I'm a new user and I'm tryng to setup a linux machine with some tool to monitor the network.
For the network usage, I choose ntop.
After configuring ntop and the router, I make some test and all seems to be work correctly, but I see that the traffic reported on ntop is not the real traffic passed trhough the router. For example: if I make a FTP download of about 30 MB, I see only few KB reported by netflow. It's normal? I try to change the version of netflow export (v1, v5, v9) but nothing change.
Moreover, thinking a problem on Ntop, I try to use other two netflow analyzer, but the result is the same.
Someone can help me? Do we modify some parameters on the router to change this behavior? Or is it normal?