Re: [Ntop-misc] Nprobe black list network

2016-05-24 Thread Luca Deri 
Loic
please file an enhhancement issue for Office365: in essence you don't
want to emit flows for protocol X,Y,Z that in your case is Office365?
Luca




On 05/24/2016 09:24 AM, Loic CRUCHADE wrote:
>
> Hello,
>
>  
>
> Thanks for the reply.
>
> I reached the same goal with the « collection-filter » argument.
>
> But i had some problems too. The « ! » was returning a shell fuction i
> think. Whan use it put some « yum install… » instead of the « ! ».
>
> I solved this by using a configuration file for nprobe.
>
> Now, the last thing i have to do is to filter only Office365 flows,
> but it’s tricky because of there is almost 1000 IP to filter.
>
> If anybody have an idea.
>
> Thanks again.
>
>  
>
> CRUCHADE Loïc
>
> 05.82.52.22.02
>
> Service Exploitation Informatique
>
> Direction des Systèmes d’information
>
> logo
>
>  
>
> *De :*ntop-misc-boun...@listgateway.unipi.it
> [mailto:ntop-misc-boun...@listgateway.unipi.it] *De la part de* Luca Deri
> *Envoyé :* mardi 24 mai 2016 09:02
> *À :* ntop-misc@listgateway.unipi.it
> *Objet :* Re: [Ntop-misc] Nprobe black list network
>
>  
>
> Loïc
>
> I have just tested and it seems to work for me. What nprobe version
> are you using? I have tested the latest 7.3 release.
>
>  
>
> Please add a “ “ between the blacklist parameter to make sure the
> shell does not mess-up. If still not working, please file a bug
> at https://github.com/ntop/nProbe/issues
>
>  
>
> Regards Luca
>
>  
>
>  
>
> On 23 May 2016, at 10:10, Loic CRUCHADE <loic.cruch...@consuel.com
> <mailto:loic.cruch...@consuel.com>> wrote:
>
>  
>
> Hello,
>
>  
>
> I recently bought Nprobe pro. I collect Netflow V9 and then sent
> it back in V5 to a server.
>
> I need to blacklist some networks, so i used the « --black-list »
> argument, but it does not seems to works.
>
>  
>
> Here is the command i use :
>
> nprobe -n udp://10.11.1.140:2055 -i none -t 20 -d 20 -a 0 -e 1 -b
> 2 -w 128000 -z 0 -S 1:1 -u 1 -Q 1 -3 9995
> --zmq tcp://127.0.0.1:5556 -V5 -G --black-list
> 10.7.0.0/16,10.1.0.0/16,10.11.0.0/16,192.168.0.0/16
>
>  
>
> And here is somes logs of networks that i dont want to send back
> to my server :
>
> 23/May/2016 09:55:43 [engine.c:2541] Emitting Flow:
> [->][icmp] *10.1.1.104:2048 -> 10.2.1.41:0 *[1 pkt/60 bytes][ifIdx
> 22273->111][0.0 sec][ECHO REPLY][init Unknown][AS: 0 -> 0]
>
> 23/May/2016 09:55:46 [engine.c:2568] Emitting Flow:
> [<-][icmp] *10.2.1.42:0 -> 10.1.1.48:2048* [2 pkt/120 bytes][ifIdx
> 111->22273][0.0 sec][AS: 0 -> 0]
>
> 23/May/2016 09:55:42 [engine.c:2361] New Flow:
> [icmp] *10.1.1.104:2048 -> 10.2.1.1:0* [00:00:00:00:00:00 ->
> 00:00:00:00:00:00][vlan 65535][tos 0][ifIdx: 22273 ->
> 111][subflowId: 0/0x][idx=69225]
>
>  
>
> What did i do wrong ?
>
>  
>
> Thanks for you help !
>
>  
>
> CRUCHADE Loïc
>
> 05.82.52.22.02
>
> Service Exploitation Informatique
>
> Direction des Systèmes d’information
>
> 
>
>  
>
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it <mailto:Ntop-misc@listgateway.unipi.it>
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
>  
>
>
>
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc

