Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: NTop: Misc

multi nprobe with ntop

 

 

NTop misc RSS feed   Index | Next | Previous | View Threaded


A.Seitz at liwest

Oct 29, 2009, 5:08 AM

Post #1 of 2 (992 views)
Permalink
multi nprobe with ntop

Hi all,


I am currently running a installation of nprobe (12 nodes) which are all
logging to a cisco netflow collector for accounting.
The probes monitor 6 Gigabit Links one probe for RX and one for TX each.


Now I want to feed flows to a ntop installation as well.
I was trying to run a second instance on the nprobe machines with my ntop
machine as netflow destination.
But I am not absolutely sure how to configure that correctly.
My first try was to let all machines send flows to one "netflow device" on
the ntop machine.
That does not work very well because all the nprobe machines send flows with
the same interface id and so I get a lot of errors regarding the rrd files
update with same timestamps and so on.
Do I have to specify a "netflow device" for each of the probes on the ntop
host? (with different UDP Ports)
But how do I get summary graphs in ntop then?
I did not find any reference to a multi nprobe installation in the docs.


Regards
Attachments: smime.p7s (3.03 KB)


deri at ntop

Nov 2, 2009, 3:45 AM

Post #2 of 2 (878 views)
Permalink
Re: multi nprobe with ntop [In reply to]

Hi Alexander

On 10/29/2009 01:08 PM, Seitz Alexander wrote:
Hi all, I am currently running a installation of nprobe (12 nodes) which are all logging to a cisco netflow collector for accounting. The probes monitor 6 Gigabit Links one probe for RX and one for TX each. Now I want to feed flows to a ntop installation as well. I was trying to run a second instance on the nprobe machines with my ntop machine as netflow destination. But I am not absolutely sure how to configure that correctly. My first try was to let all machines send flows to one "netflow device" on the ntop machine. That does not work very well because all the nprobe machines send flows with the same interface id and so I get a lot of errors regarding the rrd files update with same timestamps and so on.
You can specify interface ID on the nprobe command line. Can you please send a log of the problem?
Do I have to specify a "netflow device" for each of the probes on the ntop host? (with different UDP Ports)
Correct, this is the best solution if you keep the traffic split, but apparently this is not what you plan to do
But how do I get summary graphs in ntop then?
This is currently not possible: better to try to merge traffic all in one interface/
I did not find any reference to a multi nprobe installation in the docs.

Cheers Luca

Regards
_______________________________________________ Ntop-misc mailing list Ntop-misc [at] listgateway http://listgateway.unipi.it/mailman/listinfo/ntop-misc"]http://listgateway.unipi.it/mailman/listinfo/ntop-misc

NTop misc RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.