Re: Assistance with nProbe with Accolade Cards

--===============0216178261035573529==
Content-Type: multipart/alternative; boundary="000000000000cc5a6c0592348053"

--000000000000cc5a6c0592348053
Content-Type: text/plain; charset="UTF-8"

Thank you, Alfredo for the prompt response.

As of the packet dump, do you mean raw packets to pcap files?

--My setup is such that I need to capture the raw packets and then push
them to elasticsearch so that I can see them on the kibana dashboard.

Now if I get pcap files. I will have to run them through an application
that can read pcap's (like tcpdump or suricata) and then push it to
elasticsearch.

Thanks and regards,
-=Srijan Nandi


On Tue, 10 Sep 2019 at 20:49, Alfredo Cardigliano <[email protected]>
wrote:

> Hi
> please check https://www.ntop.org/guides/pf_ring/modules/accolade.html for
> the port naming convention,
> you can use pfcount on the same interface to check if traffic is flowing
> and print statistics.
> As of the packet dump, do you mean raw packets to pcap files?
>
> Alfredo
>
> On 10 Sep 2019, at 17:05, Srijan Nandi <[email protected]> wrote:
>
> Hello Everyone,
>
> I am trying parse GTPv2 traffic using nProbe, PF_RING for Accolade Cards.
> We also have purchased the GTPv2 plugin.
>
> Currently, my nprobe config file looks like this:
> -g=/var/run/nprobe.pid
> -G=
> -i=anic:0
> -n=none
> --dump-path=/var/log/nprobe
> --cpu-affinity=2,3,4,5
> --discard-unknown-flows=1
> --verbose=2
> --dump-format=b
> --capture-direction=1
> --drop-flow-no-plugin
> --imsi-aggregation
> --aggregate-gtp-tunnels
>
> I am not sure how to check which accolade card is being used currently. Is
> there is way someone can point me to figure out which accolade card number
> to use in the interface section  of the nprobe.conf file.
>
> Also I need to see the entire IP packet after it has been parsed by
> nProbe. I need to dump the file in the local disk as well.
>
> I will be more than happy to provide more information if required.
>
> Thanks and Regards,
> -=Srijan Nandi
> _______________________________________________
> Ntop mailing list
> [email protected]
> http://listgateway.unipi.it/mailman/listinfo/ntop
>
>
> _______________________________________________
> Ntop mailing list
> [email protected]
> http://listgateway.unipi.it/mailman/listinfo/ntop



-- 
-=Srijan Nandi

--000000000000cc5a6c0592348053
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div>Thank you, Alfredo for the prompt re=
sponse.</div><div dir=3D"ltr"><br></div><div dir=3D"ltr">As of the packet d=
ump, do you mean raw packets to pcap files?<br></div><div dir=3D"ltr"><br><=
/div><div>--My setup is such that I need to capture the raw packets and the=
n push them to elasticsearch so that I can see them on the kibana dashboard=
.</div><div><br></div><div>Now if I get pcap files. I will have to run them=
 through an application that can read pcap&#39;s (like tcpdump or suricata)=
 and then push it to elasticsearch.</div><div><br></div><div>Thanks and reg=
ards,</div><div>-=3DSrijan Nandi</div><div><br></div></div></div><br><div c=
lass=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Tue, 10 Sep 2=
019 at 20:49, Alfredo Cardigliano &lt;<a href=3D"mailto:[email protected]=
g">[email protected]</a>&gt; wrote:<br></div><blockquote class=3D"gmail_=
quote" style=3D"margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-=
style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div style=
=3D"word-wrap:break-word;line-break:after-white-space"><div>Hi</div><div>pl=
ease check=C2=A0<a href=3D"https://www.ntop.org/guides/pf_ring/modules/acco=
lade.html" target=3D"_blank">https://www.ntop.org/guides/pf_ring/modules/ac=
colade.html</a>=C2=A0for the port naming convention,</div><div>you can use =
pfcount on the same interface to check if traffic is flowing and print stat=
istics.</div><div>As of the packet dump, do you mean raw packets to pcap fi=
les?</div><div><br></div><div>Alfredo</div><div><br><blockquote type=3D"cit=
e"><div>On 10 Sep 2019, at 17:05, Srijan Nandi &lt;<a href=3D"mailto:srijan=
[email protected]" target=3D"_blank">[email protected]</a>&gt; wrote:</=
div><br class=3D"gmail-m_1218847242758577488Apple-interchange-newline"><div=
><div dir=3D"ltr"><div dir=3D"ltr">Hello Everyone,<div><br></div><div>I am =
trying parse GTPv2 traffic using nProbe, PF_RING for Accolade Cards. We als=
o have purchased the GTPv2 plugin.</div><div><br></div><div>Currently, my n=
probe config file looks like this:</div><div><div>-g=3D/var/run/nprobe.pid<=
/div><div>-G=3D</div><div>-i=3Danic:0</div><div>-n=3Dnone</div><div>--dump-=
path=3D/var/log/nprobe</div><div>--cpu-affinity=3D2,3,4,5</div><div>--disca=
rd-unknown-flows=3D1</div><div>--verbose=3D2</div><div>--dump-format=3Db</d=
iv><div>--capture-direction=3D1</div><div>--drop-flow-no-plugin</div><div>-=
-imsi-aggregation</div><div>--aggregate-gtp-tunnels</div><div><br></div><di=
v>I am not sure how to check which accolade card is being used currently. I=
s there is way someone can point me to figure out which accolade card numbe=
r to use in the interface section =C2=A0of the nprobe.conf file.</div><div>=
<br></div><div>Also I need to see the entire IP packet after it has been pa=
rsed by nProbe. I need to dump the file in the local disk as well.</div><di=
v><br></div><div>I will be more than happy to provide more information if r=
equired.</div><div><br></div><div>Thanks and Regards,</div><div>-=3DSrijan =
Nandi</div></div></div></div>
_______________________________________________<br>Ntop mailing list<br><a =
href=3D"mailto:[email protected]" target=3D"_blank">Ntop@listgatewa=
y.unipi.it</a><br><a href=3D"http://listgateway.unipi.it/mailman/listinfo/n=
top" target=3D"_blank">http://listgateway.unipi.it/mailman/listinfo/ntop</a=
></div></blockquote></div><br></div>_______________________________________=
________<br>
Ntop mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">Ntop@listgat=
eway.unipi.it</a><br>
<a href=3D"http://listgateway.unipi.it/mailman/listinfo/ntop" rel=3D"norefe=
rrer" target=3D"_blank">http://listgateway.unipi.it/mailman/listinfo/ntop</=
a></blockquote></div><br clear=3D"all"><div><br></div>-- <br><div dir=3D"lt=
r" class=3D"gmail_signature"><div dir=3D"ltr"><div><div dir=3D"ltr"><div di=
r=3D"ltr">-=3DSrijan Nandi<br></div></div></div></div></div>

--000000000000cc5a6c0592348053--

--===============0216178261035573529==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
--===============0216178261035573529==--