ClearFoundation

sorry, been a little longer then expected.

however, the code you mentioned didn't seem to do much for me

something wrong?

I think its important to specify your local net.

Under Configure -> Startup Options, set "Local Subnet Address (-m)" to "192.168.1.0/24" (substitute your network, no quotes)

Also take note of which NIC you are displaying information from. On the Admin menu there should be a "Switch NIC" option.
This option will not be available if ntop is in merge mode (-M). BUt I'm really not clear on this.

If you switch NIC to the LAN inteface, you will see all local traffic, including local to local, and local to internet.
(for example, you will see 192.168.1.2 accessing a flexishare. You will also see 192.168.1.4 communications with google)

If you switch to ppp0, you will see only internet data.

One thing I WISH ntop would do is to simply display a total-megabyte sorted list of PC to Internet Host.

But I don't think it does. It's REALLY difficult to pin point communications.
ntop seems to be geared towards tracking down protocols. Sys admin, not home admin I guess...

Michael.

Also... I found this

--sticky-hosts By default idle hosts are periodically purged from memory. Use this flag to prevent idle hosts from being purged from memory. NOTE: if idle hosts are kept in memory you can experience severe memory usage.

No wonder I couldn't track down the giga bytes!