Mailing List Archive: NTop: Users

MPLS

Index | Next | Previous | View Threaded

inetjunkmail at gmail

May 5, 2009, 11:15 AM

Post #1 of 10 (1023 views)
Permalink

MPLS

We're running ntop on an MPLS link. It doesn't seem to work. Are there
plans for MPLS support? Any ideas on how we could pop the MPLS headers
before sending to ntop for processing? We do not have overlapping IPv4
addresses within the MPLS traffic so everything should be good if we can
just get the MPLS header off.

Ggatten at waddell

May 5, 2009, 11:35 AM

Post #2 of 10 (1003 views)
Permalink

Re: MPLS [In reply to]

Can't you capture on the Ethernet side?

________________________________

From: ntop-bounces [at] unipi [mailto:ntop-bounces [at] unipi] On Behalf Of
inetjunkmail
Sent: Tuesday, May 05, 2009 1:15 PM
To: ntop [at] unipi
Subject: [Ntop] MPLS

We're running ntop on an MPLS link. It doesn't seem to work. Are there
plans for MPLS support? Any ideas on how we could pop the MPLS headers
before sending to ntop for processing? We do not have overlapping IPv4
addresses within the MPLS traffic so everything should be good if we can
just get the MPLS header off.

<font size="1">
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'>
</div>
"This email is intended to be reviewed by only the intended recipient
and may contain information that is privileged and/or confidential.
If you are not the intended recipient, you are hereby notified that
any review, use, dissemination, disclosure or copying of this email
and its attachments, if any, is strictly prohibited. If you have
received this email in error, please immediately notify the sender by
return email and delete this email from your system."
</font>

inetjunkmail at gmail

May 6, 2009, 4:11 AM

Post #3 of 10 (978 views)
Permalink

Re: MPLS [In reply to]

Thanks for the reply. This is Ethernet. This is our most convenient choke
point to run ntop but it's an MPLS link between our data center and our ISP.

------------------------------

Message: 2
Date: Tue, 5 May 2009 13:35:12 -0500
From: "Gary Gatten" <Ggatten [at] waddell>
Subject: Re: [Ntop] MPLS
To: <ntop [at] unipi>
Message-ID:
<70C0964126D66F458E688618E1CD008A0793EBA4 [at] WADPEXV0>
Content-Type: text/plain; charset="us-ascii"

Can't you capture on the Ethernet side?

________________________________

From: ntop-bounces [at] unipi [mailto:ntop-bounces [at] unipi] On Behalf Of
inetjunkmail
Sent: Tuesday, May 05, 2009 1:15 PM
To: ntop [at] unipi
Subject: [Ntop] MPLS

We're running ntop on an MPLS link. It doesn't seem to work. Are there
plans for MPLS support? Any ideas on how we could pop the MPLS headers
before sending to ntop for processing? We do not have overlapping IPv4
addresses within the MPLS traffic so everything should be good if we can
just get the MPLS header off.

Ggatten at waddell

May 6, 2009, 5:27 AM

Post #4 of 10 (978 views)
Permalink

Re: MPLS [In reply to]

Somewhere in the path should be standard 802.2 or what's the vlan encap, 802.1q? Or maybe try netflow or sflow?

To your original question I don't think ntop supports native MPLS labels/tagging/encap/ whatever.

________________________________

From: ntop-bounces [at] unipi
To: ntop [at] unipi
Sent: Wed May 06 06:11:40 2009
Subject: Re: [Ntop] MPLS

Thanks for the reply. This is Ethernet. This is our most convenient choke point to run ntop but it's an MPLS link between our data center and our ISP.

------------------------------

Message: 2
Date: Tue, 5 May 2009 13:35:12 -0500
From: "Gary Gatten" <Ggatten [at] waddell>
Subject: Re: [Ntop] MPLS
To: <ntop [at] unipi>
Message-ID:
<70C0964126D66F458E688618E1CD008A0793EBA4 [at] WADPEXV0>
Content-Type: text/plain; charset="us-ascii"

Can't you capture on the Ethernet side?

______________________________
__

From: ntop-bounces [at] unipi [mailto:ntop-bounces [at] unipi] On Behalf Of
inetjunkmail
Sent: Tuesday, May 05, 2009 1:15 PM
To: ntop [at] unipi
Subject: [Ntop] MPLS

We're running ntop on an MPLS link. It doesn't seem to work. Are there
plans for MPLS support? Any ideas on how we could pop the MPLS headers
before sending to ntop for processing? We do not have overlapping IPv4
addresses within the MPLS traffic so everything should be good if we can
just get the MPLS header off.

