Hi,

I'm using sflow, data comes from a pair of Arista switches, so I have removed 
--collector-sample-rate and --upscale-traffic. 

This is the configuration in both Arista switches:
sflow sample dangerous 2000
sflow destination 192.168.0.3 9996
sflow source 192.168.0.245
sflow run

Maybe the sample rate is too low?

Polling interval is not set, so it is using 2 secs as default value.

Any help would be appreciated.

Regards,
Javier Narváez 

----- Mensaje original -----
De: "Emanuele Faranda" <fara...@ntop.org>
Para: ntop-misc@listgateway.unipi.it
Enviados: Viernes, 9 de Febrero 2018 14:37:10
Asunto: Re: [Ntop-misc] Fwd: Ntopng high fluctuation

Hi,

The --collector-sample-rate and --upscale-traffic are not supported 
anymore in nProbe. If you are using sFlow, then the sampling rate is 
already indicated into the packets nProbe receives, so packets are 
automatically scaled.

Intead, if you are using NetFlow and the NetFlow traffic itself is 
sampled, please look at the --sample-rate nProbe option.

Please also look at your exporter flow export timeouts and 
configuration; it may happen that a lot of flows are exported at once so 
when ntopng computes the deltas it will see a lot of traffic within a 
small period of time. You can also tweak the interface speed and 
dashboard refresh timeouts by clicking the footer throughput bar.

Regards,
Emanuele


On 02/09/2018 12:10 PM, Javier Narváez wrote:
> Hi Emanuele,
>
> I'm using the latest in offical repos (updated today) and I still experience 
> the same problem:
>
> [root@ntopng ~]# rpm -qa | egrep 'nprobe|ntopng'
> ntopng-3.3.180209-3902.x86_64
> nprobe-8.3.180209-6051.x86_64
> ntopng-data-3.3.180209-3902.noarch
>
> Kind regards,
> Javier
>
> ----- Mensaje original -----
> De: "Emanuele Faranda" <fara...@ntop.org>
> Para: ntop-misc@listgateway.unipi.it
> Enviados: Viernes, 9 de Febrero 2018 11:16:55
> Asunto: Re: [Ntop-misc] Fwd: Ntopng high fluctuation
>
> Hi Javier,
>
> What ntopng and nprobe version are you using? If you are using sFlow,
> please check out the latest ntopng and nprobe development versions as
> they contain improvements on the sFlow protocol handling.
>
> Regards,
> Emanuele
>
>
> On 02/08/2018 02:06 PM, Javier Narváez wrote:
>> Hi,
>>
>> Ntopng is great, but sometimes is dificult for me identifying the user who 
>> is using more bandwith than it should.
>>
>> In the traffic dashboard view, it fluctuates a lot, everytime the web 
>> refreshes (3 seconds), the top 10 hosts change, if a user is dowloading a 
>> file at 300mbps, it should be on the top all the time. Also sometimes I can 
>> see impossible data (one host using more than 1gbit/s on a gigabit ethernet).
>>
>> I am not sure if this is a ntopng problem, a nprobe problem, a netflow 
>> problem, or if I am missing something in my configuration.
>>
>> Here you can see an animated gif of what happens: 
>> https://gfycat.com/WeightyCarefreeAfricanwilddog
>>
>> And this is my configuration:
>>
>> [root@ntopng ~]# cat /etc/ntopng/ntopng.conf
>> -G=/var/run/ntopng.pid
>> --local-networks="192.168.0.0/16,91.xxxx"
>> --interface="tcp://127.0.0.1:5556"
>>
>> [root@ntopng ~]# cat /etc/nprobe/nprobe-none.conf
>> --zmq="tcp://127.0.0.1:5556"
>> --collector-port=9996
>> -g=/var/run/nprobe-none.pid
>> -i=none
>> -n=none
>> --collector-sample-rate=1000
>> --upscale-traffic
>> -T="%IPV4_SRC_ADDR %IPV4_DST_ADDR %IPV4_SRC_MASK %IPV4_DST_MASK %L4_SRC_PORT 
>> %L4_DST_PORT %IPV6_SRC_ADDR %IPV6_DST_ADDR %IPV6_SRC_MASK %IPV6_DST_MASK 
>> %IP_PROTOCOL_VERSION %SRC_TOS %PROTOCOL %ICMP_TYPE %INPUT_SNMP %SRC_AS 
>> %DST_AS %IPV4_NEXT_HOP %IPV6_NEXT_HOP %TCP_FLAGS %OUTPUT_SNMP %IN_BYTES 
>> %IN_PKTS %OUT_BYTES %OUT_PKTS %MIN_TTL %MAX_TTL %FIRST_SWITCHED 
>> %LAST_SWITCHED %SRC_VLAN %DST_VLAN %DOT1Q_SRC_VLAN %DOT1Q_DST_VLAN 
>> %EXPORTER_IPV4_ADDRESS %IN_SRC_MAC %OUT_DST_MAC"
>> -V 9
>>
>>
>> Thank you in advance.
>> Kind regards,
>> Javier Narvaez
>> _______________________________________________
>> Ntop-misc mailing list
>> Ntop-misc@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc

_______________________________________________
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
_______________________________________________
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Reply via email to