Hi, > On 16 Jan 2019, at 19:41, Gerard Beekmans <gbeekm...@tsag.net> wrote: > > Hi, > > In an attempt to fix the issues I mentioned a few days ago, I am trying to > validate the theory that nprobe and/or ntopng are doubling up flows due to > certain traffic (not all traffic) passes through our equipment twice on > different VLANs. When looking at the flows in ntopng, I see two flows for > everything. They only difference is the VLAN; source IP, dest IP, packets, > bytes, speed, etc are all identical as expected. > > Some posts online suggest there are ways to ignore VLANs and I have tried the > following. > > In /etc/nprobe/nprobe.conf: > -p=0/1/1/1/0/0/0
to ignore VLANs -p="0/1/1/1/1/1/1" > > In /etc/ntopng/ntopng.conf: > --ignore-vlans= OK, this option was ignored when ntopng was collecting from nProbe. I've fixed it, a new build should be available in the next couple of hours. > > Perhaps the options don’t function as I assumed they would. At any rate, the > end result is that ntopng still shows duplicate flows and the list under > Hosts -> VLANs continues to populate with data. > > Here are the entire nprobe and ntopng configuration files. I am not able to > spot a typo such as a missing ‘=’ that would might cause a line to be > interpreted as the option to the line right above it. Maybe I’ve overlooked > something. > > nprobe.conf > -i=none > -n=none > -3=2055 > --zmq=tcp://127.0.0.1:5556 <tcp://127.0.0.1:5556> > -T="@NTOPNG@" > -V=9 > --idle-timeout=30 > --lifetime-timeout=600 > --disable-cache= > --enable-ipv4-deduplication= > --verbose=1 > -p=0/1/1/1/0/0/0 > --local-networks=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,208.118.68.0/24,208.118.95.34/32 > --local-traffic-direction= > > ntopng.conf > -G=/var/run/ntopng.pid > -i=tcp://127.0.0.1:5556 <tcp://127.0.0.1:5556> > --local-networks="10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,208.118.68.0/24,208.118.95.34/32" > --ignore-vlans= > > > Thanks, > Gerard Beekmans > Sr. Network Engineer > First Nations Technical Services Advisory Group Inc. > Phone: 780-638-2739 <tel:780-638-2739> > Fax: 780-483-8632 <tel:780-483-8632> > Helpdesk: 1-888-999-3356 <tel:1-888-999-3356> > Email: gbeekm...@tsag.net <mailto:gbeekm...@tsag.net> > Santa Fe Plaza > 18232 - 102 Avenue NW > Edmonton, AB T5S 1S7 > http://www.tsag.net <http://www.tsag.net/> > > _______________________________________________ > Ntop mailing list > Ntop@listgateway.unipi.it <mailto:Ntop@listgateway.unipi.it> > http://listgateway.unipi.it/mailman/listinfo/ntop > <http://listgateway.unipi.it/mailman/listinfo/ntop>
_______________________________________________ Ntop mailing list Ntop@listgateway.unipi.it http://listgateway.unipi.it/mailman/listinfo/ntop
