Re: Help configuring nProbe with ntopng

--===============9020629969558966962==
Content-Type: multipart/alternative; boundary="000000000000bf8f4e059236567a"

--000000000000bf8f4e059236567a
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hello Alfredo,

Let me explain my setup and then you can suggest the best way out.

I have a debian 9 with accolade NIC cards without an IP address. These
cards are a tap to the GTP traffic. So they get to see all  the GTP-C
traffic.

What I want to achieve:

1. Be able to read the entire GTP-C flow.
2. Dump this entire flow to a local disk. I need to read the entire content
of the packet. Including IP Address, MSISDN number, LAC etc.
3. Use Filebeat to export this to Logstash and dump it to an elasticsearch
database.

Now, what I read was I still would require ntopng to read the GTP parse
data from nProbe and then log them to a disk and export it to logstash and
elasticsearch.

-=3DSrijan Nandi

On Tue, 10 Sep 2019 at 22:56, Alfredo Cardigliano <[email protected]>
wrote:

> Hi
> you should not use the accolade adapter for exporting flow data to ntopng=
,
> that=E2=80=99s for
> capturing raw packets only, you should use the management interface (or
> other standard interfaces) for that.
>
> Alfredo
>
> > On 10 Sep 2019, at 19:22, Srijan Nandi <[email protected]> wrote:
> >
> > Hello Everyone,
> >
> > I require some assistance with the following.
> >
> > I have already configured nProbe to list to accolade NIC card. Now I
> need help in configuring ntopng so that it reads from nprobe.
> >
> > The problem, my accolade cards do not have an IP address as this entire
> setup is in Layer 2 mode. So I am not able to figure out how to use zmq i=
n
> the nprobe config file and utilise the same in the ntopng config file.
> >
> > --
> > -=3DSrijan Nandi
> > _______________________________________________
> > Ntop mailing list
> > [email protected]
> > http://listgateway.unipi.it/mailman/listinfo/ntop
>
> _______________________________________________
> Ntop mailing list
> [email protected]
> http://listgateway.unipi.it/mailman/listinfo/ntop



--=20
-=3DSrijan Nandi

--000000000000bf8f4e059236567a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hello Alfredo,<div><br></div><div>Let me explain my setup =
and then you can suggest the best way out.</div><div><br></div><div>I have =
a debian 9 with accolade NIC cards without an IP address. These cards are a=
 tap to the GTP traffic. So they get to see all =C2=A0the GTP-C traffic.</d=
iv><div><br></div><div>What I want to achieve:</div><div><br></div><div>1. =
Be able to read the entire GTP-C flow.</div><div>2. Dump this entire flow t=
o a local disk. I need to read the entire content of the packet. Including =
IP Address, MSISDN number, LAC etc.</div><div>3. Use Filebeat to export thi=
s to Logstash and dump it to an elasticsearch database.</div><div><br></div=
><div>Now, what I read was I still would require ntopng to read the GTP par=
se data from nProbe and then log them to a disk and export it to logstash a=
nd elasticsearch.</div><div><br></div><div>-=3DSrijan Nandi</div></div><br>=
<div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Tue, 10=
 Sep 2019 at 22:56, Alfredo Cardigliano &lt;<a href=3D"mailto:cardigliano@n=
top.org">[email protected]</a>&gt; wrote:<br></div><blockquote class=3D"=
gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left-width:1px;border=
-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">Hi<b=
r>
you should not use the accolade adapter for exporting flow data to ntopng, =
that=E2=80=99s for<br>
capturing raw packets only, you should use the management interface (or oth=
er standard interfaces) for that.<br>
<br>
Alfredo<br>
<br>
&gt; On 10 Sep 2019, at 19:22, Srijan Nandi &lt;<a href=3D"mailto:srijan.na=
[email protected]" target=3D"_blank">[email protected]</a>&gt; wrote:<br>
&gt; <br>
&gt; Hello Everyone,<br>
&gt; <br>
&gt; I require some assistance with the following.<br>
&gt; <br>
&gt; I have already configured nProbe to list to accolade NIC card. Now I n=
eed help in configuring ntopng so that it reads from nprobe. <br>
&gt; <br>
&gt; The problem, my accolade cards do not have an IP address as this entir=
e setup is in Layer 2 mode. So I am not able to figure out how to use zmq i=
n the nprobe config file and utilise the same in the ntopng config file.<br=
>
&gt; <br>
&gt; -- <br>
&gt; -=3DSrijan Nandi<br>
&gt; _______________________________________________<br>
&gt; Ntop mailing list<br>
&gt; <a href=3D"mailto:[email protected]" target=3D"_blank">Ntop@li=
stgateway.unipi.it</a><br>
&gt; <a href=3D"http://listgateway.unipi.it/mailman/listinfo/ntop" rel=3D"n=
oreferrer" target=3D"_blank">http://listgateway.unipi.it/mailman/listinfo/n=
top</a><br>
<br>
_______________________________________________<br>
Ntop mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">Ntop@listgat=
eway.unipi.it</a><br>
<a href=3D"http://listgateway.unipi.it/mailman/listinfo/ntop" rel=3D"norefe=
rrer" target=3D"_blank">http://listgateway.unipi.it/mailman/listinfo/ntop</=
a></blockquote></div><br clear=3D"all"><div><br></div>-- <br><div dir=3D"lt=
r" class=3D"gmail_signature"><div dir=3D"ltr"><div><div dir=3D"ltr"><div di=
r=3D"ltr">-=3DSrijan Nandi<br></div></div></div></div></div>

--000000000000bf8f4e059236567a--

--===============9020629969558966962==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
--===============9020629969558966962==--