deri at ntop
May 31, 2011, 10:59 AM
Post #8 of 9
On May 31, 2011, at 11:19 AM, Daniel Aschwanden wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
> Ciao Luca
> The interfaces are tagged correctly, however the direction field
> template field id 61 is not set correctly (always to zero (inbound))
> nprobe -h:
> [ 61] %DIRECTION %flowDirection It
> indicates where a sample has been taken (always 0)
> Normally, this field have to be set to 1 if it is egress traffic and to
> 0 if it is inbound traffic. So if this help output is correct, I've no
> chance of getting the direction field set correctly, whatever I tag my
> interfaces, right?
The direction is 0 because nprobe has no clue about it. This is what collectors expect in this case (I mean a sniffer-based probe)
> when I specify --if-network AA:BB:CC:DD:EE:FF@3 does this mean that all
> packets with AA:BB:CC:DD:EE:FF as SRC MACaddr are assigned with
> interface ident 3?
> If this is correct, and AA:BB:CC:DD:EE:FF is my WAN device MAC, then I
> should be able to specify the traffic direction by:
> nprobe --if-network AA:BB:CC:DD:EE:FF@3 -Q3 -u0 ...
> Thanks a lot for your help!
> On 05/30/2011 10:27 AM, Luca Deri wrote:
>> this is how to do it (nprobe -h)
>> Note on interface indexes and (router) MAC/IP addresses
>> Flags -u and -Q are used to specify the SNMP interface identifiers for emitted flows.
>> However using --if-networks it is possible to specify an interface identifier to which
>> a MAC address or IP network is bound. The syntax of --if-networks is:
>> <MAC|IP/mask>@<interfaceId> where multiple entries can be separated by a comma (,).
>> Example: --if-networks "AA:BB:CC:DD:EE:FF@3,192.168.0.0/24@2" or
>> --if-networks @<fileaname> where <filename> is a file path containing the networks
>> specified using the above format.
>> On May 30, 2011, at 9:28 AM, Daniel Aschwanden wrote:
>> Hi Jaime,
>> Thanks for your reply. You're perfectly right about that. nprobe is only
>> able to figure the direction out of what it gets from pcap.. which is
>> only packetlevel information (L2 and up), the interface information are
>> lost due to the portability reasons of pcap.
>> However, it should be possible to guess the direction either on Level 3
>> information (just specify which networks are "inside") or on Level 2
>> information (just specify which is the "local" MAC address of the TX
>> interface and flag all the traffic with this MAC address as src MAC as
>> outgoing). Unfortunately, the second method will only work if you run
>> nprobe on a in-line device (the traffic flows through) and not on a
>> "tap" device (the traffic is mirrored to the interface).
>> Nevertheless, I haven't figured it out how to achieve that with my
>> version of nprobe, since the direction field of my netflow template is
>> always set to 0 (incoming).
>> Thanks for any comments in advance.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
> -----END PGP SIGNATURE-----
> Ntop-misc mailing list
> Ntop-misc [at] listgateway
Bildung ist kein Verbrechen
Ntop-misc mailing list
Ntop-misc [at] listgateway