I see now... but I remember I read somewhere that Cisco sent flow information even if the connection is not yet expired .... so in this case it should be visible !?
http://www.ntop.org/netflow.html <snip> The main difference between ntop and a Cisco router, is that a router can be configured in a way that it emits a flow packet for a TCP connection that is not yet terminated (expired in the Cisco terminology). This means that for a long standing connection (e.g. a copy via FTP of a large file) ntop sends only one packet containing flow information at the end of the connection, whereas a router sends periodic packets (e.g. every 15 minutes) that contain partial flow information. Beside this difference (and that ntop cannot return information about ASs, Authonomous Systems, as it is not a router) ntop acts as a software-based NetFlow data export, similar to a real network device such as a router. </snip> So the question then is HOW I can configure Cisco to export netflow info more often ?! Meanwhile I'm OK also if I can see info of the connection even that from it termination passed 5-10min... Some sort sort of Time-machine :") (is there a tweak so that i can enable this i.e. if device is Netflow and 5 min passed and session-number is not too big, show it ?! or it is not that easy.) |If I am not mistaken ... the flows are exported when |they expire. So, by the time they reach NTOP they are |not active sessions. Thats probably why you see |active flows when looking on the router because they |have not been exported yet. | |Please read the previous list thread "NetFlow |Overview" because it should answer your other |questions regarding your configuration. |--Blake |> My netflow plugin finaly works (after small change |> in the code), but I'm not getting flows!! |> i.e. on /NetNetstat.html I'm getting "NO ACTIVE TCP |> SESSIONS", but when I execute "sh ip cache flow" on |> the Cisco I see that I have active session ?! |> What can be the reason ? |> If I go on Total/Sent/Recv I see : |> |> NetFlow 0 0 |> |> On the other hand I have o Plugins : |> |> Interface Name NetFlow Enabled |> eth0 Yes |> NetFlow-device Yes |> |> Flow Statistics |> # Pkts Rcvd.value 1,334 |> # Flows Rcvd.value 19,820 |> # Flow with Bad Version 0 |> Flow Senders x.x.x.x [1,334 pkts] |> |> Switch NIC is set on the Net-flow device .... |> Did I missed something... |> |> Oooo and I'm using latest 2.1.51 .. |> raptor _______________________________________________ Ntop mailing list [EMAIL PROTECTED] http://lists.ntop.org/mailman/listinfo/ntop
