[Ntop] Non IP Traffic

[Martin Larsson]

Thanks. WireShark was interesting, and overwhelming.
It seems there's a lot of "MS NLB Heartbeat" each containing 1510 bytes.
Could that be it?
I've attached a sample screenshot.

On Thu, Jan 29, 2009 at 2:16 PM, Burton Strauss III
<Burton at ntopsupport.com> wrote:
> It means ntop is seeing a lot of traffic that isn't recognizable as tcp/ip.
>
> Depending on your connection and what you are monitoring (network topology)
> this could be normal (i.e. traffic wrapped in something) or it could be odd.
>
> I usually recommend installing WireShark and letting it analyze a few dozen
> packets (they both use libpcap so they look at traffic the same way).  If
> WireShark calls it differently than ntop, you probably have exposed some
> bug. If they both call it non-ip, then explain your topology and we can
> guide you.  If you aren't sure, grab & post a screen shot of a page of
> random traffic from WireShark, post it and we can read what you have from
> there...
>
> -----Burton
>
>
>
>
>
> -----Original Message-----
> From: ntop-bounces at unipi.it [mailto:ntop-bounces at unipi.it] On Behalf Of
> Martin Larsson
> Sent: Thursday, January 29, 2009 3:54 AM
> To: ntop at unipi.it
> Subject: [Ntop] Non IP Traffic
>
> I installed ntop because the system monitor told me my network was fairly
> active
> even though I wasn't actively sending or receiving anything.
> After about 1.5 hours of running, the traffic summary is showing me a lot of
> non-IP traffic.
>
> Total   26.4 MBytes [47,672 Pkts]
> IP Traffic      9.3 MBytes [26,718 Pkts]
> Fragmented IP Traffic   0 [0.0%]
> Non IP Traffic  17.1 MBytes
>
> What does that mean?
>
> M.
> _______________________________________________
> Ntop mailing list
> Ntop at unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
>
> _______________________________________________
> Ntop mailing list
> Ntop at unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Wireshark.png
Type: image/png
Size: 314949 bytes
Desc: not available
Url : http://listgateway.unipi.it/pipermail/ntop/attachments/20090129/e776c260/attachment-0001.png