> On 12 Feb 2018, at 22:06, Peter Shute <> wrote:
> Thanks for that. I've also discovered I can separate out the netflow data 
> coming from each office's router using dynamic network interfaces. I followed 
> the instructions provided at to 
> enable Probe IP disaggregation criterion, and to add %EXPORTER_IPV4_ADDRESS 
> to the template.  I assume this does the same thing as host pooling, assuming 
> one wants to pool every subnet on each router?


> I have this running now, so I can't try creating host pools unless I undo 
> those changes.
> One thing I've noticed with dynamic interfaces is that if I select one, then 
> click on the chart icon, the traffic peaks seem way too  high. Eg 85Mbps when 
> we only have a 14Mbps link.

Peaks you are seeing are very likely due to the quantized nature of flows. Your 
netflow exporters do periodic exports of active flows -- say every 2 minutes -- 
so the ntopng/nProbe pair is not able to know what happened during the 2 
minutes, it just receives the exported flow at the end of the period. This 
translates into a potentially high volume of traffic in a very short period 
that determines the peak. However, total values over time must be consistent.

> If I click on Hosts/Networks, and select one of the local subnets, it seems 
> ok. Is there something wrong with that combined chart?

Interfaces charts are populated with a data point every second. Hosts/networks 
every 5 minutes and thus peaks get smoothed because total data is averaged over 
a much wider time range.

> Is it possible to name the dynamic network interfaces so I don't have to keep 
> a list of all the routers' ip addresses?

Yes, rename it as if it was a normal interface.


>> -----Original Message-----
>> From: [mailto:ntop-
>>] On Behalf Of Simone Mainardi
>> Sent: Tuesday, 13 February 2018 1:29 AM
>> To:
>> Subject: Re: [Ntop] Combining subnet statistics
>> Yes, you can do that.
>> You should create an host pool for any branch you are interested monitoring.
>> An host pool can be defined as a set of subnets so this will do the trick. 
>> Once
>> you've created the pools, visit the ntopng preferences and enable the
>> timeseries creation for them.
>> Simone
>>> On 12 Feb 2018, at 00:08, Peter Shute <> wrote:
>>> We have several subnets in each of our branch offices that can use our
>> WAN. I have listed each of these in ntopng.conf:
>>> --local-networks=
>> ",,,,,
>> 0/24,,,"
>>> I can view charts for each subnet individually, but I would like to see the
>> total for each branch office. E.g + +
>>> Is there a way to do this? Because of the subnet ranges they've used (last
>> digit of second last number indicates branch office), I can't just define a
>> subnet range to cover them.
>>> Peter Shute
>>> _______________________________________________
>>> Ntop mailing list
>> _______________________________________________
>> Ntop mailing list
> _______________________________________________
> Ntop mailing list

Ntop mailing list

Reply via email to