag> 240 16.1 % 240 0 0
toolbarqueries.google.com <flag> 60 4.0 % 60 0 0
If the <protocol list> is very long you may store it in a file (for instance protocol.list). To do so,
specify the file name instead of the <protocol list> on the command line. e.g. ntop -p
protocol.list
If the -p parameter is omitted the following default value is used:
FTP=ftp|ftp-data
HTTP=http|www|https|3128 3128 is Squid, the HTTP cache
DNS=name|domain
Telnet=telnet|login
NBios-IP=netbios-ns|netbios-dgm|netbios-ssn
Mail=pop-2|pop-3|pop3|kpop|smtp|imap|imap2
DHCP-BOOTP=67-68
SNMP=snmp|snmp-trap
NNTP=nntp
NFS=mount|pcnfs|bwnfs|nfsd|nfsd-status
© 1998-2003 - Luca Deri <[email protected]>
8