ntop and switch

Dear NG!

I got 2 new switches yesterday and want to watch the networktraffic with
ntop.
But i dont see anything except things concerning my own machine and
broadcasts, even then, when i specify the -j switch.

Is ntop able to do a spoof-view like ettercap does?
Is there any workaround?

Please help!

Greetings from Austria

Ivo Angelo Carobbio

Ivo Angelo Carobbio <ivo.angelo.carobbio@aon.at> wrote
news:Xns93CA623267841ivoangelocarobbioaon@192.168. 10.9:

> Dear NG!
>
> I got 2 new switches yesterday and want to watch the networktraffic
> with ntop.
> But i dont see anything except things concerning my own machine and
> broadcasts, even then, when i specify the -j switch.
>
> Is ntop able to do a spoof-view like ettercap does?

Of course ntop can work in "promiscuity mode" and so read any passing
throw traffic.

> Is there any workaround?

But you say "switches" which optimize traffic and forward only specific
host ethernet traffic on each switch port.

So it's normal to see only your host traffic (including broadcast and
multicast).

To "scan" all traffic you should set the switch port attach to your host
as a "mirror port" (a switch function that replicate ll ethernet traffic
to a specific port).

> Please help!
>
> Greetings from Austria
>
> Ivo Angelo Carobbio

Rehards

Ivo Angelo Carobbio wrote:

> Dear NG!
>
> I got 2 new switches yesterday and want to watch the networktraffic with
> ntop.
> But i dont see anything except things concerning my own machine and
> broadcasts, even then, when i specify the -j switch.
>
> Is ntop able to do a spoof-view like ettercap does?
> Is there any workaround?

Unlike a hub which passes all traffic to all ports, a switch passes only the
packets intended for that port. You don't see traffic for other computers.
This is one of the benefits of a switch, as it prevents collision and
reduces congestion.

--

Fundamentalism is fundamentally wrong.

To reply to this message, replace everything to the left of "@" with
james.knott.