Ok, so first off this is my first post, secondly, I think this is in the right place as I do believe there is something fishy going on. Please move if you disagree!
Anyway, I have ntopng running, installed in pfSense running as VM.
When I do a network scan, I get a whole bunch of hosts that have the little ghost man icon and show as on ghost networks. I’ve sought help for this in the pat and everyone is just like you have a network misconfiguration. But, its a pretty simple network. It’s a simple /24 and most hosts are given DHCP, with a /24 mask. So, I struggle to see how this is a misconfiguration.
That being said, I should also mention that these little ghost men that show on the hosts, always move around between hosts on the network. If I do another network discovery, the ghost man will be on a different host or different host(s).
So, with that being said. Can anyone explain to me why this ghost man is invading me. It does concern me as I do believe my network has been compromised (ex-girlfriend shenanigan’s) but I need to understand exactly what this icon actually means, and how it determines that hosts are on different networks.
Also, the hostnames it gives are very weird and incorrect.
Another thing to note is that sometimes said ghost man appears as a IPv6 host.
Any help would be much appreciated!