___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Re: [Ntop-misc] Nprobe black list network

2016-05-24 Thread Loic CRUCHADE 
Hello,

Thanks for the reply.
I reached the same goal with the « collection-filter » argument.
But i had some problems too. The « ! » was returning a shell fuction i think. 
Whan use it put some « yum install… » instead of the « ! ».
I solved this by using a configuration file for nprobe.
Now, the last thing i have to do is to filter only Office365 flows, but it’s 
tricky because of there is almost 1000 IP to filter.
If anybody have an idea.
Thanks again.

CRUCHADE Loïc
05.82.52.22.02
Service Exploitation Informatique
Direction des Systèmes d’information
[logo]

De : ntop-misc-boun...@listgateway.unipi.it 
[mailto:ntop-misc-boun...@listgateway.unipi.it] De la part de Luca Deri
Envoyé : mardi 24 mai 2016 09:02
À : ntop-misc@listgateway.unipi.it
Objet : Re: [Ntop-misc] Nprobe black list network

Loïc
I have just tested and it seems to work for me. What nprobe version are you 
using? I have tested the latest 7.3 release.

Please add a “ “ between the blacklist parameter to make sure the shell does 
not mess-up. If still not working, please file a bug at 
https://github.com/ntop/nProbe/issues

Regards Luca


On 23 May 2016, at 10:10, Loic CRUCHADE 
<loic.cruch...@consuel.com<mailto:loic.cruch...@consuel.com>> wrote:

Hello,

I recently bought Nprobe pro. I collect Netflow V9 and then sent it back in V5 
to a server.
I need to blacklist some networks, so i used the « --black-list » argument, but 
it does not seems to works.

Here is the command i use :
nprobe -n udp://10.11.1.140:2055 -i none -t 20 -d 20 -a 0 -e 1 -b 2 -w 128000 
-z 0 -S 1:1 -u 1 -Q 1 -3 9995 --zmq tcp://127.0.0.1:5556 -V5 -G --black-list 
10.7.0.0/16,10.1.0.0/16,10.11.0.0/16,192.168.0.0/16

And here is somes logs of networks that i dont want to send back to my server :
23/May/2016 09:55:43 [engine.c:2541] Emitting Flow: [->][icmp] 10.1.1.104:2048 
-> 10.2.1.41:0 [1 pkt/60 bytes][ifIdx 22273->111][0.0 sec][ECHO REPLY][init 
Unknown][AS: 0 -> 0]
23/May/2016 09:55:46 [engine.c:2568] Emitting Flow: [<-][icmp] 10.2.1.42:0 -> 
10.1.1.48:2048 [2 pkt/120 bytes][ifIdx 111->22273][0.0 sec][AS: 0 -> 0]
23/May/2016 09:55:42 [engine.c:2361] New Flow: [icmp] 10.1.1.104:2048 -> 
10.2.1.1:0 [00:00:00:00:00:00 -> 00:00:00:00:00:00][vlan 65535][tos 0][ifIdx: 
22273 -> 111][subflowId: 0/0x][idx=69225]

What did i do wrong ?

Thanks for you help !

CRUCHADE Loïc
05.82.52.22.02
Service Exploitation Informatique
Direction des Systèmes d’information


___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it<mailto:Ntop-misc@listgateway.unipi.it>
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Re: [Ntop-misc] Nprobe black list network

2016-05-24 Thread Luca Deri 
Loïc
I have just tested and it seems to work for me. What nprobe version are you 
using? I have tested the latest 7.3 release.

