From: Neil McKee (neil.mckee@inmon.com)
Date: 11/12/03
Alternatively, if you ask for "categoryColumn=sourceName" instead of
"categoryColumn=sourceAddress", then the query will try and map from MAC
to IP to DNS name, and put that name in if it is found.
regards,
neil
Neil McKee wrote:
> Leon,
>
> In the traffic history, we don't store MAC and IP addresses in the same
> table, because there isn't always a 1:1 correspondence. Working within
> the reporting system, the best I can suggest is for the MAC address to
> be a link to the page that shows the IPAddress(es). For example, see
> the Layer 2 Broadcasts report under Reports->Scheduled->Pollution (click
> on the graph to see the table, then click on one of the MAC addresses...).
>
> If this doesn't meet your needs, then let me know. I'd be happy to show
> you how to roll your own perl-script query.
>
> regards,
> neil
>
>
> Leon Mayne wrote:
>
>> Hello,
>> Sorry, I think I missed out a bit in my description! What I mean is
>> that I'm
>> trying to create a report of e.g. Layer 2 Broadcasts (which currently
>> just
>> shows the MAC address):
>>
>> <inmon>
>> action=set;
>> reportName=TopN; reportFormat=table; includeData=yes;
>> categoryColumn=sourceAddress;
>> valueColumn=frames;
>> date=yesterday
>> action=report;
>> tableType=MAC;
>> destinationAddress=0xFFFFFFFFFFFF
>> </inmon>
>>
>> I want it to show the MAC address and the IP address.
>>
>>
>> -----Original Message-----
>> From: owner-traffic-management@inmon.com
>> [mailto:owner-traffic-management@inmon.com] On Behalf Of Neil McKee
>> Sent: 10 November 2003 18:56
>> To: Leon Mayne
>> Cc: traffic-management@inmon.com
>> Subject: Re: [traffic-management] IPs & MACs
>>
>>
>> Hello Leon,
>>
>> You can extract both addresses from Query->Other->Interface Traffic if
>> you configure the output protocol to be "ALL".
>>
>> Alternatively, you can always map from one address type to the other
>> using Query->Other->AddressMappings. For example, a perl script could
>> load an IP->MAC lookup table and then apply it to the output from a
>> TCP query to merge in the extra MAC address columns.
>>
>> In the scheduled reports, you can usually get to the MAC address by
>> clicking on the graph and then clicking on the IP address. This takes
>> you to the same page as Monitor->Host, and shows all known address
>> mappings.
>>
>> regards,
>> neil
>>
>> Leon Mayne wrote:
>>
>>> Hello,
>>> I note that some reports give the IP address of the specified
>>> machine(s),
>>> and some give the MAC address. Is there any way of listing both for a
>>> report? E.g.
>>>
>>> IP Address | MAC Address | Bytes 123.123.1.2 | ff:ff:ff:ff:ff |
>>> 1,320,981,546.00 125.153.1.2 | 00:ff:00:ff:00 | 1,020,981,546.00
>>>
>>
>>
>>
>
>
-- Neil McKee, InMon Corp. tel: +1 (415) 283-3265 //www.inmon.com
This archive was generated by hypermail 2.1.4 : 11/12/03 PST