Re: Help configuring nProbe with ntopng
Simone Mainardi <[email protected]> Wed, 11 Sep 2019 11:49:00 +0200
| Newsgroups | gmane.linux.ntop.general |
|---|---|
| Message-ID | <[email protected]> |
--===============5766379343161566217== Content-Type: multipart/alternative; boundary="Apple-Mail=_5EF50B25-EC72-4509-AFAB-9C3902A2A1AF" --Apple-Mail=_5EF50B25-EC72-4509-AFAB-9C3902A2A1AF Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Srijan, You can use nProbe to dump to text files (see options -P <path> and -D = t). nProbe will generate text files with as many columns as the elements = specified in the template option -T. Then use FileBeat to read those = text files and do the necessary downstream processing. Alternatively, you can directly push to ElasticSearch straight from = nProbe. In this case you will need the nProbe export plugin and use = option --elastic. Simone > On 10 Sep 2019, at 19:35, Srijan Nandi <[email protected]> wrote: >=20 > Hello Alfredo, >=20 > Let me explain my setup and then you can suggest the best way out. >=20 > I have a debian 9 with accolade NIC cards without an IP address. These = cards are a tap to the GTP traffic. So they get to see all the GTP-C = traffic. >=20 > What I want to achieve: >=20 > 1. Be able to read the entire GTP-C flow. > 2. Dump this entire flow to a local disk. I need to read the entire = content of the packet. Including IP Address, MSISDN number, LAC etc. > 3. Use Filebeat to export this to Logstash and dump it to an = elasticsearch database. >=20 > Now, what I read was I still would require ntopng to read the GTP = parse data from nProbe and then log them to a disk and export it to = logstash and elasticsearch. >=20 > -=3DSrijan Nandi >=20 > On Tue, 10 Sep 2019 at 22:56, Alfredo Cardigliano = <[email protected] <mailto:[email protected]>> wrote: > Hi > you should not use the accolade adapter for exporting flow data to = ntopng, that=E2=80=99s for > capturing raw packets only, you should use the management interface = (or other standard interfaces) for that. >=20 > Alfredo >=20 > > On 10 Sep 2019, at 19:22, Srijan Nandi <[email protected] = <mailto:[email protected]>> wrote: > >=20 > > Hello Everyone, > >=20 > > I require some assistance with the following. > >=20 > > I have already configured nProbe to list to accolade NIC card. Now I = need help in configuring ntopng so that it reads from nprobe.=20 > >=20 > > The problem, my accolade cards do not have an IP address as this = entire setup is in Layer 2 mode. So I am not able to figure out how to = use zmq in the nprobe config file and utilise the same in the ntopng = config file. > >=20 > > --=20 > > -=3DSrijan Nandi > > _______________________________________________ > > Ntop mailing list > > [email protected] <mailto:[email protected]> > > http://listgateway.unipi.it/mailman/listinfo/ntop = <http://listgateway.unipi.it/mailman/listinfo/ntop> >=20 > _______________________________________________ > Ntop mailing list > [email protected] <mailto:[email protected]> > http://listgateway.unipi.it/mailman/listinfo/ntop = <http://listgateway.unipi.it/mailman/listinfo/ntop> >=20 > --=20 > -=3DSrijan Nandi > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop --Apple-Mail=_5EF50B25-EC72-4509-AFAB-9C3902A2A1AF Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;" class=3D""><div = class=3D"">Srijan,</div><div class=3D""><br class=3D""></div><div = class=3D"">You can use nProbe to dump to text files (see options -P = <path> and -D t). nProbe will generate text files with as many = columns as the elements specified in the template option -T. Then use = FileBeat to read those text files and do the necessary downstream = processing.</div><div class=3D""><br class=3D""></div><div = class=3D"">Alternatively, you can directly push to ElasticSearch = straight from nProbe. In this case you will need the nProbe export = plugin and use option --elastic.</div><div class=3D""><br = class=3D""></div><div class=3D"">Simone</div><div class=3D""><br = class=3D""></div><div class=3D""><br class=3D""><div><br = class=3D""><blockquote type=3D"cite" class=3D""><div class=3D"">On 10 = Sep 2019, at 19:35, Srijan Nandi <<a = href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>> wrote:</div><br = class=3D"Apple-interchange-newline"><div class=3D""><div dir=3D"ltr" = class=3D"">Hello Alfredo,<div class=3D""><br class=3D""></div><div = class=3D"">Let me explain my setup and then you can suggest the best way = out.