I'm currently testing out a demo copy of nprobe/ntopng, on an Ubuntu LTS 16.04 to evaluate if it is worth purchasing.
This seems to work partially, I can see flows, protocol breakdowns etc. However, the population of hosts doesn't seem to be working so well. I generally see that there are hosts in the status block in the lower right, but when I go to "hosts" from the top menu, there are no hosts found. Flows on the other hand populate correctly, and I can even click on a host IP in there and get a summary of the host. I've tried tinkering with various things, like changing the idle timeouts, and adding local hosts as sticky, but that doesn't seem to help. At one point I got some local hosts to populate, and they stayed for a while as I was using sticky locals, but I realized no remotes were ever being added, so I tried restarting it with sticky-hosts=none, and now nothing is populated. I've also tried updating a few times, currently I am running: ntopng --version v.2.5.170301 [Enterprise/Professional Edition] and was running: v.2.5.170228 [Enterprise/Professional Edition] and prior to that I was running whatever was current on the apt repo last friday. Have I misconfigured something? Failing to understand a limit of the demo versions? I'm using this sending netflows from a Cisco ASA to nprobe, which then zmq's them to ntopng, so these are my conf files: (minor censoring of bits with xxx's) nprobe: --collector=none --interface=none --zmq="tcp://*:5556" --collector-port=2055 --lifetime-timeout=180 --idle-timeout=60 -g=/var/run/nprobe-none.pid --vlanid-as-iface-idx=none --as-list=/usr/share/ntopng/httpdocs/geoip/GeoIPASNum.dat --daemon-mode --dump-stats=/var/log/nprobe/none-0_flows_stats.txt --city-list=/usr/share/ntopng/httpdocs/geoip/GeoLiteCity.dat -V=5 ntopng: -G=/var/run/ntopng.pid --interface="tcp://127.0.0.1:5556" --local-networks="192.168.0.0/16,10.0.0.0/8,xx.xx.xx.xx/xx" --daemon --http-port=3000 --sticky-hosts=none --dump-hosts=none -F "mysql;xxxx;ntopng;flows;xxxxx;xxxxx" *This e-mail is intended solely for the addressee. Access to this email by anyone else is unauthorized. If you have received this e-mail in error, please notify the sender immediately, delete the e-mail from your computer and do not copy or disclose it to anyone else.* *THE INFORMATION IN THIS EMAIL AND ANY ATTACHMENTS CONSTITUTE THE PROPRIETARY INFORMATION OF FOURTH DIMENSION ENGINEERING, LLC.* Any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. Fourth Dimension is not responsible for any damages caused by your unauthorized use of the materials in this e-mail.
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
