Ntop can't see IP detail information

highlandpeak

I had this problem and I just got it to work:

From within NTop, try Admin/Switch NIC and choose your wan interface.

Bruce

dgcom

Did you click on IP address or MAC?

highlandpeak

Not sure what you're asking… Could you clarify?

Bruce

dgcom

When you look at host, there are two different types of addresses shown - IP (level 3) and MAC (level 2).
You can click on both of them to view host information, however only level 2 addresses work currently.
That is why I am asking - when you switched interface and looked at host - was this level 2 or level 3 host? I.e. did you click on IP address or MAC to show host information?

highlandpeak

Host name & macs where there is one work, ip addresses are not clickable in the reports that I can see. Macs do not show up for remote networks.

I don't know if this has to do with differences in how I have mine setup vs yours.

In ntop Settings I have 3 interfaces selected (LAN, OPT1, WAN) and allow merge interfaces ticked.

In Admin/Configure ntop/IP Prefs I have DNS resolution mode (-n) set to all.

Bruce

![Screen Shot 2014-07-17 at 4.47.20 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2014-07-17 at 4.47.20 PM.png_thumb)
![Screen Shot 2014-07-17 at 4.47.20 PM.png](/public/imported_attachments/1/Screen Shot 2014-07-17 at 4.47.20 PM.png)

dgcom

So, in the screenshot you attached - what happens if you click on host name?

BTW - see that drop down, which is saying "Show only L3 hosts"? What you see is the list of all level 3 hosts - being it name or IP… If you switch to level 2, you will see MAC addresses...

highlandpeak

See attached

![Screen Shot 2014-07-17 at 5.31.00 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2014-07-17 at 5.31.00 PM.png_thumb)
![Screen Shot 2014-07-17 at 5.31.00 PM.png](/public/imported_attachments/1/Screen Shot 2014-07-17 at 5.31.00 PM.png)
![Screen Shot 2014-07-17 at 5.32.43 PM.png](/public/imported_attachments/1/Screen Shot 2014-07-17 at 5.32.43 PM.png)
![Screen Shot 2014-07-17 at 5.32.43 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2014-07-17 at 5.32.43 PM.png_thumb)

dgcom

This is interesting… Your host information page (1st screenshot) is different than the one with spinning wheel - it has less tabs (like the one I get for L2 hosts).
Are there any global ntop settings you changed?

Cino

something has change.. I'm seeing the same thing on my box… This wasn't the case for me 1-2 months ago... Submit a bug report here: https://redmine.pfsense.org/

I believe Jimp normally maintains this package, hopefully its a quick fix by recompiling the binary

akong

I submit it.
https://redmine.pfsense.org/issues/3764

ipassashuman

I had your exact problem. Managed to resolve it;
Did a few things before restarting the service. So I'm not sure exactly which it was that resolved it;

Admin -> Configure -> Startup Options;

Enable Session Handling (-z) -> No
Run as daemon (-d) YES
Set Both these and restart the service in PfSense -> Status -> Services

Other changes i made;
NTOP IP ranges were incorrect; (Admin -> Configure -> Preferences
look for all references to your IP ranges and fix them. e.g.
netflow.2.ifNetMask 192.168.0.0/255.255.255.0 -> Change to your ranges 192.168.1.0/255.255.255.0

Tested this under another system and resolved the same issue.

Later

dgcom

It looks like disabling TCP sessions handling switches host information to simplified page which works, but shows much less data than when ntop can track TCP sessions.

Would still be nice if integration with Python can be fixed, so ntop can show all data collected.

akong

I have to report to redmine.pfsense.org.It's report for me.

there's nothing broken in general with ntop. it needs to be deprecated and replaced with ntopng regardless.

So,Is it will be use ntopng?