Thanks for providing the pcap. We have added GRE ERSPAN detunneling in 
https://github.com/ntop/ntopng/commit/9d82df748f27da6bc7c51e7e726600b09670c518 
<https://github.com/ntop/ntopng/commit/9d82df748f27da6bc7c51e7e726600b09670c518>

Please check it out and report. Thanks,

Simone

> On 1 Mar 2018, at 22:09, Rokkhan <rokk...@gmail.com> wrote:
> 
> I have upgraded to v.3.3.180301 and I still see GRE traffic.
> 
> Greetings.
> 
> 2018-03-01 21:36 GMT+01:00 Rokkhan <rokk...@gmail.com 
> <mailto:rokk...@gmail.com>>:
> Hi,
> 
> I am using v.3.3.180125 version. I send you attached an small pcap.
> 
> 
> <imagen.png>
> 
> Greetings
> 
> 2018-03-01 20:54 GMT+01:00 Simone Mainardi <maina...@ntop.org 
> <mailto:maina...@ntop.org>>:
> As you can see from 
> https://github.com/ntop/ntopng/blob/dev/src/NetworkInterface.cpp#L1521 
> <https://github.com/ntop/ntopng/blob/dev/src/NetworkInterface.cpp#L1521> 
> ntopng decapsulates GRE traffic. Are you using the latest version? Can you 
> enclose a pcap file so we can try and reproduce?
> 
> 
>> On 1 Mar 2018, at 20:40, Rokkhan <rokk...@gmail.com 
>> <mailto:rokk...@gmail.com>> wrote:
>> 
>> Hi,
>> I am using ntopng and it shows traffic flows as gre, instead of the real 
>> traffic.
>> Do i have to enable any option?
>> Greetings
>> 
>> 
>> El 1 mar. 2018 20:35, "Simone Mainardi" <maina...@ntop.org 
>> <mailto:maina...@ntop.org>> escribi├│:
>> ntopng decapsulates GRE tunnels by default. nprobe needs the following 
>> option to account for decapsulated traffic:
>> 
>> [--tunnel|-5]                       | Compute flows on tunnelled traffic 
>> rather than
>>                                     | on the external envelope
>> 
>> 
>> Simone
>> 
>> > On 28 Feb 2018, at 18:28, Rokkhan <rokk...@gmail.com 
>> > <mailto:rokk...@gmail.com>> wrote:
>> >
>> > Hi,
>> >
>> > I am sending traffic to one of the ntop interfaces with ERSPAN but traffic 
>> > info shows application as "GRE".
>> >
>> > ┬┐Coudl it be configured to inspect the traffic inside the ERSPAN and show 
>> > the real application?
>> >
>> > Saludos.
>> > _______________________________________________
>> > Ntop mailing list
>> > Ntop@listgateway.unipi.it <mailto:Ntop@listgateway.unipi.it>
>> > http://listgateway.unipi.it/mailman/listinfo/ntop 
>> > <http://listgateway.unipi.it/mailman/listinfo/ntop>
>> 
>> _______________________________________________
>> Ntop mailing list
>> Ntop@listgateway.unipi.it <mailto:Ntop@listgateway.unipi.it>
>> http://listgateway.unipi.it/mailman/listinfo/ntop 
>> <http://listgateway.unipi.it/mailman/listinfo/ntop>_______________________________________________
>> Ntop mailing list
>> Ntop@listgateway.unipi.it <mailto:Ntop@listgateway.unipi.it>
>> http://listgateway.unipi.it/mailman/listinfo/ntop 
>> <http://listgateway.unipi.it/mailman/listinfo/ntop>
> 
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it <mailto:Ntop@listgateway.unipi.it>
> http://listgateway.unipi.it/mailman/listinfo/ntop 
> <http://listgateway.unipi.it/mailman/listinfo/ntop>
> 
> 
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop

_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

Reply via email to