Re: Assistance with nProbe with Accolade Cards
Alfredo Cardigliano <[email protected]> Tue, 10 Sep 2019 17:19:46 +0200
| Newsgroups | gmane.linux.ntop.general |
|---|---|
| Message-ID | <[email protected]> |
--===============3908819718357118996== Content-Type: multipart/alternative; boundary="Apple-Mail=_A73F8B55-E54F-49B7-B708-7BF3C0548170" --Apple-Mail=_A73F8B55-E54F-49B7-B708-7BF3C0548170 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hi please check https://www.ntop.org/guides/pf_ring/modules/accolade.html = <https://www.ntop.org/guides/pf_ring/modules/accolade.html> for the port = naming convention, you can use pfcount on the same interface to check if traffic is flowing = and print statistics. As of the packet dump, do you mean raw packets to pcap files? Alfredo > On 10 Sep 2019, at 17:05, Srijan Nandi <[email protected]> wrote: >=20 > Hello Everyone, >=20 > I am trying parse GTPv2 traffic using nProbe, PF_RING for Accolade = Cards. We also have purchased the GTPv2 plugin. >=20 > Currently, my nprobe config file looks like this: > -g=3D/var/run/nprobe.pid > -G=3D > -i=3Danic:0 > -n=3Dnone > --dump-path=3D/var/log/nprobe > --cpu-affinity=3D2,3,4,5 > --discard-unknown-flows=3D1 > --verbose=3D2 > --dump-format=3Db > --capture-direction=3D1 > --drop-flow-no-plugin > --imsi-aggregation > --aggregate-gtp-tunnels >=20 > I am not sure how to check which accolade card is being used = currently. Is there is way someone can point me to figure out which = accolade card number to use in the interface section of the nprobe.conf = file. >=20 > Also I need to see the entire IP packet after it has been parsed by = nProbe. I need to dump the file in the local disk as well. >=20 > I will be more than happy to provide more information if required. >=20 > Thanks and Regards, > -=3DSrijan Nandi > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop --Apple-Mail=_A73F8B55-E54F-49B7-B708-7BF3C0548170 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3Dus-ascii"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;" class=3D""><div = class=3D"">Hi</div><div class=3D"">please check <a = href=3D"https://www.ntop.org/guides/pf_ring/modules/accolade.html" = class=3D"">https://www.ntop.org/guides/pf_ring/modules/accolade.html</a>&n= bsp;for the port naming convention,</div><div class=3D"">you can use = pfcount on the same interface to check if traffic is flowing and print = statistics.</div><div class=3D"">As of the packet dump, do you mean raw = packets to pcap files?</div><div class=3D""><br class=3D""></div><div = class=3D"">Alfredo</div><div><br class=3D""><blockquote type=3D"cite" = class=3D""><div class=3D"">On 10 Sep 2019, at 17:05, Srijan Nandi <<a = href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>> wrote:</div><br = class=3D"Apple-interchange-newline"><div class=3D""><div dir=3D"ltr" = class=3D""><div dir=3D"ltr" class=3D"">Hello Everyone,<div class=3D""><br = class=3D""></div><div class=3D"">I am trying parse GTPv2 traffic using = nProbe, PF_RING for Accolade Cards. We also have purchased the GTPv2 = plugin.</div><div class=3D""><br class=3D""></div><div = class=3D"">Currently, my nprobe config file looks like this:</div><div = class=3D""><div class=3D"">-g=3D/var/run/nprobe.pid</div><div = class=3D"">-G=3D</div><div class=3D"">-i=3Danic:0</div><div = class=3D"">-n=3Dnone</div><div = class=3D"">--dump-path=3D/var/log/nprobe</div><div = class=3D"">--cpu-affinity=3D2,3,4,5</div><div = class=3D"">--discard-unknown-flows=3D1</div><div = class=3D"">--verbose=3D2</div><div class=3D"">--dump-format=3Db</div><div = class=3D"">--capture-direction=3D1</div><div = class=3D"">--drop-flow-no-plugin</div><div = class=3D"">--imsi-aggregation</div><div = class=3D"">--aggregate-gtp-tunnels</div><div class=3D""><br = class=3D""></div><div class=3D"">I am not sure how to check which = accolade card is being used currently. Is there is way someone can point = me to figure out which accolade card number to use in the interface = section of the nprobe.conf file.</div><div class=3D""><br = class=3D""></div><div class=3D"">Also I need to see the entire IP packet = after it has been parsed by nProbe. I need to dump the file in the local = disk as well.</div><div class=3D""><br class=3D""></div><div class=3D"">I = will be more than happy to provide more information if = required.</div><div class=3D""><br class=3D""></div><div class=3D"">Thanks= and Regards,</div><div class=3D"">-=3DSrijan = Nandi</div></div></div></div> _______________________________________________<br class=3D"">Ntop = mailing list<br class=3D""><a href=3D"mailto:[email protected]" = class=3D"">[email protected]</a><br = class=3D"">http://listgateway.unipi.it/mailman/listinfo/ntop</div></blockq= uote></div><br class=3D""></body></html>= --Apple-Mail=_A73F8B55-E54F-49B7-B708-7BF3C0548170-- --===============3908819718357118996== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop --===============3908819718357118996==--