Re: Understanding nprobe
Simone Mainardi <[email protected]> Mon, 1 Jul 2019 08:22:16 +0200
| Newsgroups | gmane.linux.ntop.general |
|---|---|
| Message-ID | <[email protected]> |
--===============6764275738647416156== Content-Type: multipart/alternative; boundary="Apple-Mail=_3633FB55-46C4-4F58-921A-FD3AB0148AC9" --Apple-Mail=_3633FB55-46C4-4F58-921A-FD3AB0148AC9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Andreas, > On 28 Jun 2019, at 10:50, Andreas Br=C3=BCck = <[email protected]> wrote: >=20 > Hello everybody, >=20 > i have build up a virtual test environment to get familiar with flow = monitoring. I installed ntop on a server and nprobe on a gateway = (provides access to the internet). I hoped that nprobe is collecting all = the traffic/flows and send it to the ntop server. But it does not work = work me. I don't see any flows if i check it on the ntop web gui. Both = machines could ping each other and no firewall is between them. >=20 > I used the following configuration: >=20 > Ntop-server (ip-address: 194.95.66.100, interface: enp0s8): >=20 > - ntopng -i enp0s8 -i tcp://8.8.8.1:5556 >=20 > Gateway (ip-address: 8.8.8.1, interface: enp0s8): >=20 > - nprobe --zmq tcp://8.8.8.1:5556 -i enp0s8 -n none -T @NTOPNG@ >=20 >=20 I think it could just be something related to the address of the ZMQ = endpoint. Check if ntopng can connect to address 8.8.8.1 port 5556 and = also check if nprobe can bind to address 8.8.8.1 port 5556 on the = machine where it's running. Just look at the output of both software and = you'll see if there are errors. If ntopng and nprobe are communicating = successfully you should see increasing counters for flows and updates, = in the interface details page in the ntopng UI. Note that you can also use nprobe in the so-called --zmq-probe-mode if = necessary. Have a look at = https://www.ntop.org/nprobe/best-practices-for-the-collection-of-flows-wit= h-ntopng-and-nprobe/ = <https://www.ntop.org/nprobe/best-practices-for-the-collection-of-flows-wi= th-ntopng-and-nprobe/> > If i check the sockets with "ss" there is a established zmq connection = listed between this to server. I also can choose the interface = "tcp://8.8.8.1:5556" in the ntop web gui. But no traffic will be = reported to ntop. I generated traffic with iperf, which comes from a = third server. This traffic transited the gateway interface enp0s8 with = the ip address 8.8.8.1. >=20 > It is possible that i missundertood the function of nprobe? Can i use = only nprobe instead of sflow to collect flows or it is necessary to = combine them? I hope anyone could help me. Thank you very much in = advance. >=20 > Regard, >=20 > Andreas > <https://dict.leo.org/german-english/misunderstood> >=20 >=20 > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop --Apple-Mail=_3633FB55-46C4-4F58-921A-FD3AB0148AC9 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;" class=3D"">Hi = Andreas,<div class=3D""><br class=3D""><div><br class=3D""><blockquote = type=3D"cite" class=3D""><div class=3D"">On 28 Jun 2019, at 10:50, = Andreas Br=C3=BCck <<a href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>> wrote:</div><br = class=3D"Apple-interchange-newline"><div class=3D""> =20 <meta http-equiv=3D"content-type" content=3D"text/html; = charset=3DUTF-8" class=3D""> =20 <div bgcolor=3D"#FFFFFF" text=3D"#000000" class=3D""><p class=3D""><tt = class=3D"">Hello everybody,</tt></p><p class=3D""><tt class=3D"">i have = build up a virtual test environment to get familiar with flow monitoring. I installed ntop on a server and nprobe on a gateway (provides access to the internet). I hoped that nprobe is collecting all the traffic/flows and send it to the ntop server. But it does not work work me. I don't see any flows if i check it on the ntop web gui. Both machines could ping each other and no firewall is between them.<br class=3D""> </tt></p><p class=3D""><tt class=3D"">I used the following = configuration:</tt></p><p class=3D""><tt class=3D"">Ntop-server = (ip-address: 194.95.66.100, interface: enp0s8):</tt></p><p class=3D""><tt = class=3D"">- ntopng -i enp0s8 -i <a href=3D"tcp://8.8.8.1:5556" = class=3D"">tcp://8.8.8.1:5556</a></tt></p><p class=3D""><tt = class=3D"">Gateway (ip-address: 8.8.8.1, interface: enp0s8):</tt></p><p = class=3D""><tt class=3D"">- nprobe --zmq <a href=3D"tcp://8.8.8.1:5556" = class=3D"">tcp://8.8.8.1:5556</a> -i enp0s8 -n none -T @NTOPNG@</tt></p><div class=3D""><br = class=3D""></div></div></div></blockquote><div><br class=3D""></div><div>I= think it could just be something related to the address of the ZMQ = endpoint. Check if ntopng can connect to address 8.8.8.1 port 5556 and = also check if nprobe can bind to address 8.8.8.1 port 5556 on the = machine where it's running. Just look at the output of both software and = you'll see if there are errors. If ntopng and nprobe are communicating = successfully you should see increasing counters for flows and updates, = in the interface details page in the ntopng UI.</div><div><br = class=3D""></div><div>Note that you can also use nprobe in the so-called = --zmq-probe-mode if necessary. Have a look at <a = href=3D"https://www.ntop.org/nprobe/best-practices-for-the-collection-of-f= lows-with-ntopng-and-nprobe/" = class=3D"">https://www.ntop.org/nprobe/best-practices-for-the-collection-o= f-flows-with-ntopng-and-nprobe/</a></div><div><br = class=3D""></div><div><br class=3D""></div><br class=3D""><blockquote = type=3D"cite" class=3D""><div class=3D""><div bgcolor=3D"#FFFFFF" = text=3D"#000000" class=3D""><p class=3D""><tt class=3D"">If i check the = sockets with "ss" there is a established zmq connection listed between this to server. I also can choose the interface "<a href=3D"tcp://8.8.8.1:5556" = class=3D"">tcp://8.8.8.1:5556</a>" in the ntop web gui. But no traffic will be reported to ntop. I generated traffic with iperf, which comes from a third server. This traffic transited the gateway interface enp0s8 with the ip address = 8.8.8.1.</tt></p><p class=3D""><tt class=3D"">It is possible that i = missundertood the function of nprobe? Can i use only nprobe instead of sflow to collect flows or it is necessary to combine them? I hope anyone could help me. Thank you very much in advance.</tt></p><p class=3D""><tt = class=3D"">Regard,</tt></p><p class=3D""><tt class=3D"">Andreas</tt><br = class=3D""> <tt class=3D""></tt><tt class=3D""><a = href=3D"https://dict.leo.org/german-english/misunderstood" = class=3D""><mark class=3D""></mark></a></tt> </p><p class=3D""><br class=3D""> </p> </div> _______________________________________________<br class=3D"">Ntop = mailing list<br class=3D""><a href=3D"mailto:[email protected]" = class=3D"">[email protected]</a><br = class=3D"">http://listgateway.unipi.it/mailman/listinfo/ntop</div></blockq= uote></div><br class=3D""></div></body></html>= --Apple-Mail=_3633FB55-46C4-4F58-921A-FD3AB0148AC9-- --===============6764275738647416156== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop --===============6764275738647416156==--