</div><div class=3D""><br class=3D""></div><div class=3D"">I have a = debian 9 with accolade NIC cards without an IP address. These cards are = a tap to the GTP traffic. So they get to see all the GTP-C = traffic.</div><div class=3D""><br class=3D""></div><div class=3D"">What = I want to achieve:</div><div class=3D""><br class=3D""></div><div = class=3D"">1. Be able to read the entire GTP-C flow.</div><div = class=3D"">2. Dump this entire flow to a local disk. I need to read the = entire content of the packet. Including IP Address, MSISDN number, LAC = etc.</div><div class=3D"">3. Use Filebeat to export this to Logstash and = dump it to an elasticsearch database.</div><div class=3D""><br = class=3D""></div><div class=3D"">Now, what I read was I still would = require ntopng to read the GTP parse data from nProbe and then log them = to a disk and export it to logstash and elasticsearch.</div><div = class=3D""><br class=3D""></div><div class=3D"">-=3DSrijan = Nandi</div></div><br class=3D""><div class=3D"gmail_quote"><div = dir=3D"ltr" class=3D"gmail_attr">On Tue, 10 Sep 2019 at 22:56, Alfredo = Cardigliano <<a href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>> wrote:<br = class=3D""></div><blockquote class=3D"gmail_quote" style=3D"margin:0px = 0px 0px = 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(= 204,204,204);padding-left:1ex">Hi<br class=3D""> you should not use the accolade adapter for exporting flow data to = ntopng, that=E2=80=99s for<br class=3D""> capturing raw packets only, you should use the management interface (or = other standard interfaces) for that.<br class=3D""> <br class=3D""> Alfredo<br class=3D""> <br class=3D""> > On 10 Sep 2019, at 19:22, Srijan Nandi <<a = href=3D"mailto:[email protected]" target=3D"_blank" = class=3D"">[email protected]</a>> wrote:<br class=3D""> > <br class=3D""> > Hello Everyone,<br class=3D""> > <br class=3D""> > I require some assistance with the following.<br class=3D""> > <br class=3D""> > I have already configured nProbe to list to accolade NIC card. Now = I need help in configuring ntopng so that it reads from nprobe. <br = class=3D""> > <br class=3D""> > The problem, my accolade cards do not have an IP address as this = entire setup is in Layer 2 mode. So I am not able to figure out how to = use zmq in the nprobe config file and utilise the same in the ntopng = config file.<br class=3D""> > <br class=3D""> > -- <br class=3D""> > -=3DSrijan Nandi<br class=3D""> > _______________________________________________<br class=3D""> > Ntop mailing list<br class=3D""> > <a href=3D"mailto:[email protected]" target=3D"_blank" = class=3D"">[email protected]</a><br class=3D""> > <a href=3D"http://listgateway.unipi.it/mailman/listinfo/ntop" = rel=3D"noreferrer" target=3D"_blank" = class=3D"">http://listgateway.unipi.it/mailman/listinfo/ntop</a><br = class=3D""> <br class=3D""> _______________________________________________<br class=3D""> Ntop mailing list<br class=3D""> <a href=3D"mailto:[email protected]" target=3D"_blank" = class=3D"">[email protected]</a><br class=3D""> <a href=3D"http://listgateway.unipi.it/mailman/listinfo/ntop" = rel=3D"noreferrer" target=3D"_blank" = class=3D"">http://listgateway.unipi.it/mailman/listinfo/ntop</a></blockquo= te></div><br clear=3D"all" class=3D""><div class=3D""><br = class=3D""></div>-- <br class=3D""><div dir=3D"ltr" = class=3D"gmail_signature"><div dir=3D"ltr" class=3D""><div class=3D""><div= dir=3D"ltr" class=3D""><div dir=3D"ltr" class=3D"">-=3DSrijan Nandi<br = class=3D""></div></div></div></div></div> _______________________________________________<br class=3D"">Ntop = mailing list<br class=3D""><a href=3D"mailto:[email protected]" = class=3D"">[email protected]</a><br = class=3D"">http://listgateway.unipi.it/mailman/listinfo/ntop</div></blockq= uote></div><br class=3D""></div></body></html>= --Apple-Mail=_5EF50B25-EC72-4509-AFAB-9C3902A2A1AF-- --===============5766379343161566217== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop --===============5766379343161566217==--