<font size="1">
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'>
</div>
"This email is intended to be reviewed by only the intended recipient
and may contain information that is privileged and/or confidential.
If you are not the intended recipient, you are hereby notified that
any review, use, dissemination, disclosure or copying of this email
and its attachments, if any, is strictly prohibited. If you have
received this email in error, please immediately notify the sender by
return email and delete this email from your system."
</font>

walt.henley at gmail

May 6, 2009, 5:28 AM

Post #5 of 10 (984 views)
Permalink

Re: MPLS [In reply to]

I would capture traffic using netflow or sflow on the ethernet
interface. All of your traffic that is not IP will be classified as
"other", but it should give you some stats. In my understanding
capturing MPLS frames would be a change in the mibs for ntop.
Probablyl best accomploished with a plug-in. Any volunteers?

On Tue, May 5, 2009 at 2:15 PM, inetjunkmail <inetjunkmail [at] gmail> wrote:
> We're running ntop on an MPLS link.� It doesn't seem to work.� Are there
> plans for MPLS support?� Any ideas on how we could pop the MPLS headers
> before sending to ntop for processing?� We do not have overlapping IPv4
> addresses within the MPLS traffic so everything should be good if we can
> just get the MPLS header off.
>
> _______________________________________________
> Ntop mailing list
> Ntop [at] unipi
> http://listgateway.unipi.it/mailman/listinfo/ntop
>
>
_______________________________________________
Ntop mailing list
Ntop [at] unipi
http://listgateway.unipi.it/mailman/listinfo/ntop

deri at ntop

May 6, 2009, 7:58 AM

Post #6 of 10 (977 views)
Permalink

Re: MPLS [In reply to]

I'm the volunteer: :-)

I have just committed on SVN the MPLS code. Please test it as I don't
have many mpls packets to use.

Comments are welcome.

Cheers Luca

On May 6, 2009, at 2:28 PM, Walt Henley wrote:

> I would capture traffic using netflow or sflow on the ethernet
> interface. All of your traffic that is not IP will be classified as
> "other", but it should give you some stats. In my understanding
> capturing MPLS frames would be a change in the mibs for ntop.
> Probablyl best accomploished with a plug-in. Any volunteers?
>
> On Tue, May 5, 2009 at 2:15 PM, inetjunkmail
> <inetjunkmail [at] gmail> wrote:
>> We're running ntop on an MPLS link. It doesn't seem to work. Are
>> there
>> plans for MPLS support? Any ideas on how we could pop the MPLS
>> headers
>> before sending to ntop for processing? We do not have overlapping
>> IPv4
>> addresses within the MPLS traffic so everything should be good if
>> we can
>> just get the MPLS header off.
>>
>> _______________________________________________
>> Ntop mailing list
>> Ntop [at] unipi
>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>
>>
> _______________________________________________
> Ntop mailing list
> Ntop [at] unipi
> http://listgateway.unipi.it/mailman/listinfo/ntop

_______________________________________________
Ntop mailing list
Ntop [at] unipi
http://listgateway.unipi.it/mailman/listinfo/ntop

Ggatten at waddell

May 6, 2009, 8:12 AM

Post #7 of 10 (985 views)
Permalink

Re: MPLS [In reply to]

Wow - very fast! I'm getting ready to post a crash captured with gdb.
Hopefully you'll have a prompt turn around ;-) I THINK it's related to
the dnsCache.db thing, but not sure...

-----Original Message-----
From: ntop-bounces [at] unipi [mailto:ntop-bounces [at] unipi] On Behalf Of
Luca Deri
Sent: Wednesday, May 06, 2009 9:58 AM
To: ntop [at] unipi
Subject: Re: [Ntop] MPLS

I'm the volunteer: :-)

I have just committed on SVN the MPLS code. Please test it as I don't
have many mpls packets to use.

Comments are welcome.

