[Ntop] RE:RE: cisco 2950 port mirror problem

[Blake]

If need be I have some 2950 and 3550 switches so when
I get a chance I will try to run NTOP like you however
I am wondering if you have tried running tcpdump or
something to verify you are seeing the expected
traffic on the destination (monitor dest) switch port?


--- "Burton M. Strauss III" <Burton@ntopsupport.com>
wrote:
> Sounds like you might have VLANs?  The only
> supported release is 2.2, and
> one of the enhancments from 2.1.3 is support for
> 802.1q VLANs.  2.2 is the
> one with the problem report (the little 'bug' icon
> on the About tab).
> 
> -----Burton
> 
> -----Original Message-----
> From: ntop-admin@unipi.it
> [mailto:ntop-admin@unipi.it]On Behalf Of
> Charley Pfaff
> Sent: Monday, April 28, 2003 8:21 AM
> To: ntop@Unipi.IT
> Subject: [Ntop] RE:RE: cisco 2950 port mirror
> problem
> 
> 
> Sorry I was unclear,
> 
> Yes I am runnning ntop on a unnumbered interface.
> The command that I am
> using is "ntop -i eth0 -P ./trash -m
> 192.168.25.0/24" . Once this is ran I
> will goto the interface on port 3000 on the managed
> interface eth1. I will
> then goto the stats tab and view hosts. This will
> display mac addresses
> and board vendor. There is no other info like ip
> address. Then I will
> navigate to the total tab and view all protocols and
> this is only showing
> ARP and OTHER traffic. So just for fun I used the
> same command but changed
> the interface to the managed interface eth1 and
> looked at the same
> information and it showed ip along with mac addr.
> and it also showed udp,
> arp tcp  traffic. As for the built in problem report
> form I am unfamiliar
> with this and do not know where to find this.
> 
> 
> 
> If I'm following you, when you fire up ntop on an
> unnumbered interface,
> there's no traffic?  Are you using -m to tell ntop
> what's local?
> Otherwise... you have neglected to provide important
> information - using the
> built-in problem report form is STRONGLY suggested. 
> And, include an 'ASCII
> art' picture of the network in the description
> section...
> 
>  -----Burton
> 
> > -----Original Message-----
> > From: ntop-admin@unipi.it
> [mailto:ntop-admin@unipi.it]On Behalf Of
> > Charley Pfaff
> > Sent: Friday, April 25, 2003 11:37 AM
> > To: ntop@Unipi.IT
> > Subject: [Ntop] cisco 2950 port mirror problem
> >
> >
> > I have a cisco 2950 running 12.1(9) ios and I am
> port mirroring one port
> > to the listening port runnning redhat 7.2 with 2
> nics the listening nic is
> > upped without an address and the second it on a
> managed lan with latest
> > build of pcap and ntop . I have searched on the
> faq's and list but haven't
> > found what I am looking for. Being a novice to
> linux.. When I fire up ntop
> > on the listening port the stats and host
> information do not show ip
> > addresses or protocol info. It does show "other"
> traffic being logged. If
> > I run it on the managed interface it runs perfect
> showing everything.. Is
> > there something wrong with using my configuration
> or something that the
> > cisco 2950 catalyst messes up.?  Also I am not
> running mutiple vlans or
> > anything. Any help you be great.
> 
> _______________________________________________
> Ntop mailing list
> Ntop@unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
> 
> _______________________________________________
> Ntop mailing list
> Ntop@unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop



__________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.
http://search.yahoo.com