Re: Ntop and ERSPAN
Simone Mainardi <[email protected]>
| Newsgroups | gmane.linux.ntop.general |
|---|---|
| Message-ID | <[email protected]> |
Hi, Is the ERSPAN traffic detunneled? Do you get flows in the web interface? Please also send the ntopng logs and make sure folders permissions are read+write for the user who is running ntopng. Simone > On 4 Mar 2018, at 23:25, Rokkhan <[email protected]> wrote: > > Hi, > > I have updated to latest version but now I am unable to dump any packet. It does not even generate the pcap folder on interface folder. > > Greetings. > > 2018-03-02 21:30 GMT+01:00 Simone Mainardi <[email protected] <mailto:[email protected]>>: > Just wait until tomorrow (new builds are being generated) ad update ntopng to the latest 3.3 version. > > Simone > > >> On 2 Mar 2018, at 21:29, Rokkhan <[email protected] <mailto:[email protected]>> wrote: >> >> Sorry, I am quite newbie at this? what do i have to do? update? overwrite a file? >> Greetings! >> >> 2018-03-02 21:21 GMT+01:00 Simone Mainardi <[email protected] <mailto:[email protected]>>: >> Thanks for providing the pcap. We have added GRE ERSPAN detunneling in https://github.com/ntop/ntopng/commit/9d82df748f27da6bc7c51e7e726600b09670c518 <https://github.com/ntop/ntopng/commit/9d82df748f27da6bc7c51e7e726600b09670c518> >> >> Please check it out and report. Thanks, >> >> Simone >> >>> On 1 Mar 2018, at 22:09, Rokkhan <[email protected] <mailto:[email protected]>> wrote: >>> >>> I have upgraded to v.3.3.180301 and I still see GRE traffic. >>> >>> Greetings. >>> >>> 2018-03-01 21:36 GMT+01:00 Rokkhan <[email protected] <mailto:[email protected]>>: >>> Hi, >>> >>> I am using v.3.3.180125 version. I send you attached an small pcap. >>> >>> >>> <imagen.png> >>> >>> Greetings >>> >>> 2018-03-01 20:54 GMT+01:00 Simone Mainardi <[email protected] <mailto:[email protected]>>: >>> As you can see from https://github.com/ntop/ntopng/blob/dev/src/NetworkInterface.cpp#L1521 <https://github.com/ntop/ntopng/blob/dev/src/NetworkInterface.cpp#L1521> ntopng decapsulates GRE traffic. Are you using the latest version? Can you enclose a pcap file so we can try and reproduce? >>> >>> >>>> On 1 Mar 2018, at 20:40, Rokkhan <[email protected] <mailto:[email protected]>> wrote: >>>> >>>> Hi, >>>> I am using ntopng and it shows traffic flows as gre, instead of the real traffic. >>>> Do i have to enable any option? >>>> Greetings >>>> >>>> >>>> El 1 mar. 2018 20:35, "Simone Mainardi" <[email protected] <mailto:[email protected]>> escribió: >>>> ntopng decapsulates GRE tunnels by default. nprobe needs the following option to account for decapsulated traffic: >>>> >>>> [--tunnel|-5] | Compute flows on tunnelled traffic rather than >>>> | on the external envelope >>>> >>>> >>>> Simone >>>> >>>> > On 28 Feb 2018, at 18:28, Rokkhan <[email protected] <mailto:[email protected]>> wrote: >>>> > >>>> > Hi, >>>> > >>>> > I am sending traffic to one of the ntop interfaces with ERSPAN but traffic info shows application as "GRE". >>>> > >>>> > ¿Coudl it be configured to inspect the traffic inside the ERSPAN and show the real application? >>>> > >>>> > Saludos. >>>> > _______________________________________________ >>>> > Ntop mailing list >>>> > [email protected] <mailto:[email protected]> >>>> > http://listgateway.unipi.it/mailman/listinfo/ntop <http://listgateway.unipi.it/mailman/listinfo/ntop> >>>> >>>> _______________________________________________ >>>> Ntop mailing list >>>> [email protected] <mailto:[email protected]> >>>> http://listgateway.unipi.it/mailman/listinfo/ntop <http://listgateway.unipi.it/mailman/listinfo/ntop>_______________________________________________ >>>> Ntop mailing list >>>> [email protected] <mailto:[email protected]> >>>> http://listgateway.unipi.it/mailman/listinfo/ntop <http://listgateway.unipi.it/mailman/listinfo/ntop> >>> >>> _______________________________________________ >>> Ntop mailing list >>> [email protected] <mailto:[email protected]> >>> http://listgateway.unipi.it/mailman/listinfo/ntop <http://listgateway.unipi.it/mailman/listinfo/ntop> >>> >>> >>> _______________________________________________ >>> Ntop mailing list >>> [email protected] <mailto:[email protected]> >>> http://listgateway.unipi.it/mailman/listinfo/ntop <http://listgateway.unipi.it/mailman/listinfo/ntop> >> >> _______________________________________________ >> Ntop mailing list >> [email protected] <mailto:[email protected]> >> http://listgateway.unipi.it/mailman/listinfo/ntop <http://listgateway.unipi.it/mailman/listinfo/ntop> >> >> _______________________________________________ >> Ntop mailing list >> [email protected] <mailto:[email protected]> >> http://listgateway.unipi.it/mailman/listinfo/ntop <http://listgateway.unipi.it/mailman/listinfo/ntop> > > _______________________________________________ > Ntop mailing list > [email protected] <mailto:[email protected]> > http://listgateway.unipi.it/mailman/listinfo/ntop <http://listgateway.unipi.it/mailman/listinfo/ntop> > > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop