Hi, another question that arose during the debugging. How do the --in-iface-idx 910 --out-iface-idx 917
switches work? From the help text, I was under the impression that nProbe will modify/fake the corresponding snmp interface id, which is useful when dealing with flows from multiple routers and interfaces. So when setting interface ids to 910 and 917 I assumed that when configuring Wansight and specifying those IDs for the Flow Probe, all traffic would show up. But it seems it does not work that way? The SNMP ID is still the ID from the interfaces on our routers so our customer would need to specific each Interface that we sample so that Wansight shows the traffic. Otherwise only the traffic which actually runs over these snmp interface ids will show up in Wansight. In my captures from nProbe, Wireshark shows for InputInt and OutputInt the original value from our router. In the capture provided by you, both fields show 0. Viele Grüße, best regards, Benjamin Weik -------------------------------------- Core-Backbone GmbH Hans-Sachs-Str.14 93138 Lappersdorf Internet: www.core-backbone.com eMail: [email protected] Telefon: +49 (0)911-310432-00 ( werktags von 9 - 17 Uhr ) Hotline 24/7: Bitte entnehmen Sie diese Rufnummer Ihrem Kundeninterface Fax: +49 (0)911-310432-99 Registernummer (HR): HRB 10189 Registergericht: Amtsgericht Regensburg Geschäftsführung: Daniel Maresch Umsatzsteuer-Identifikationsnummer: DE249028038 Von: [email protected] <[email protected]> Im Auftrag von Luca Deri Gesendet: Montag, 12. März 2018 11:46 An: [email protected] Betreff: Re: [Ntop-misc] nProbe and Andrisoft compatibility Benjamin all I did is this: I have started "nprobe nprobe.conf” (basically is your config file) and sent some flows to nprobe, then captured the emitted flows with wireshark. I enclose the pcap with such flows. If you open them with wireshark everything looks good with no decoding errors whatsoever. Please tell the Wansight folks to contact us and report the exact issue (so that we can reproduce it an fix it), so we can use to reproduce the issues they mentioned you. Regards Luca
_______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