Please add a “ “ between the blacklist parameter to make sure the shell does 
not mess-up. If still not working, please file a bug at 
https://github.com/ntop/nProbe/issues

Regards Luca


> On 23 May 2016, at 10:10, Loic CRUCHADE  wrote:
> 
> Hello,
>  
> I recently bought Nprobe pro. I collect Netflow V9 and then sent it back in 
> V5 to a server.
> I need to blacklist some networks, so i used the « --black-list » argument, 
> but it does not seems to works.
>  
> Here is the command i use :
> nprobe -n udp://10.11.1.140:2055  -i none -t 20 -d 20 
> -a 0 -e 1 -b 2 -w 128000 -z 0 -S 1:1 -u 1 -Q 1 -3 9995 --zmq 
> tcp://127.0.0.1:5556  -V5 -G --black-list 
> 10.7.0.0/16,10.1.0.0/16,10.11.0.0/16,192.168.0.0/16
>  
> And here is somes logs of networks that i dont want to send back to my server 
> :
> 23/May/2016 09:55:43 [engine.c:2541] Emitting Flow: [->][icmp] 
> 10.1.1.104:2048 -> 10.2.1.41:0 [1 pkt/60 bytes][ifIdx 22273->111][0.0 
> sec][ECHO REPLY][init Unknown][AS: 0 -> 0]
> 23/May/2016 09:55:46 [engine.c:2568] Emitting Flow: [<-][icmp] 10.2.1.42:0 -> 
> 10.1.1.48:2048 [2 pkt/120 bytes][ifIdx 111->22273][0.0 sec][AS: 0 -> 0]
> 23/May/2016 09:55:42 [engine.c:2361] New Flow: [icmp] 10.1.1.104:2048 -> 
> 10.2.1.1:0 [00:00:00:00:00:00 -> 00:00:00:00:00:00][vlan 65535][tos 0][ifIdx: 
> 22273 -> 111][subflowId: 0/0x][idx=69225]
>  
> What did i do wrong ?
>  
> Thanks for you help !
>  
> CRUCHADE Loïc
> 05.82.52.22.02
> Service Exploitation Informatique
> Direction des Systèmes d’information
> 
>  
> ___
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it 
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc 
> 
___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

[Ntop-misc] Nprobe black list network

2016-05-23 Thread Loic CRUCHADE 
Hello,

I recently bought Nprobe pro. I collect Netflow V9 and then sent it back in V5 
to a server.
I need to blacklist some networks, so i used the « --black-list » argument, but 
it does not seems to works.

Here is the command i use :
nprobe -n udp://10.11.1.140:2055 -i none -t 20 -d 20 -a 0 -e 1 -b 2 -w 128000 
-z 0 -S 1:1 -u 1 -Q 1 -3 9995 --zmq tcp://127.0.0.1:5556 -V5 -G --black-list 
10.7.0.0/16,10.1.0.0/16,10.11.0.0/16,192.168.0.0/16

And here is somes logs of networks that i dont want to send back to my server :
23/May/2016 09:55:43 [engine.c:2541] Emitting Flow: [->][icmp] 10.1.1.104:2048 
-> 10.2.1.41:0 [1 pkt/60 bytes][ifIdx 22273->111][0.0 sec][ECHO REPLY][init 
Unknown][AS: 0 -> 0]
23/May/2016 09:55:46 [engine.c:2568] Emitting Flow: [<-][icmp] 10.2.1.42:0 -> 
10.1.1.48:2048 [2 pkt/120 bytes][ifIdx 111->22273][0.0 sec][AS: 0 -> 0]
23/May/2016 09:55:42 [engine.c:2361] New Flow: [icmp] 10.1.1.104:2048 -> 
10.2.1.1:0 [00:00:00:00:00:00 -> 00:00:00:00:00:00][vlan 65535][tos 0][ifIdx: 
22273 -> 111][subflowId: 0/0x][idx=69225]

What did i do wrong ?

Thanks for you help !

CRUCHADE Loïc
05.82.52.22.02
Service Exploitation Informatique
Direction des Systèmes d'information
[logo]

___
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc