Explain L and R – why doesn ntop double count?
A. Classification is all based on what ntop SEES in the packets. ntop sees packets and ONLY packets. Packets have a FROM and a TO address. Which packets ntop sees is determined by the interfaces it is monitoring. Traffic (packets) is classified based on the joint classification of the FROM address (L or R) and the TO address (L or R). Only in L->L traffic will ntop see sent=rcvd and ‘double count’.
