Re: Traffic mismatch.

--===============5207640858115533492==
Content-Type: multipart/alternative; boundary="0000000000009ac94805958117c2"

--0000000000009ac94805958117c2
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

At interface page.
There are not drop alerts but there are others:
interface tcp://127.0.0.1:5556 has too many flows. Please extend the
--max-num-flows/-X command line option
Statistics update on interface tcp://127.0.0.1:5556 is too slow. This could
lead to data accuracy loss and missing alerts.
 Update frequency can be tuned by the Hosts Statistics Update Frequency
preference.

Perhaps this is why im not getting propper traffic values.

- Is your netflow configured properly to capture alle the 1.2Gpbs traffic?
It should work ... we already have nfsen working properly here.

- Is your nprobe and ntopng configuration ok? Feel free to share it here
Configuration was taken from quick start section at doc pag, here are both
files content:

[root@netflowB ~]# grep "^[^#;]" /etc/ntopng/ntopng.conf
-i=3Dtcp://127.0.0.1:5556
-G=3D/var/run/ntopng.pid
[root@netflowB ~]# grep "^[^#;]" /etc/nprobe/nprobe.conf
-i=3Dnone
--collector-port=3D6363
--zmq=3Dtcp://*:5556
-n=3Dnone
-T=3D@NTOPNG@
-G=3D/var/run/nprobe.pid

- Actually, your exporting router should point to nprobe
Exporting router is pointing to server ip on port 6363 , (collector and web
interface are on same machine).

Last:
How do you take 95th percentile.
Is it based on selected time slot ?
Is it calculated only on biggest value ? / Does it take multiple sorted
samples and drops its biggest 5% percent  to take next  (propper way) ?
Please explain.

Regards,
Leandro.


<https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3Dlink&utm_c=
ampaign=3Dsig-email&utm_content=3Dwebmail>
Libre
de virus. www.avast.com
<https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3Dlink&utm_c=
ampaign=3Dsig-email&utm_content=3Dwebmail>
<#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

El mar., 22 oct. 2019 a las 4:32, Simone Mainardi (<[email protected]>)
escribi=C3=B3:

> Leandro,
>
> On 21 Oct 2019, at 21:20, Leandro Roggerone <[email protected]>
> wrote:
>
> Hi guys, im testing ntopng + nprobe (30 days licence created).
> I config exporting router to point to ntopng server.
> I can see top talkers on dashboard screen but:
>
> Traffic graph shown at interface->traffic is not ok.
> I can see 620Mbps max when real traffic is 1.2gbps.
> Is there something I need to tweak ?
>
>
> Check the following:
> - Look at the interface page, do you see any collection or drops?
> - Is your netflow configured properly to capture alle the 1.2Gpbs traffic=
?
> - Is your nprobe and ntopng configuration ok? Feel free to share it here
> - Actually, your exporting router should point to nprobe
>
>
> Other:
> After going to hosts->networks , i got:
> "no results found"
>
> What is this section for ?
>
>
> Configure your local networks and they will show up here.
>
> Can I create a subnet filter ? / Do I neet to bui pro version for this ?
>
>
> You can create host pools, up to 8 in the community edition, up to 128 in
> the enterprise.
>
> Simone
>
>
> Regards,
> Leandro.
>
>
> <https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3Dlink&utm=
_campaign=3Dsig-email&utm_content=3Dwebmail> Libre
> de virus. www.avast.com
> <https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3Dlink&utm=
_campaign=3Dsig-email&utm_content=3Dwebmail>
> _______________________________________________
> Ntop mailing list
> [email protected]
> http://listgateway.unipi.it/mailman/listinfo/ntop
>
>
> _______________________________________________
> Ntop mailing list
> [email protected]
> http://listgateway.unipi.it/mailman/listinfo/ntop

--0000000000009ac94805958117c2
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">At interface page.<div>There are not drop alerts but there=
 are others:</div><div><div>interface tcp://<a href=3D"http://127.0.0.1:555=
6">127.0.0.1:5556</a> has too many flows. Please extend the --max-num-flows=
/-X command line option	<br>Statistics update on interface tcp://<a href=3D=
"http://127.0.0.1:5556">127.0.0.1:5556</a> is too slow. This could lead to =
data accuracy loss and missing alerts.</div><div>=C2=A0Update frequency can=
 be tuned by the Hosts Statistics Update Frequency preference.<br></div><di=
v><font color=3D"#500050"><br></font></div><div><font color=3D"#500050">Per=
haps this is why im not getting propper=C2=A0traffic values.</font></div><b=
r><div>- Is your netflow configured properly to capture alle the 1.2Gpbs tr=
affic?</div>It should work ... we already have nfsen working properly here.=
<br><br><div>- Is your nprobe and ntopng configuration ok? Feel free to sha=
re it here</div>Configuration was taken from quick start section at doc pag=
, here are both files content:</div><div><br></div><div>[root@netflowB ~]# =
grep &quot;^[^#;]&quot; /etc/ntopng/ntopng.conf<br>-i=3Dtcp://<a href=3D"ht=
tp://127.0.0.1:5556">127.0.0.1:5556</a><br>-G=3D/var/run/ntopng.pid<br>[roo=
t@netflowB ~]# grep &quot;^[^#;]&quot; /etc/nprobe/nprobe.conf<br>-i=3Dnone=
<br>--collector-port=3D6363<br>--zmq=3Dtcp://*:5556<br>-n=3Dnone<br>-T=3D@N=
TOPNG@<br>-G=3D/var/run/nprobe.pid<br></div><div><div><br></div></div><div>=
<div>- Actually, your exporting router should point to nprobe</div><span cl=
ass=3D"gmail-im" style=3D"color:rgb(80,0,80)">Exporting router is pointing =
to server ip=C2=A0on port 6363 ,=C2=A0</span>(collector and web interface a=
re on same machine).=C2=A0</div><div><br></div><div><font color=3D"#500050"=
>Last:</font></div><div><font color=3D"#500050">How do you take 95th percen=
tile.</font></div><div><font color=3D"#500050">Is it based on selected time=
 slot ?=C2=A0<br>Is it calculated only on biggest value ? / Does it take mu=
ltiple sorted=C2=A0 samples and drops its biggest 5% percent=C2=A0 to take =
next=C2=A0 (propper=C2=A0way) ? Please explain.</font></div><div><font colo=
r=3D"#500050"><br></font></div><div><font color=3D"#500050">Regards,</font>=
</div><div><font color=3D"#500050">Leandro.</font></div><div><font color=3D=
"#500050"><br></font></div></div><div id=3D"DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F=
9FDF2"><br> <table style=3D"border-top:1px solid #d3d4de">
	<tr>
      <td style=3D"width:55px;padding-top:18px"><a href=3D"https://www.avas=
t.com/sig-email?utm_medium=3Demail&amp;utm_source=3Dlink&amp;utm_campaign=
=3Dsig-email&amp;utm_content=3Dwebmail" target=3D"_blank"><img src=3D"https=
://ipmcdn.avast.com/images/icons/icon-envelope-tick-round-orange-animated-n=
o-repeat-v1.gif" alt=3D"" width=3D"46" height=3D"29" style=3D"width: 46px; =
height: 29px;"></a></td>
		<td style=3D"width:470px;padding-top:17px;color:#41424e;font-size:13px;fo=
nt-family:Arial,Helvetica,sans-serif;line-height:18px">Libre de virus. <a h=
ref=3D"https://www.avast.com/sig-email?utm_medium=3Demail&amp;utm_source=3D=
link&amp;utm_campaign=3Dsig-email&amp;utm_content=3Dwebmail" target=3D"_bla=
nk" style=3D"color:#4453ea">www.avast.com</a> 		</td>
	</tr>
</table>
<a href=3D"#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" width=3D"1" height=3D"1">=
</a></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_at=
tr">El mar., 22 oct. 2019 a las 4:32, Simone Mainardi (&lt;<a href=3D"mailt=
o:[email protected]">[email protected]</a>&gt;) escribi=C3=B3:<br></div><bl=
ockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-lef=
t:1px solid rgb(204,204,204);padding-left:1ex"><div style=3D"overflow-wrap:=
 break-word;">Leandro,<br><div><br><blockquote type=3D"cite"><div>On 21 Oct=
 2019, at 21:20, Leandro Roggerone &lt;<a href=3D"mailto:leandro@tecnetmza.=
com.ar" target=3D"_blank">[email protected]</a>&gt; wrote:</div><br>=
<div><div dir=3D"ltr">Hi guys, im testing ntopng=C2=A0+ nprobe (30 days lic=
ence created).<div>I config exporting router to point to ntopng server.</di=
v><div>I can see top talkers on dashboard screen but:</div><div><br></div><=
div>Traffic graph shown at interface-&gt;traffic is not ok.</div><div>I can=
 see 620Mbps max when real traffic is 1.2gbps.</div><div>Is there something=
 I need to tweak ?=C2=A0</div></div></div></blockquote><div><br></div><div>=
Check the following:</div><div>- Look at the interface page, do you see any=
 collection or drops?</div><div>- Is your netflow configured properly to ca=
pture alle the 1.2Gpbs traffic?</div><div>- Is your nprobe and ntopng confi=
guration ok? Feel free to share it here</div><div>- Actually, your exportin=
g router should point to nprobe</div><br><blockquote type=3D"cite"><div><di=
v dir=3D"ltr"><div><br></div><div>Other:</div><div>After going to hosts-&gt=
;networks , i got:<br>&quot;no results found&quot;</div></div></div></block=
quote><blockquote type=3D"cite"><div><div dir=3D"ltr"><div>What is this sec=
tion for ?</div></div></div></blockquote><div><br></div>Configure your loca=
l networks and they will show up here.</div><div><br><blockquote type=3D"ci=
te"><div><div dir=3D"ltr"><div>Can I create a subnet filter ? / Do I neet t=
o bui pro version for this ?</div></div></div></blockquote><div><br></div><=
div>You can create host pools, up to 8 in the community edition, up to 128 =
in the enterprise.</div><div><br></div><div>Simone</div><br><blockquote typ=
e=3D"cite"><div><div dir=3D"ltr"><div><br></div><div>Regards,</div><div>Lea=
ndro.</div></div><div id=3D"gmail-m_2166148101935191951DAB4FAD8-2DD7-40BB-A=
1B8-4E2AA1F9FDF2"><br> <table style=3D"border-top:1px solid rgb(211,212,222=
)">
	<tbody><tr>
      <td style=3D"width:55px;padding-top:18px"><a href=3D"https://www.avas=
t.com/sig-email?utm_medium=3Demail&amp;utm_source=3Dlink&amp;utm_campaign=
=3Dsig-email&amp;utm_content=3Dwebmail" target=3D"_blank"><img src=3D"https=
://ipmcdn.avast.com/images/icons/icon-envelope-tick-round-orange-animated-n=
o-repeat-v1.gif" alt=3D"" width=3D"46" height=3D"29" style=3D"width: 46px; =
height: 29px;"></a></td>
		<td style=3D"width:470px;padding-top:17px;color:rgb(65,66,78);font-size:1=
3px;font-family:Arial,Helvetica,sans-serif;line-height:18px">Libre de virus=
. <a href=3D"https://www.avast.com/sig-email?utm_medium=3Demail&amp;utm_sou=
rce=3Dlink&amp;utm_campaign=3Dsig-email&amp;utm_content=3Dwebmail" style=3D=
"color:rgb(68,83,234)" target=3D"_blank">www.avast.com</a> 		</td>
	</tr>
</tbody></table>
<a width=3D"1" height=3D"1"></a></div>
_______________________________________________<br>Ntop mailing list<br><a =
href=3D"mailto:[email protected]" target=3D"_blank">Ntop@listgatewa=
y.unipi.it</a><br><a href=3D"http://listgateway.unipi.it/mailman/listinfo/n=
top" target=3D"_blank">http://listgateway.unipi.it/mailman/listinfo/ntop</a=
></div></blockquote></div><br></div>_______________________________________=
________<br>
Ntop mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">Ntop@listgat=
eway.unipi.it</a><br>
<a href=3D"http://listgateway.unipi.it/mailman/listinfo/ntop" rel=3D"norefe=
rrer" target=3D"_blank">http://listgateway.unipi.it/mailman/listinfo/ntop</=
a></blockquote></div>

--0000000000009ac94805958117c2--

--===============5207640858115533492==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
--===============5207640858115533492==--