Re: Help configuring nProbe with ntopng
Srijan Nandi <[email protected]> Wed, 11 Sep 2019 15:32:51 +0530
| Newsgroups | gmane.linux.ntop.general |
|---|---|
| Message-ID | <CAJjLrOSa2Uervke9zQDtNpo6DgU4M2sqgQLEy0j17hDe4GH7mA@mail.gmail.com> |
--===============4870423206006134004== Content-Type: multipart/alternative; boundary="00000000000066adcf0592442011" --00000000000066adcf0592442011 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thank you, Simone. On Wed, 11 Sep 2019 at 15:19, Simone Mainardi <[email protected]> wrote: > Srijan, > > You can use nProbe to dump to text files (see options -P <path> and -D t)= . > nProbe will generate text files with as many columns as the elements > specified in the template option -T. Then use FileBeat to read those text > files and do the necessary downstream processing. > > Alternatively, you can directly push to ElasticSearch straight from > nProbe. In this case you will need the nProbe export plugin and use > option --elastic. > > Simone > > > > On 10 Sep 2019, at 19:35, Srijan Nandi <[email protected]> wrote: > > Hello Alfredo, > > Let me explain my setup and then you can suggest the best way out. > > I have a debian 9 with accolade NIC cards without an IP address. These > cards are a tap to the GTP traffic. So they get to see all the GTP-C > traffic. > > What I want to achieve: > > 1. Be able to read the entire GTP-C flow. > 2. Dump this entire flow to a local disk. I need to read the entire > content of the packet. Including IP Address, MSISDN number, LAC etc. > 3. Use Filebeat to export this to Logstash and dump it to an elasticsearc= h > database. > > Now, what I read was I still would require ntopng to read the GTP parse > data from nProbe and then log them to a disk and export it to logstash an= d > elasticsearch. > > -=3DSrijan Nandi > > On Tue, 10 Sep 2019 at 22:56, Alfredo Cardigliano <[email protected]> > wrote: > >> Hi >> you should not use the accolade adapter for exporting flow data to >> ntopng, that=E2=80=99s for >> capturing raw packets only, you should use the management interface (or >> other standard interfaces) for that. >> >> Alfredo >> >> > On 10 Sep 2019, at 19:22, Srijan Nandi <[email protected]> wrote: >> > >> > Hello Everyone, >> > >> > I require some assistance with the following. >> > >> > I have already configured nProbe to list to accolade NIC card. Now I >> need help in configuring ntopng so that it reads from nprobe. >> > >> > The problem, my accolade cards do not have an IP address as this entir= e >> setup is in Layer 2 mode. So I am not able to figure out how to use zmq = in >> the nprobe config file and utilise the same in the ntopng config file. >> > >> > -- >> > -=3DSrijan Nandi >> > _______________________________________________ >> > Ntop mailing list >> > [email protected] >> > http://listgateway.unipi.it/mailman/listinfo/ntop >> >> _______________________________________________ >> Ntop mailing list >> [email protected] >> http://listgateway.unipi.it/mailman/listinfo/ntop > > > > -- > -=3DSrijan Nandi > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop > > > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop --=20 -=3DSrijan Nandi --00000000000066adcf0592442011 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Thank you, Simone.</div><br><div class=3D"gmail_quote"><di= v dir=3D"ltr" class=3D"gmail_attr">On Wed, 11 Sep 2019 at 15:19, Simone Mai= nardi <<a href=3D"mailto:[email protected]">[email protected]</a>> wr= ote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px= 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(= 204,204,204);padding-left:1ex"><div style=3D"word-wrap:break-word;line-brea= k:after-white-space"><div>Srijan,</div><div><br></div><div>You can use nPro= be to dump to text files (see options -P <path> and -D t). nProbe wil= l generate text files with as many columns as the elements specified in the= template option -T. Then use FileBeat to read those text files and do the = necessary downstream processing.</div><div><br></div><div>Alternatively, yo= u can directly push to ElasticSearch straight from nProbe. In this case you= will need the nProbe export plugin and use option=C2=A0--elastic.</div><di= v><br></div><div>Simone</div><div><br></div><div><br><div><br><blockquote t= ype=3D"cite"><div>On 10 Sep 2019, at 19:35, Srijan Nandi <<a href=3D"mai= lto:[email protected]" target=3D"_blank">[email protected]</a>>= ; wrote:</div><br class=3D"gmail-m_7821696919704481891Apple-interchange-new= line"><div><div dir=3D"ltr">Hello Alfredo,<div><br></div><div>Let me explai= n my setup and then you can suggest the best way out.</div><div><br></div><= div>I have a debian 9 with accolade NIC cards without an IP address. These = cards are a tap to the GTP traffic. So they get to see all =C2=A0the GTP-C = traffic.</div><div><br></div><div>What I want to achieve:</div><div><br></d= iv><div>1. Be able to read the entire GTP-C flow.</div><div>2. Dump this en= tire flow to a local disk. I need to read the entire content of the packet.= Including IP Address, MSISDN number, LAC etc.</div><div>3. Use Filebeat to= export this to Logstash and dump it to an elasticsearch database.</div><di= v><br></div><div>Now, what I read was I still would require ntopng to read = the GTP parse data from nProbe and then log them to a disk and export it to= logstash and elasticsearch.</div><div><br></div><div>-=3DSrijan Nandi</div= ></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr"= >On Tue, 10 Sep 2019 at 22:56, Alfredo Cardigliano <<a href=3D"mailto:ca= [email protected]" target=3D"_blank">[email protected]</a>> wrote:<b= r></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex= ;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,20= 4,204);padding-left:1ex">Hi<br> you should not use the accolade adapter for exporting flow data to ntopng, = that=E2=80=99s for<br> capturing raw packets only, you should use the management interface (or oth= er standard interfaces) for that.<br> <br> Alfredo<br> <br> > On 10 Sep 2019, at 19:22, Srijan Nandi <<a href=3D"mailto:srijan.na= [email protected]" target=3D"_blank">[email protected]</a>> wrote:<br> > <br> > Hello Everyone,<br> > <br> > I require some assistance with the following.<br> > <br> > I have already configured nProbe to list to accolade NIC card. Now I n= eed help in configuring ntopng so that it reads from nprobe. <br> > <br> > The problem, my accolade cards do not have an IP address as this entir= e setup is in Layer 2 mode. So I am not able to figure out how to use zmq i= n the nprobe config file and utilise the same in the ntopng config file.<br= > > <br> > -- <br> > -=3DSrijan Nandi<br> > _______________________________________________<br> > Ntop mailing list<br> > <a href=3D"mailto:[email protected]" target=3D"_blank">Ntop@li= stgateway.unipi.it</a><br> > <a href=3D"http://listgateway.unipi.it/mailman/listinfo/ntop" rel=3D"n= oreferrer" target=3D"_blank">http://listgateway.unipi.it/mailman/listinfo/n= top</a><br> <br> _______________________________________________<br> Ntop mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank">Ntop@listgat= eway.unipi.it</a><br> <a href=3D"http://listgateway.unipi.it/mailman/listinfo/ntop" rel=3D"norefe= rrer" target=3D"_blank">http://listgateway.unipi.it/mailman/listinfo/ntop</= a></blockquote></div><br clear=3D"all"><div><br></div>-- <br><div dir=3D"lt= r" class=3D"gmail-m_7821696919704481891gmail_signature"><div dir=3D"ltr"><d= iv><div dir=3D"ltr"><div dir=3D"ltr">-=3DSrijan Nandi<br></div></div></div>= </div></div> _______________________________________________<br>Ntop mailing list<br><a = href=3D"mailto:[email protected]" target=3D"_blank">Ntop@listgatewa= y.unipi.it</a><br><a href=3D"http://listgateway.unipi.it/mailman/listinfo/n= top" target=3D"_blank">http://listgateway.unipi.it/mailman/listinfo/ntop</a= ></div></blockquote></div><br></div></div>_________________________________= ______________<br> Ntop mailing list<br> <a href=3D"mailto:[email protected]" target=3D"_blank">Ntop@listgat= eway.unipi.it</a><br> <a href=3D"http://listgateway.unipi.it/mailman/listinfo/ntop" rel=3D"norefe= rrer" target=3D"_blank">http://listgateway.unipi.it/mailman/listinfo/ntop</= a></blockquote></div><br clear=3D"all"><div><br></div>-- <br><div dir=3D"lt= r" class=3D"gmail_signature"><div dir=3D"ltr"><div><div dir=3D"ltr"><div di= r=3D"ltr">-=3DSrijan Nandi<br></div></div></div></div></div> --00000000000066adcf0592442011-- --===============4870423206006134004== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop --===============4870423206006134004==--