Best ntop config?

[kartweel]

Hi,

I've got a pretty simple pfSense install, ethernet WAN pfSense in NAT mode and single local network.

I wanted to monitor what client machines on the LAN are up to in terms of internet usage.

If I run ntop on the WAN interface, it doesn't show any client IP addresses, just the WAN interface address as the client.

If I run ntop on the LAN interface, most of the traffic it picks up is local broadcast stuff from the windows DC and most of the output isn't useful.

Is there any guides for best setup for ntop?. If I run on WAN interface it gives great output, but no client IPs, if I run on LAN then I get client IPs, but most of the info I am not interested in.

Thanks, Ryan

[kartweel]

Thinking, perhaps I just need to block broadcast or multicast or something? Is there an easy way to block broadcast traffic?