Re: Ntop and ERSPAN

Hi,

I have updated to latest version but now I am unable to dump any packet. It
does not even generate the pcap folder on interface folder.

Greetings.

2018-03-02 21:30 GMT+01:00 Simone Mainardi <[email protected]>:

> Just wait until tomorrow (new builds are being generated) ad update ntopng
> to the latest 3.3 version.
>
> Simone
>
>
> On 2 Mar 2018, at 21:29, Rokkhan <[email protected]> wrote:
>
> Sorry, I am quite newbie at this? what do i have to do? update? overwrite
> a file?
> Greetings!
>
> 2018-03-02 21:21 GMT+01:00 Simone Mainardi <[email protected]>:
>
>> Thanks for providing the pcap. We have added GRE ERSPAN detunneling in
>> https://github.com/ntop/ntopng/commit/9d82df748f27da6bc7c
>> 51e7e726600b09670c518
>>
>> Please check it out and report. Thanks,
>>
>> Simone
>>
>> On 1 Mar 2018, at 22:09, Rokkhan <[email protected]> wrote:
>>
>> I have upgraded to v.3.3.180301 and I still see GRE traffic.
>>
>> Greetings.
>>
>> 2018-03-01 21:36 GMT+01:00 Rokkhan <[email protected]>:
>>
>>> Hi,
>>>
>>> I am using v.3.3.180125 version. I send you attached an small pcap.
>>>
>>>
>>> <imagen.png>
>>>
>>> Greetings
>>>
>>> 2018-03-01 20:54 GMT+01:00 Simone Mainardi <[email protected]>:
>>>
>>>> As you can see from https://github.com/ntop/n
>>>> topng/blob/dev/src/NetworkInterface.cpp#L1521 ntopng decapsulates GRE
>>>> traffic. Are you using the latest version? Can you enclose a pcap file so
>>>> we can try and reproduce?
>>>>
>>>>
>>>> On 1 Mar 2018, at 20:40, Rokkhan <[email protected]> wrote:
>>>>
>>>> Hi,
>>>> I am using ntopng and it shows traffic flows as gre, instead of the
>>>> real traffic.
>>>> Do i have to enable any option?
>>>> Greetings
>>>>
>>>>
>>>> El 1 mar. 2018 20:35, "Simone Mainardi" <[email protected]> escribió:
>>>>
>>>>> ntopng decapsulates GRE tunnels by default. nprobe needs the following
>>>>> option to account for decapsulated traffic:
>>>>>
>>>>> [--tunnel|-5]                       | Compute flows on tunnelled
>>>>> traffic rather than
>>>>>                                     | on the external envelope
>>>>>
>>>>>
>>>>> Simone
>>>>>
>>>>> > On 28 Feb 2018, at 18:28, Rokkhan <[email protected]> wrote:
>>>>> >
>>>>> > Hi,
>>>>> >
>>>>> > I am sending traffic to one of the ntop interfaces with ERSPAN but
>>>>> traffic info shows application as "GRE".
>>>>> >
>>>>> > ¿Coudl it be configured to inspect the traffic inside the ERSPAN and
>>>>> show the real application?
>>>>> >
>>>>> > Saludos.
>>>>> > _______________________________________________
>>>>> > Ntop mailing list
>>>>> > [email protected]
>>>>> > http://listgateway.unipi.it/mailman/listinfo/ntop
>>>>>
>>>>> _______________________________________________
>>>>> Ntop mailing list
>>>>> [email protected]
>>>>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>>>
>>>> _______________________________________________
>>>> Ntop mailing list
>>>> [email protected]
>>>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> Ntop mailing list
>>>> [email protected]
>>>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>>>
>>>
>>>
>> _______________________________________________
>> Ntop mailing list
>> [email protected]
>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>
>>
>>
>> _______________________________________________
>> Ntop mailing list
>> [email protected]
>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>
>
> _______________________________________________
> Ntop mailing list
> [email protected]
> http://listgateway.unipi.it/mailman/listinfo/ntop
>
>
>
> _______________________________________________
> Ntop mailing list
> [email protected]
> http://listgateway.unipi.it/mailman/listinfo/ntop
>

_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop