Re: Traffic sent and traffic received in historical view in ntopng

On 16 May 2017 at 19:29, Emanuele Faranda faranda-at-ntop.org |ntop-flugle|
<[email protected]> wrote:

> Hi Peter and Andrew,
>
> Please see below.
>
>> On 05/16/2017 01:33 PM, Peter Shute wrote:
>> I'm also interested in this. I can get from my ISP daily totals for our
>> internet usage. I would like ntopng to be able to replicate those daily
>> totals (to give confidence our data is correct), and then analyse the
>> totals to see which devices contributed. Eg. If we have an above average
>> daily total, I want to know why.
>> ​​
>>
>
> Ntopng can actually produce a traffic report where it shows the top
> local/remote talkers for a specified time frame (e.g. a day), but this is a
> pro only feature.
>

​I don't object to paying for the license, but this still doesn't get me
what I want, I think. I want to look back over a historical graph (or jump
to a time and day, if I believe there was a problem at that time) and drill
down to see the protocols invloved, and the hosts. Top 10 talkers may not
include the information I want.​

> On 16 May 2017, at 4:01 am, Andrew Hilborne <[email protected]<mailto:[email protected]> <[email protected]>> wrote:
> ​​
>
> On 15 May 2017 at 17:10, Emanuele Faranda faranda-at-ntop.org<http://faranda-at-ntop.org> <http://faranda-at-ntop.org> |ntop-flugle| <[email protected]<mailto:[email protected]> <[email protected]>> wrote:
>
> You are right, network stats are calculated every minute, whereas interface stats are updated each second.
>
> Please note that these stats are dumped to RRD files, not to the MySQL database.
>
> ​Would it be possible t change this? Is the issue storage space in the MySQL database? This is what I want to know (initially):
>
> No, this is something different. MySQL database exports *flows* as data,
> whereas RRD is *timeseries* database, so they play different roles.
>

​I do understand the difference between flows and and the RDD timeseries.
However, typical 5-minute RDD data is useless for investigating traffic
peaks; I think you may know this, because n2disk can now detect
'micro-bursts'​. I don't suggest that storing sufficient information to
provide a near real-time breakdown of traffic is easy, but it would be
interesting. If I am reduced to going back to using RDDtool type data,
there are better tools than ntopng for that purpose.

Maybe I'm not using ntopng properly?

Andrew

_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop