1

I'm having some trouble understanding the output of Ntop.

I'm receiving high bandwidth warnings for one my (debian) servers from my network provider. Because the server runs only a few low traffic sites, and I couldn't find anything being too busy, I have installed NTOP.

In Ntop I can see there is some weird traffic going on but it is hard too understand.

  • On trafficStats -> application protocols, I have a high 10gb of Mail_POP traffic. I don't use POP on the server though. Only HTTPS/HTTP and SSH are open.

  • On trafficStats -> eth0 report, I find this 10gb under "non-ip traffic", with only 1gb ip traffic.

  • On hosts -> traffic, Only the server itself has a little traffic 1.5 gb but the 10gb Mail_POP traffic does not show anywhere.

  • Ntop uptime is 6 days but the server itself is first seen yesterday.

Can anyone help to understand these readings? What is Mail_POP What could be causing the high traffic spikes? Do I need to provide more information?

Improve this question

1 Answer 1

Reset to default
2

Your "huge amounts of Mail_POP traffic" issue is probably related to a bug the existed in some old (circa early-2012) releases of ntop. It was mistakenly categorising HTTPS traffic as POP.

There's a discussion that touches on it here..

Moreover, port 443 is mapped to POP rather than HTTPS..

And some mention of it here too..

.. there was a report back in March of HTTPS traffic being classified as mail_POP.

Can't shed any light on your other issues but my experience with ntop so far indicates it can generally be a bit flaky.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .