Re: nProbe / ntopNG config

Hello,

> On 12 Oct 2018, at 10:52, BASSAGET Cédric <[email protected]> wrote:
> 
> Hello,
> I'm trying to make nprobe work with IPFIX and ntopng, but data displayed by ntopng is inconsistent.
> 
> Here's the path my netflow packets take :
> router -> nprobe:6345 -> ntopNG:6445.
> (nprobe and ntopng services are on the same host.)
> 
> nprobe runs with : (cat /etc/nprobe/nprobe.conf)
> -i=any 

set to 

-i=none

> -n=none 
> --collector-port=6345 
> --zmq tcp://*:6445 <tcp://*:6445>%EXPORTER_IPV4_ADDRESS 
> -T "@NTOPNG@"

exporter ipv4 address must go into the template::

-T "@NTOPNG@ %EXPORTER_IPV4_ADDRESS"

>  
> 
> ntopng runs with : (cat /etc/ntopng/ntopng.conf)
> -i="tcp://127.0.0.1:6445 <http://127.0.0.1:6445/>"
> -m=<my local subnet>
> -F="mysql;/var/run/mysqld/mysqld.sock;ntopng;flows-%Y.%m.%d;ntopng;ntopng"

-F contains duplicated conf. Check that.

> 
> I have two hosts sending netflow to nprobe. I don't see two interfaces in ntopng. any reason why ?

Visit ntopng preferences, enable interfaces disaggregation on the basis of the probe ip, and then restart ntopng

> Trafic one one of the hosts which sends netflow to nprobe is always >100mb/s. In ntopng graphs, I do not see this value. It moves between 1 and 10mb/s. why ?

see this explanation: https://github.com/ntop/ntopng/issues/1359#issuecomment-320949928 <https://github.com/ntop/ntopng/issues/1359#issuecomment-320949928>


Regards,
Simone

> 
> I'm running ntop/nprobe from ntop debian repositories, latest version (upgraded this morning).
> 
> Regards
> Cédriic
> _______________________________________________
> Ntop mailing list
> [email protected]
> http://listgateway.unipi.it/mailman/listinfo/ntop

_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop