Re: Traffic mismatch.
Simone Mainardi <[email protected]> Tue, 22 Oct 2019 17:23:47 +0200
| Newsgroups | gmane.linux.ntop.general |
|---|---|
| Message-ID | <[email protected]> |
--===============9117832256386637305== Content-Type: multipart/alternative; boundary="Apple-Mail=_B44A05FA-39B2-437F-9D8D-9A50439BBCA7" --Apple-Mail=_B44A05FA-39B2-437F-9D8D-9A50439BBCA7 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Leandro, > On 22 Oct 2019, at 17:02, Leandro Roggerone <[email protected]> = wrote: >=20 > At interface page. > There are not drop alerts but there are others: > interface tcp://127.0.0.1:5556 <http://127.0.0.1:5556/> has too many = flows. Please extend the --max-num-flows/-X command line option=09 > Statistics update on interface tcp://127.0.0.1:5556 = <http://127.0.0.1:5556/> is too slow. This could lead to data accuracy = loss and missing alerts. > Update frequency can be tuned by the Hosts Statistics Update = Frequency preference. >=20 > Perhaps this is why im not getting propper traffic values. Correct. Make sure to opportunely tune -X and -x so that they are much = larger than the actual numbers of flows and hosts you have. You should = not see those errors anymore. By the way, how many flows per second are you collecting? You should see = this information under the interface stats page as well. >=20 > - Is your netflow configured properly to capture alle the 1.2Gpbs = traffic? > It should work ... we already have nfsen working properly here. ok >=20 > - Is your nprobe and ntopng configuration ok? Feel free to share it = here > Configuration was taken from quick start section at doc pag, here are = both files content: >=20 > [root@netflowB ~]# grep "^[^#;]" /etc/ntopng/ntopng.conf > -i=3Dtcp://127.0.0.1:5556 <http://127.0.0.1:5556/> > -G=3D/var/run/ntopng.pid configuration looks good, just add option -m with your local networks. > [root@netflowB ~]# grep "^[^#;]" /etc/nprobe/nprobe.conf > -i=3Dnone > --collector-port=3D6363 > --zmq=3Dtcp://*:5556 > -n=3Dnone > -T=3D@NTOPNG@ > -G=3D/var/run/nprobe.pid >=20 > - Actually, your exporting router should point to nprobe > Exporting router is pointing to server ip on port 6363 , (collector = and web interface are on same machine).=20 this is ok >=20 > Last: > How do you take 95th percentile. > Is it based on selected time slot ?=20 based on the selected time frame. > Is it calculated only on biggest value ? / Does it take multiple = sorted samples and drops its biggest 5% percent to take next (propper = way) ? Please explain. See = https://github.com/ntop/ntopng/blob/dev/scripts/lua/modules/timeseries/ts_= common.lua#L30 = <https://github.com/ntop/ntopng/blob/dev/scripts/lua/modules/timeseries/ts= _common.lua#L30> for the algorithm. >=20 > Regards, > Leandro. >=20 >=20 > = <https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3Dlink&utm_= campaign=3Dsig-email&utm_content=3Dwebmail> Libre de virus. = www.avast.com = <https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3Dlink&utm_= campaign=3Dsig-email&utm_content=3Dwebmail> = <x-msg://28/#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2> > El mar., 22 oct. 2019 a las 4:32, Simone Mainardi (<[email protected] = <mailto:[email protected]>>) escribi=C3=B3: > Leandro, >=20 >> On 21 Oct 2019, at 21:20, Leandro Roggerone <[email protected] = <mailto:[email protected]>> wrote: >>=20 >> Hi guys, im testing ntopng + nprobe (30 days licence created). >> I config exporting router to point to ntopng server. >> I can see top talkers on dashboard screen but: >>=20 >> Traffic graph shown at interface->traffic is not ok. >> I can see 620Mbps max when real traffic is 1.2gbps. >> Is there something I need to tweak ?=20 >=20 > Check the following: > - Look at the interface page, do you see any collection or drops? > - Is your netflow configured properly to capture alle the 1.2Gpbs = traffic? > - Is your nprobe and ntopng configuration ok? Feel free to share it = here > - Actually, your exporting router should point to nprobe >=20 >>=20 >> Other: >> After going to hosts->networks , i got: >> "no results found" >> What is this section for ? >=20 > Configure your local networks and they will show up here. >=20 >> Can I create a subnet filter ? / Do I neet to bui pro version for = this ? >=20 > You can create host pools, up to 8 in the community edition, up to 128 = in the enterprise. >=20 > Simone >=20 >>=20 >> Regards, >> Leandro. >>=20 >> = <https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3Dlink&utm_= campaign=3Dsig-email&utm_content=3Dwebmail> Libre de virus. = www.avast.com = <https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3Dlink&utm_= campaign=3Dsig-email&utm_content=3Dwebmail> = <>_______________________________________________ >> Ntop mailing list >> [email protected] <mailto:[email protected]> >> http://listgateway.unipi.it/mailman/listinfo/ntop = <http://listgateway.unipi.it/mailman/listinfo/ntop> > _______________________________________________ > Ntop mailing list > [email protected] <mailto:[email protected]> > http://listgateway.unipi.it/mailman/listinfo/ntop = <http://listgateway.unipi.it/mailman/listinfo/ntop>_______________________= ________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop --Apple-Mail=_B44A05FA-39B2-437F-9D8D-9A50439BBCA7 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;" = class=3D"">Leandro,<br class=3D""><div><br class=3D""><blockquote = type=3D"cite" class=3D""><div class=3D"">On 22 Oct 2019, at 17:02, = Leandro Roggerone <<a href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>> wrote:</div><br = class=3D"Apple-interchange-newline"><div class=3D""><div dir=3D"ltr" = class=3D"">At interface page.<div class=3D"">There are not drop alerts = but there are others:</div><div class=3D""><div class=3D"">interface = tcp://<a href=3D"http://127.0.0.1:5556/" class=3D"">127.0.0.1:5556</a> = has too many flows. Please extend the --max-num-flows/-X command line = option <br class=3D"">Statistics update on interface tcp://<a = href=3D"http://127.0.0.1:5556/" class=3D"">127.0.0.1:5556</a> is too = slow. This could lead to data accuracy loss and missing = alerts.</div><div class=3D""> Update frequency can be tuned by the = Hosts Statistics Update Frequency preference.<br class=3D""></div><div = class=3D""><font color=3D"#500050" class=3D""><br = class=3D""></font></div><div class=3D""><font color=3D"#500050" = class=3D"">Perhaps this is why im not getting propper traffic = values.</font></div></div></div></div></blockquote><div><br = class=3D""></div><div>Correct. Make sure to opportunely tune -X and -x = so that they are much larger than the actual numbers of flows and hosts = you have. You should not see those errors anymore.</div><div><br = class=3D""></div><div>By the way, how many flows per second are you = collecting? You should see this information under the interface stats = page as well.</div><br class=3D""><blockquote type=3D"cite" = class=3D""><div class=3D""><div dir=3D"ltr" class=3D""><div class=3D""><br= class=3D""><div class=3D"">- Is your netflow configured properly to = capture alle the 1.2Gpbs traffic?</div>It should work ... we already = have nfsen working properly here.<br = class=3D""></div></div></div></blockquote><div><br = class=3D""></div><div>ok</div><br class=3D""><blockquote type=3D"cite" = class=3D""><div class=3D""><div dir=3D"ltr" class=3D""><div class=3D""><br= class=3D""><div class=3D"">- Is your nprobe and ntopng configuration = ok? Feel free to share it here</div>Configuration was taken from quick = start section at doc pag, here are both files content:</div><div = class=3D""><br class=3D""></div><div class=3D"">[root@netflowB ~]# grep = "^[^#;]" /etc/ntopng/ntopng.conf<br class=3D"">-i=3Dtcp://<a = href=3D"http://127.0.0.1:5556/" class=3D"">127.0.0.1:5556</a><br = class=3D"">-G=3D/var/run/ntopng.pid<br = class=3D""></div></div></div></blockquote><div><br = class=3D""></div><div>configuration looks good, just add option -m with = your local networks.</div><br class=3D""><blockquote type=3D"cite" = class=3D""><div class=3D""><div dir=3D"ltr" class=3D""><div = class=3D"">[root@netflowB ~]# grep "^[^#;]" /etc/nprobe/nprobe.conf<br = class=3D"">-i=3Dnone<br class=3D"">--collector-port=3D6363<br = class=3D"">--zmq=3D<a href=3D"tcp://*:5556" class=3D"">tcp://*:5556</a><br= class=3D"">-n=3Dnone<br class=3D"">-T=3D@NTOPNG@<br = class=3D"">-G=3D/var/run/nprobe.pid<br class=3D""></div><div = class=3D""><div class=3D""><br class=3D""></div></div><div class=3D""><div= class=3D"">- Actually, your exporting router should point to = nprobe</div><span class=3D"gmail-im" = style=3D"color:rgb(80,0,80)">Exporting router is pointing to server = ip on port 6363 , </span>(collector and web interface are on = same machine). </div></div></div></blockquote><div><br = class=3D""></div><div>this is ok</div><br class=3D""><blockquote = type=3D"cite" class=3D""><div class=3D""><div dir=3D"ltr" class=3D""><div = class=3D""><br class=3D""></div><div class=3D""><font color=3D"#500050" = class=3D"">Last:</font></div><div class=3D""><font color=3D"#500050" = class=3D"">How do you take 95th percentile.</font></div><div = class=3D""><font color=3D"#500050" class=3D"">Is it based on selected = time slot ? <br = class=3D""></font></div></div></div></blockquote><div><br = class=3D""></div><div>based on the selected time frame.</div><br = class=3D""><blockquote type=3D"cite" class=3D""><div class=3D""><div = dir=3D"ltr" class=3D""><div class=3D""><font color=3D"#500050" = class=3D"">Is it calculated only on biggest value ? / Does it take = multiple sorted samples and drops its biggest 5% percent to = take next (propper way) ? Please = explain.</font></div></div></div></blockquote><div><br = class=3D""></div><div>See <a = href=3D"https://github.com/ntop/ntopng/blob/dev/scripts/lua/modules/timese= ries/ts_common.lua#L30" = class=3D"">https://github.com/ntop/ntopng/blob/dev/scripts/lua/modules/tim= eseries/ts_common.lua#L30</a> for the algorithm.</div><br = class=3D""><blockquote type=3D"cite" class=3D""><div class=3D""><div = dir=3D"ltr" class=3D""><div class=3D""><font color=3D"#500050" = class=3D""><br class=3D""></font></div><div class=3D""><font = color=3D"#500050" class=3D"">Regards,</font></div><div class=3D""><font = color=3D"#500050" class=3D"">Leandro.</font></div><div class=3D""><font = color=3D"#500050" class=3D""><br class=3D""></font></div></div><div = id=3D"DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" class=3D""><br class=3D""> = <table style=3D"border-top:1px solid #d3d4de" class=3D""> <tbody class=3D""><tr class=3D""> <td style=3D"width:55px;padding-top:18px" class=3D""><a = href=3D"https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3D= link&utm_campaign=3Dsig-email&utm_content=3Dwebmail" = target=3D"_blank" class=3D""><img = src=3D"https://ipmcdn.avast.com/images/icons/icon-envelope-tick-round-oran= ge-animated-no-repeat-v1.gif" alt=3D"" width=3D"46" height=3D"29" = style=3D"width: 46px; height: 29px;" class=3D""></a></td> <td = style=3D"width:470px;padding-top:17px;color:#41424e;font-size:13px;font-fa= mily:Arial,Helvetica,sans-serif;line-height:18px" class=3D"">Libre de = virus. <a = href=3D"https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3D= link&utm_campaign=3Dsig-email&utm_content=3Dwebmail" = target=3D"_blank" style=3D"color:#4453ea" class=3D"">www.avast.com</a> = </td> </tr> </tbody></table> <a href=3D"x-msg://28/#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" width=3D"1" = height=3D"1" class=3D""></a></div><br class=3D""><div = class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">El mar., 22 = oct. 2019 a las 4:32, Simone Mainardi (<<a = href=3D"mailto:[email protected]" class=3D"">[email protected]</a>>) = escribi=C3=B3:<br class=3D""></div><blockquote class=3D"gmail_quote" = style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid = rgb(204,204,204);padding-left:1ex"><div style=3D"overflow-wrap: = break-word;" class=3D"">Leandro,<br class=3D""><div class=3D""><br = class=3D""><blockquote type=3D"cite" class=3D""><div class=3D"">On 21 = Oct 2019, at 21:20, Leandro Roggerone <<a = href=3D"mailto:[email protected]" target=3D"_blank" = class=3D"">[email protected]</a>> wrote:</div><br = class=3D""><div class=3D""><div dir=3D"ltr" class=3D"">Hi guys, im = testing ntopng + nprobe (30 days licence created).<div class=3D"">I = config exporting router to point to ntopng server.</div><div class=3D"">I = can see top talkers on dashboard screen but:</div><div class=3D""><br = class=3D""></div><div class=3D"">Traffic graph shown at = interface->traffic is not ok.</div><div class=3D"">I can see 620Mbps = max when real traffic is 1.2gbps.</div><div class=3D"">Is there = something I need to tweak ? </div></div></div></blockquote><div = class=3D""><br class=3D""></div><div class=3D"">Check the = following:</div><div class=3D"">- Look at the interface page, do you see = any collection or drops?</div><div class=3D"">- Is your netflow = configured properly to capture alle the 1.2Gpbs traffic?</div><div = class=3D"">- Is your nprobe and ntopng configuration ok? Feel free to = share it here</div><div class=3D"">- Actually, your exporting router = should point to nprobe</div><br class=3D""><blockquote type=3D"cite" = class=3D""><div class=3D""><div dir=3D"ltr" class=3D""><div class=3D""><br= class=3D""></div><div class=3D"">Other:</div><div class=3D"">After = going to hosts->networks , i got:<br class=3D"">"no results = found"</div></div></div></blockquote><blockquote type=3D"cite" = class=3D""><div class=3D""><div dir=3D"ltr" class=3D""><div = class=3D"">What is this section for ?</div></div></div></blockquote><div = class=3D""><br class=3D""></div>Configure your local networks and they = will show up here.</div><div class=3D""><br class=3D""><blockquote = type=3D"cite" class=3D""><div class=3D""><div dir=3D"ltr" class=3D""><div = class=3D"">Can I create a subnet filter ? / Do I neet to bui pro version = for this ?</div></div></div></blockquote><div class=3D""><br = class=3D""></div><div class=3D"">You can create host pools, up to 8 in = the community edition, up to 128 in the enterprise.</div><div = class=3D""><br class=3D""></div><div class=3D"">Simone</div><br = class=3D""><blockquote type=3D"cite" class=3D""><div class=3D""><div = dir=3D"ltr" class=3D""><div class=3D""><br class=3D""></div><div = class=3D"">Regards,</div><div class=3D"">Leandro.</div></div><div = id=3D"gmail-m_2166148101935191951DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2" = class=3D""><br class=3D""> <table style=3D"border-top:1px solid = rgb(211,212,222)" class=3D""> <tbody class=3D""><tr class=3D""> <td style=3D"width:55px;padding-top:18px" class=3D""><a = href=3D"https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3D= link&utm_campaign=3Dsig-email&utm_content=3Dwebmail" = target=3D"_blank" class=3D""><img = src=3D"https://ipmcdn.avast.com/images/icons/icon-envelope-tick-round-oran= ge-animated-no-repeat-v1.gif" alt=3D"" width=3D"46" height=3D"29" = style=3D"width: 46px; height: 29px;" class=3D""></a></td> <td = style=3D"width:470px;padding-top:17px;color:rgb(65,66,78);font-size:13px;f= ont-family:Arial,Helvetica,sans-serif;line-height:18px" class=3D"">Libre = de virus. <a = href=3D"https://www.avast.com/sig-email?utm_medium=3Demail&utm_source=3D= link&utm_campaign=3Dsig-email&utm_content=3Dwebmail" = style=3D"color:rgb(68,83,234)" target=3D"_blank" = class=3D"">www.avast.com</a> </td> </tr> </tbody></table> <a width=3D"1" height=3D"1" class=3D""></a></div> _______________________________________________<br class=3D"">Ntop = mailing list<br class=3D""><a href=3D"mailto:[email protected]" = target=3D"_blank" class=3D"">[email protected]</a><br = class=3D""><a href=3D"http://listgateway.unipi.it/mailman/listinfo/ntop" = target=3D"_blank" = class=3D"">http://listgateway.unipi.it/mailman/listinfo/ntop</a></div></bl= ockquote></div><br = class=3D""></div>_______________________________________________<br = class=3D""> Ntop mailing list<br class=3D""> <a href=3D"mailto:[email protected]" target=3D"_blank" = class=3D"">[email protected]</a><br class=3D""> <a href=3D"http://listgateway.unipi.it/mailman/listinfo/ntop" = rel=3D"noreferrer" target=3D"_blank" = class=3D"">http://listgateway.unipi.it/mailman/listinfo/ntop</a></blockquo= te></div> _______________________________________________<br class=3D"">Ntop = mailing list<br class=3D""><a href=3D"mailto:[email protected]" = class=3D"">[email protected]</a><br = class=3D"">http://listgateway.unipi.it/mailman/listinfo/ntop</div></blockq= uote></div><br class=3D""></body></html>= --Apple-Mail=_B44A05FA-39B2-437F-9D8D-9A50439BBCA7-- --===============9117832256386637305== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop --===============9117832256386637305==--