Re: Ntop and ERSPAN
Simone Mainardi <[email protected]>
| Newsgroups | gmane.linux.ntop.general |
|---|---|
| Message-ID | <[email protected]> |
Just wait until tomorrow (new builds are being generated) ad update ntopng to the latest 3.3 version. Simone > On 2 Mar 2018, at 21:29, Rokkhan <[email protected]> wrote: > > Sorry, I am quite newbie at this? what do i have to do? update? overwrite a file? > Greetings! > > 2018-03-02 21:21 GMT+01:00 Simone Mainardi <[email protected] <mailto:[email protected]>>: > Thanks for providing the pcap. We have added GRE ERSPAN detunneling in https://github.com/ntop/ntopng/commit/9d82df748f27da6bc7c51e7e726600b09670c518 <https://github.com/ntop/ntopng/commit/9d82df748f27da6bc7c51e7e726600b09670c518> > > Please check it out and report. Thanks, > > Simone > >> On 1 Mar 2018, at 22:09, Rokkhan <[email protected] <mailto:[email protected]>> wrote: >> >> I have upgraded to v.3.3.180301 and I still see GRE traffic. >> >> Greetings. >> >> 2018-03-01 21:36 GMT+01:00 Rokkhan <[email protected] <mailto:[email protected]>>: >> Hi, >> >> I am using v.3.3.180125 version. I send you attached an small pcap. >> >> >> <imagen.png> >> >> Greetings >> >> 2018-03-01 20:54 GMT+01:00 Simone Mainardi <[email protected] <mailto:[email protected]>>: >> As you can see from https://github.com/ntop/ntopng/blob/dev/src/NetworkInterface.cpp#L1521 <https://github.com/ntop/ntopng/blob/dev/src/NetworkInterface.cpp#L1521> ntopng decapsulates GRE traffic. Are you using the latest version? Can you enclose a pcap file so we can try and reproduce? >> >> >>> On 1 Mar 2018, at 20:40, Rokkhan <[email protected] <mailto:[email protected]>> wrote: >>> >>> Hi, >>> I am using ntopng and it shows traffic flows as gre, instead of the real traffic. >>> Do i have to enable any option? >>> Greetings >>> >>> >>> El 1 mar. 2018 20:35, "Simone Mainardi" <[email protected] <mailto:[email protected]>> escribió: >>> ntopng decapsulates GRE tunnels by default. nprobe needs the following option to account for decapsulated traffic: >>> >>> [--tunnel|-5] | Compute flows on tunnelled traffic rather than >>> | on the external envelope >>> >>> >>> Simone >>> >>> > On 28 Feb 2018, at 18:28, Rokkhan <[email protected] <mailto:[email protected]>> wrote: >>> > >>> > Hi, >>> > >>> > I am sending traffic to one of the ntop interfaces with ERSPAN but traffic info shows application as "GRE". >>> > >>> > ¿Coudl it be configured to inspect the traffic inside the ERSPAN and show the real application? >>> > >>> > Saludos. >>> > _______________________________________________ >>> > Ntop mailing list >>> > [email protected] <mailto:[email protected]> >>> > http://listgateway.unipi.it/mailman/listinfo/ntop <http://listgateway.unipi.it/mailman/listinfo/ntop> >>> >>> _______________________________________________ >>> Ntop mailing list >>> [email protected] <mailto:[email protected]> >>> http://listgateway.unipi.it/mailman/listinfo/ntop <http://listgateway.unipi.it/mailman/listinfo/ntop>_______________________________________________ >>> Ntop mailing list >>> [email protected] <mailto:[email protected]> >>> http://listgateway.unipi.it/mailman/listinfo/ntop <http://listgateway.unipi.it/mailman/listinfo/ntop> >> >> _______________________________________________ >> Ntop mailing list >> [email protected] <mailto:[email protected]> >> http://listgateway.unipi.it/mailman/listinfo/ntop <http://listgateway.unipi.it/mailman/listinfo/ntop> >> >> >> _______________________________________________ >> Ntop mailing list >> [email protected] <mailto:[email protected]> >> http://listgateway.unipi.it/mailman/listinfo/ntop <http://listgateway.unipi.it/mailman/listinfo/ntop> > > _______________________________________________ > Ntop mailing list > [email protected] <mailto:[email protected]> > http://listgateway.unipi.it/mailman/listinfo/ntop <http://listgateway.unipi.it/mailman/listinfo/ntop> > > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop