Re: [Ntop] Ntop 3.3.10 rev 3772

2009-05-27 Thread Wiebel, Rolf
Hello Luca, Maybe I it's better to specify the warning messages ./make install ... /bin/sh ./libtool --mode=install /usr/bin/install -c 'libntop.la' '/usr/local/lib/libntop.la' libtool: install: warning: relinking `libntop.la' ... /bin/sh ./libtool --mode=install

[Ntop] ntop problem

2009-05-27 Thread Phillip Lynn
Hi, Yesterday we upgraded a server to run ntop-3.3.10. After letting the system run over night I found that ntop had multiple instances running. The systems performance was degraded severely with a load average of 18.89. Has anyone else seen this type of an issue and if so were you able to

Re: [Ntop] ntop problem

2009-05-27 Thread Luca Deri
Phillip I have heard from other users that ntop on FreeBSD is not running nicely. Unfortunately I have no BSD system here so I cannot debug this. Can you please see if you can debug this problem yourself (at least partially) so I can try to image what's wrong? Thanks Luca On May 27,

Re: [Ntop] nProbe --as-list

2009-05-27 Thread Luca Deri
Steve I have just release 5.2.5 (please download it from the same link). This is based on GeoIP as ntop and it adds AS/country and city export in netflow. [--as-list|-A] AS list | GeoIP file containing the list of known ASs. | Example:

Re: [Ntop] Ntop 3.3.10 rev 3772 /Suse 10.2 / configure: error: cannot find macro directory `m4'

2009-05-27 Thread Luca Deri
Rolf/Brian can you please resync from SVN and see if this fixed the m4 issue you reported? Thanks Luca On May 26, 2009, at 7:29 PM, Brian Mengel wrote: This error is very much like the one I ran into with compiling the latest version of nprobe. I do not believe creating the m4 directory

Re: [Ntop] ntop problem

2009-05-27 Thread Phillip Lynn
Hi Luca, Thanks for quick response. I will be glad to try and debug the problem. I have not found any documents that would point me in the direction concerning the spawning of the running ntop process. Is there any high level architecture documents? If you have any idea as to where to start

Re: [Ntop] ntop problem

2009-05-27 Thread Gary Gatten
Hello, I tried a dev version of 3.3.10 on FBSD 6.0 and had various issues, but nothing like it spawning multiple instances on its own. In fact it usually will die if you try to run multiple instances without the correct config - it tries to open th db's rw anf they're already open so it aborts

Re: [Ntop] ntop problem

2009-05-27 Thread Phillip Lynn
Hi Gary, Thanks for the offer of help . We do not have a cron job for ntop. We are starting ntop with the following args: -ivr1 -ndLM -W 0 -w 127.0.0.1:3000 . Thank You Phillip Lynn Gary Gatten wrote: Hello, I tried a dev version of 3.3.10 on FBSD 6.0 and had various issues, but

Re: [Ntop] ntop problem

2009-05-27 Thread Phillip Lynn
Gary, I forgot to add that the first listing on my original email was from ptree, the second list was from the top. Also I also have only seen this issue twice now. One time with ntop-3.3.9 and ntop-3.3.10. We left the system running ntop over night both times and that is when the issues

[Ntop] nprobe errors

2009-05-27 Thread Rich Stoneberg
All; Would imagine this is something I am doing incorrectly. Googled the problem, not able to find a solution that I understand (although - may - have well looked at it !!) Loaded new install - as basic as I could get it. d/l'ed all latest sources for: nprobe 5.2.1 pro (paid for it ! I

Re: [Ntop] ntop problem

2009-05-27 Thread Phillip Lynn
All, Well it happened again. So I ran gdb on the ntop process that was continually in the run state. It looks like it was spawned off to handle a web request then never died. Would the sslwatchdog help this? We are going try using sslwatchdog. If anyone has any ideas let us know. gdb

[Ntop] Missing libnprobe

2009-05-27 Thread Steve Petko
I just built 5.2.5 on an Ubuntu 8.04 box and there seems to be a problem: r...@shake1:/usr/local/lib# nprobe -h nprobe: error while loading shared libraries: libnprobe-5.2.5.so: cannot open shared object file: No such file or directory r...@shake1:/usr/local/lib# ls -l libnprobe* -rwxr-xr-x 1

Re: [Ntop] ntop problem

2009-05-27 Thread Gary Gatten
Per private email, try -K. G -Original Message- From: ntop-boun...@unipi.it [mailto:ntop-boun...@unipi.it] On Behalf Of Phillip Lynn Sent: Wednesday, May 27, 2009 10:44 AM To: ntop@unipi.it Subject: Re: [Ntop] ntop problem All, Well it happened again. So I ran gdb on the ntop process

Re: [Ntop] Ntop 3.3.10 rev 3772 /Suse 10.2 / configure: error:cannot find macro directory `m4'

2009-05-27 Thread Wiebel, Rolf
Hi Luca, it's now working fine . I do not need to create 'm4' manuall. I do not need to compile GeoIP-1.4.6 manuall. Best regards/Mit freundlichen Grüßen Rolf -Ursprüngliche Nachricht- Von: ntop-boun...@unipi.it [mailto:ntop-boun...@unipi.it] Im Auftrag von Luca

Re: [Ntop] Ntop 3.3.10 rev 3772 /Suse 10.2 / configure: error:cannot find macro directory `m4'

2009-05-27 Thread Luca Deri
Thanks. it's now time to make our FreeBSD friends finally happy then. Luca On May 27, 2009, at 5:56 PM, Wiebel, Rolf wrote: Hi Luca, it's now working fine . I do not need to create 'm4' manuall. I do not need to compile GeoIP-1.4.6 manuall. Best regards/Mit freundlichen

Re: [Ntop] Ntop 3.3.10 rev 3772 /Suse 10.2 / configure:error:cannot find macro directory `m4'

2009-05-27 Thread Gary Gatten
Yea! -Original Message- From: ntop-boun...@unipi.it [mailto:ntop-boun...@unipi.it] On Behalf Of Luca Deri Sent: Wednesday, May 27, 2009 11:05 AM To: ntop@unipi.it Subject: Re: [Ntop] Ntop 3.3.10 rev 3772 /Suse 10.2 / configure:error:cannot find macro directory `m4' Thanks. it's now

Re: [Ntop] Ntop 3.3.10 rev 3772 /Suse 10.2 / configure:error:cannot find macro directory `m4'

2009-05-27 Thread Kurt Buff
Motion passed with acclaim! Kurt On Wed, May 27, 2009 at 09:08, Gary Gatten ggat...@waddell.com wrote: Yea! -Original Message- From: ntop-boun...@unipi.it [mailto:ntop-boun...@unipi.it] On Behalf Of Luca Deri Sent: Wednesday, May 27, 2009 11:05 AM To: ntop@unipi.it Subject: Re:

Re: [Ntop] Ntop 3.3.10 rev 3772 /Suse 10.2 / configure:error:cannot find macro directory `m4'

2009-05-27 Thread Brian Mengel
Can nprobe be sync'd via SVN? On Wed, May 27, 2009 at 12:23 PM, Kurt Buff kurt.b...@gmail.com wrote: Motion passed with acclaim! Kurt On Wed, May 27, 2009 at 09:08, Gary Gatten ggat...@waddell.com wrote: Yea! -Original Message- From: ntop-boun...@unipi.it

Re: [Ntop] ntop problem

2009-05-27 Thread Phillip Lynn
All, After some digging we found others that had a similar issue after they upgraded to FreeBSD 6.3. We are testing a solution from the following web site: http://unix.derkeiler.com/Mailing-Lists/FreeBSD/stable/2008-02/msg00442.html . Will let you know if this corrects our problem. Thanks

[Ntop] Plugin to assist in name resolution - dns snooping.

2009-05-27 Thread Gary Gatten
Hello, In my environment, end user systems are registered in DNS as an asset tag. I then must go to an external DB or use M$MC or LDAP hooks into AD to lookup either their IP address or asset tag to find out the actual users name so I can call them and ask, WTF are you downloading 100GB of

Re: [Ntop] ntop problem

2009-05-27 Thread Gary Gatten
Are you switching thread libraries or patching as the url mentioned? -Original Message- From: ntop-boun...@unipi.it [mailto:ntop-boun...@unipi.it] On Behalf Of Phillip Lynn Sent: Wednesday, May 27, 2009 1:24 PM To: ntop@unipi.it Subject: Re: [Ntop] ntop problem All, After some digging

Re: [Ntop] ntop problem

2009-05-27 Thread Phillip Lynn
All, Sorry forgot to tell everyone we are switching thread libraries. Phillip Lynn Gary Gatten wrote: Are you switching thread libraries or patching as the url mentioned? -Original Message- From: ntop-boun...@unipi.it [mailto:ntop-boun...@unipi.it] On Behalf Of Phillip Lynn

[Ntop] per host pair data?

2009-05-27 Thread Phil . Newlon
I am trying to figure out how to get host pair data out of ntop, or if it is even possible. I want to know what hosts (b, c, d, e) have had a conversation with the host ntop is running on (a), and how much data has been exchanged between them. I would also like to drill down to learn how that

Re: [Ntop] per host pair data?

2009-05-27 Thread Phil . Newlon
What defines active / current? If by that you mean all traffic seen since ntop was started, then yes I would like to see active / current. I have a host that communicates with about 40-50 other hosts, I need to know who is it talking to the most (or say the top 5 talkers), what was the volume,

Re: [Ntop] per host pair data?

2009-05-27 Thread Gary Gatten
Active/current is before the session info times out and is purged and no longer available on reports. Ntop is good what's happening right now tool, but getting detailed history not as easy. Have u tried traffic map and matrix? Ill be back at my desk in a few and can check further -

Re: [Ntop] per host pair data?

2009-05-27 Thread Gary Gatten
OK, I have another example that I believe is similar to yours: I have a end user system that at 2AM this morning sent 1.5GB of data somewhere. Who received this data and what was it? nTop can not easily answer this for me - that I know of. I don't have rrd configured to store enough detail

Re: [Ntop] per host pair data?

2009-05-27 Thread Phil . Newlon
Space I have. I've enabled 'hosts' and 'flows' in rrd configure, deactivated and reactivated rrd. Still not getting pertinent data (or can't find it) - Original Message - From: Gary Gatten [ggat...@waddell.com] Sent: 05/27/2009 04:08 PM EST To: ntop@unipi.it Subject: Re: [Ntop] per

Re: [Ntop] per host pair data?

2009-05-27 Thread Gary Gatten
Maybe add rrd Matrix and set detail level to full. Somewhere is a doc describing what rrd does with these various settings. I'll look for it or google it and I'm sure you'll find it. The one I'm thinking of is a pdf and maybe I found it on SourceForge? I forget. Anyway, Arbitrary Graphs

Re: [Ntop] per host pair data?

2009-05-27 Thread Gary Gatten
FYI: Ethereal / Wireshark and many others will do this in some manner. They have other limitations though. From: ntop-boun...@unipi.it [mailto:ntop-boun...@unipi.it] On Behalf Of phil.new...@wendysarbys.com Sent: Wednesday, May 27, 2009 4:14 PM To: ntop

Re: [Ntop] per host pair data?

2009-05-27 Thread Luca Deri
Gary ntop 3.x cannot answer you're right. The one I;m cooking will be able to give you both metrics/graphs and evidence of such traffic. I need some more months of work. That's should explain why the mainstream ntop is slowly moving. stay tuned. Luca PS. Anyone willing to provide me an

[Ntop] feature / enhancement request - host level conversation tracking / history / matrix

2009-05-27 Thread Gary Gatten
Problem: Host A Tx / Rx an abnormal amount of data. I want to see where that data went and what ports were used. Example: At 2AM BobsPC sends 2GB of data as seen in Host Traffic Stats //ntopsystem:3000/BobsPC.html. WTF was Bob doing at 2AM sending 2GB of data when he shouldn't even be here

Re: [Ntop] per host pair data?

2009-05-27 Thread Gary Gatten
Check my recent post re feature / enhancement request ... and see if that's basically what you want? Maybe if enough people chip in a few bucks it will help get that feature more quickly? Regardless I'll be filling out a request to donate some $$$. nTop has helped me / my company a fair amount

Re: [Ntop] per host pair data?

2009-05-27 Thread Gary Gatten
Depending on your memory and number of hosts - you COULD do this: Tweak time-out values and IDLE_PURGE timers in globals-defines.h, set immediate purge = off (syntax?) startup. This will / MAY allow you to see active traffic details longer than usual. Ie: Usually Active TCP/UDP Sessions

[Ntop-dev] r3779 - trunk/ntop

2009-05-27 Thread svn-commit
Author: deri Date: 2009-05-27 15:26:07 +0200 (Wed, 27 May 2009) New Revision: 3779 Modified: trunk/ntop/autogen.sh Log: Fix for RH-like distro that cannot find the m4 directory ___ Ntop-dev mailing list Ntop-dev@unipi.it