Re: Monitoring problems...

[Alistair Tonner <Alistair@nerdnet.ca>]

On October 31, 2003 05:19 am, Vincent Haverlant wrote:
> "Mark Webb" <webb@mmspl.com.au> writes:
> > I was asked by the powers that be to set up some monitoring of our
>
> workplaces internet traffic. Basically a breakdown of the volume used
> and what protocol is using it.  i.e. 20% mail, 30% web, 10% ftp, etc....
>
> Hi Mark,
>
> You might want to have a look at ntop (http://www.ntop.org/) which looks
> like it does exactly what you want.
>
> Vincent.

	Mark:
	Essentially what is happening is that although you are on a hub and can 
technically see all the traffic for the pipe you are attached to, the box 
does not see all that traffic as being destined for your box, thus is 
ignoring packets NOT a) addressed to the box itself b) addressed to 
broadcast.

  Don't know about ntop myself, but it seems to have a number of fans on this 
list (Hey ...look theres one now... its Vincent)

	*shrugs* ... there are those that swear by other tools too... and difficult 
as ethereal is ... with careful configuration and a few good scripts... 
	

-- 

	Alistair Tonner
	nerdnet.ca
	Senior Systems Analyst - RSS
	
     Any sufficiently advanced technology will have the appearance of magic.
	Lets get magical!