Cheers Luca

On May 6, 2009, at 2:28 PM, Walt Henley wrote:

> I would capture traffic using netflow or sflow on the ethernet
> interface. All of your traffic that is not IP will be classified as
> "other", but it should give you some stats. In my understanding
> capturing MPLS frames would be a change in the mibs for ntop.
> Probablyl best accomploished with a plug-in. Any volunteers?
>
> On Tue, May 5, 2009 at 2:15 PM, inetjunkmail
> <inetjunkmail [at] gmail> wrote:
>> We're running ntop on an MPLS link. It doesn't seem to work. Are
>> there
>> plans for MPLS support? Any ideas on how we could pop the MPLS
>> headers
>> before sending to ntop for processing? We do not have overlapping
>> IPv4
>> addresses within the MPLS traffic so everything should be good if
>> we can
>> just get the MPLS header off.
>>
>> _______________________________________________
>> Ntop mailing list
>> Ntop [at] unipi
>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>
>>
> _______________________________________________
> Ntop mailing list
> Ntop [at] unipi
> http://listgateway.unipi.it/mailman/listinfo/ntop

_______________________________________________
Ntop mailing list
Ntop [at] unipi
http://listgateway.unipi.it/mailman/listinfo/ntop

<font size="1">
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'>
</div>
"This email is intended to be reviewed by only the intended recipient
and may contain information that is privileged and/or confidential.
If you are not the intended recipient, you are hereby notified that
any review, use, dissemination, disclosure or copying of this email
and its attachments, if any, is strictly prohibited. If you have
received this email in error, please immediately notify the sender by
return email and delete this email from your system."
</font>

_______________________________________________
Ntop mailing list
Ntop [at] unipi
http://listgateway.unipi.it/mailman/listinfo/ntop

deri at ntop

May 6, 2009, 8:14 AM

Post #8 of 10 (987 views)
Permalink

Re: MPLS [In reply to]

On May 6, 2009, at 5:12 PM, Gary Gatten wrote:

> Wow - very fast! I'm getting ready to post a crash captured with gdb.
> Hopefully you'll have a prompt turn around ;-) I THINK it's related
> to
> the dnsCache.db thing, but not sure...

Gary
are you using the latest libevent-based code?

Luca

>
> -----Original Message-----
> From: ntop-bounces [at] unipi [mailto:ntop-bounces [at] unipi] On Behalf
> Of
> Luca Deri
> Sent: Wednesday, May 06, 2009 9:58 AM
> To: ntop [at] unipi
> Subject: Re: [Ntop] MPLS
>
> I'm the volunteer: :-)
>
> I have just committed on SVN the MPLS code. Please test it as I don't
> have many mpls packets to use.
>
> Comments are welcome.
>
> Cheers Luca
>
> On May 6, 2009, at 2:28 PM, Walt Henley wrote:
>
>> I would capture traffic using netflow or sflow on the ethernet
>> interface. All of your traffic that is not IP will be classified as
>> "other", but it should give you some stats. In my understanding
>> capturing MPLS frames would be a change in the mibs for ntop.
>> Probablyl best accomploished with a plug-in. Any volunteers?
>>
>> On Tue, May 5, 2009 at 2:15 PM, inetjunkmail
>> <inetjunkmail [at] gmail> wrote:
>>> We're running ntop on an MPLS link. It doesn't seem to work. Are
>>> there
>>> plans for MPLS support? Any ideas on how we could pop the MPLS
>>> headers
>>> before sending to ntop for processing? We do not have overlapping
>>> IPv4
>>> addresses within the MPLS traffic so everything should be good if
>>> we can
>>> just get the MPLS header off.
>>>
>>> _______________________________________________
>>> Ntop mailing list
>>> Ntop [at] unipi
>>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>>
>>>
>> _______________________________________________
>> Ntop mailing list
>> Ntop [at] unipi
>> http://listgateway.unipi.it/mailman/listinfo/ntop
>
> _______________________________________________
> Ntop mailing list
> Ntop [at] unipi
> http://listgateway.unipi.it/mailman/listinfo/ntop
>
>
>
>
>
> <font size="1">
> <div style='border:none;border-bottom:double windowtext
> 2.25pt;padding:0in 0in 1.0pt 0in'>
> </div>
> "This email is intended to be reviewed by only the intended recipient
> and may contain information that is privileged and/or confidential.
> If you are not the intended recipient, you are hereby notified that
> any review, use, dissemination, disclosure or copying of this email
> and its attachments, if any, is strictly prohibited. If you have
> received this email in error, please immediately notify the sender by
> return email and delete this email from your system."
> </font>
>
> _______________________________________________
> Ntop mailing list
> Ntop [at] unipi
> http://listgateway.unipi.it/mailman/listinfo/ntop

_______________________________________________
Ntop mailing list
Ntop [at] unipi
http://listgateway.unipi.it/mailman/listinfo/ntop

Ggatten at waddell

May 6, 2009, 8:18 AM

Post #9 of 10 (984 views)
Permalink

Re: MPLS [In reply to]

Sorry to hijack this thread

No - I'm still on 3.2.1. Should I even bother with the gdb stuff or get
the upgrade done?

-----Original Message-----
From: ntop-bounces [at] unipi [mailto:ntop-bounces [at] unipi] On Behalf Of
Luca Deri
Sent: Wednesday, May 06, 2009 10:15 AM
To: ntop [at] unipi
Subject: Re: [Ntop] MPLS

On May 6, 2009, at 5:12 PM, Gary Gatten wrote:

> Wow - very fast! I'm getting ready to post a crash captured with gdb.
> Hopefully you'll have a prompt turn around ;-) I THINK it's related
> to
> the dnsCache.db thing, but not sure...

Gary
are you using the latest libevent-based code?

Luca

>
> -----Original Message-----
> From: ntop-bounces [at] unipi [mailto:ntop-bounces [at] unipi] On Behalf
> Of
> Luca Deri
> Sent: Wednesday, May 06, 2009 9:58 AM
> To: ntop [at] unipi
> Subject: Re: [Ntop] MPLS
>
> I'm the volunteer: :-)
>
> I have just committed on SVN the MPLS code. Please test it as I don't
> have many mpls packets to use.
>
> Comments are welcome.
>
> Cheers Luca
>
> On May 6, 2009, at 2:28 PM, Walt Henley wrote:
>
>> I would capture traffic using netflow or sflow on the ethernet
>> interface. All of your traffic that is not IP will be classified as
>> "other", but it should give you some stats. In my understanding
>> capturing MPLS frames would be a change in the mibs for ntop.
>> Probablyl best accomploished with a plug-in. Any volunteers?
>>
>> On Tue, May 5, 2009 at 2:15 PM, inetjunkmail
>> <inetjunkmail [at] gmail> wrote:
>>> We're running ntop on an MPLS link. It doesn't seem to work. Are
>>> there
>>> plans for MPLS support? Any ideas on how we could pop the MPLS
>>> headers
>>> before sending to ntop for processing? We do not have overlapping
>>> IPv4
>>> addresses within the MPLS traffic so everything should be good if
>>> we can
>>> just get the MPLS header off.
>>>
>>> _______________________________________________
>>> Ntop mailing list
>>> Ntop [at] unipi
>>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>>
>>>
>> _______________________________________________
>> Ntop mailing list
>> Ntop [at] unipi
>> http://listgateway.unipi.it/mailman/listinfo/ntop
>
> _______________________________________________
> Ntop mailing list
> Ntop [at] unipi
> http://listgateway.unipi.it/mailman/listinfo/ntop
>
>
>
>
>
> <font size="1">
> <div style='border:none;border-bottom:double windowtext
> 2.25pt;padding:0in 0in 1.0pt 0in'>
> </div>
> "This email is intended to be reviewed by only the intended recipient
> and may contain information that is privileged and/or confidential.
> If you are not the intended recipient, you are hereby notified that
> any review, use, dissemination, disclosure or copying of this email
> and its attachments, if any, is strictly prohibited. If you have
> received this email in error, please immediately notify the sender by
> return email and delete this email from your system."
> </font>
>
> _______________________________________________
> Ntop mailing list
> Ntop [at] unipi
> http://listgateway.unipi.it/mailman/listinfo/ntop

_______________________________________________
Ntop mailing list
Ntop [at] unipi
http://listgateway.unipi.it/mailman/listinfo/ntop

<font size="1">
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'>
</div>
"This email is intended to be reviewed by only the intended recipient
and may contain information that is privileged and/or confidential.
If you are not the intended recipient, you are hereby notified that
any review, use, dissemination, disclosure or copying of this email
and its attachments, if any, is strictly prohibited. If you have
received this email in error, please immediately notify the sender by
return email and delete this email from your system."
</font>

_______________________________________________
Ntop mailing list
Ntop [at] unipi
http://listgateway.unipi.it/mailman/listinfo/ntop

deri at ntop

May 6, 2009, 8:25 AM

Post #10 of 10 (978 views)
Permalink

Re: MPLS [In reply to]

On May 6, 2009, at 5:18 PM, Gary Gatten wrote:

> Sorry to hijack this thread
>
> No - I'm still on 3.2.1. Should I even bother with the gdb stuff or
> get
> the upgrade done?
>
Yes sir

> -----Original Message-----
> From: ntop-bounces [at] unipi [mailto:ntop-bounces [at] unipi] On Behalf
> Of
> Luca Deri
> Sent: Wednesday, May 06, 2009 10:15 AM
> To: ntop [at] unipi
> Subject: Re: [Ntop] MPLS
>
>
> On May 6, 2009, at 5:12 PM, Gary Gatten wrote:
>
>> Wow - very fast! I'm getting ready to post a crash captured with
>> gdb.
>> Hopefully you'll have a prompt turn around ;-) I THINK it's related
>> to
>> the dnsCache.db thing, but not sure...
>
> Gary
> are you using the latest libevent-based code?
>
> Luca
>
>>
>> -----Original Message-----
>> From: ntop-bounces [at] unipi [mailto:ntop-bounces [at] unipi] On Behalf
>> Of
>> Luca Deri
>> Sent: Wednesday, May 06, 2009 9:58 AM
>> To: ntop [at] unipi
>> Subject: Re: [Ntop] MPLS
>>
>> I'm the volunteer: :-)
>>
>> I have just committed on SVN the MPLS code. Please test it as I don't
>> have many mpls packets to use.
>>
>> Comments are welcome.
>>
>> Cheers Luca
>>
>> On May 6, 2009, at 2:28 PM, Walt Henley wrote:
>>
>>> I would capture traffic using netflow or sflow on the ethernet
>>> interface. All of your traffic that is not IP will be classified as
>>> "other", but it should give you some stats. In my understanding
>>> capturing MPLS frames would be a change in the mibs for ntop.
>>> Probablyl best accomploished with a plug-in. Any volunteers?
>>>
>>> On Tue, May 5, 2009 at 2:15 PM, inetjunkmail
>>> <inetjunkmail [at] gmail> wrote:
>>>> We're running ntop on an MPLS link. It doesn't seem to work. Are
>>>> there
>>>> plans for MPLS support? Any ideas on how we could pop the MPLS
>>>> headers
>>>> before sending to ntop for processing? We do not have overlapping
>>>> IPv4
>>>> addresses within the MPLS traffic so everything should be good if
>>>> we can
>>>> just get the MPLS header off.
>>>>
>>>> _______________________________________________
>>>> Ntop mailing list
>>>> Ntop [at] unipi
>>>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>>>
>>>>
>>> _______________________________________________
>>> Ntop mailing list
>>> Ntop [at] unipi
>>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>
>> _______________________________________________
>> Ntop mailing list
>> Ntop [at] unipi
>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>
>>
>>
>>
>>
>> <font size="1">
>> <div style='border:none;border-bottom:double windowtext
>> 2.25pt;padding:0in 0in 1.0pt 0in'>
>> </div>
>> "This email is intended to be reviewed by only the intended recipient
>> and may contain information that is privileged and/or confidential.
>> If you are not the intended recipient, you are hereby notified that
>> any review, use, dissemination, disclosure or copying of this email
>> and its attachments, if any, is strictly prohibited. If you have
>> received this email in error, please immediately notify the sender by
>> return email and delete this email from your system."
>> </font>
>>
>> _______________________________________________
>> Ntop mailing list
>> Ntop [at] unipi
>> http://listgateway.unipi.it/mailman/listinfo/ntop
>
> _______________________________________________
> Ntop mailing list
> Ntop [at] unipi
> http://listgateway.unipi.it/mailman/listinfo/ntop
>
>
>
>
>
> <font size="1">
> <div style='border:none;border-bottom:double windowtext
> 2.25pt;padding:0in 0in 1.0pt 0in'>
> </div>
> "This email is intended to be reviewed by only the intended recipient
> and may contain information that is privileged and/or confidential.
> If you are not the intended recipient, you are hereby notified that
> any review, use, dissemination, disclosure or copying of this email
> and its attachments, if any, is strictly prohibited. If you have
> received this email in error, please immediately notify the sender by
> return email and delete this email from your system."
> </font>
>
> _______________________________________________
> Ntop mailing list
> Ntop [at] unipi
> http://listgateway.unipi.it/mailman/listinfo/ntop

_______________________________________________
Ntop mailing list
Ntop [at] unipi
http://listgateway.unipi.it/mailman/listinfo/ntop

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads