Hello Luca
I stopped nProbe and started it again with the same command line (just
added the -b 2 option). Still no flows or any other traffic. I think this
is a switch problem. This morning I asked for the sampling rate to be
adjusted on the switch, which then immediately gave me results on ntopng
although no flows or protocol data was available. We then tried another
uplink port and no data came through. To be honest I think this is a Dell
switch limitation. This port is part of a LAG so I think that's
interfering. Let me try another port again and get back to you. Also, if we
wish to save this info as we are getting the flows what command line option
should i add?
On Fri, May 6, 2016 at 12:00 PM, <ntop-misc-request@listgateway.unipi.it>
wrote:
> Send Ntop-misc mailing list submissions to
> ntop-misc@listgateway.unipi.it
>
> To subscribe or unsubscribe via the World Wide Web, visit
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
> or, via email, send a message with subject or body 'help' to
> ntop-misc-request@listgateway.unipi.it
>
> You can reach the person managing the list at
> ntop-misc-owner@listgateway.unipi.it
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Ntop-misc digest..."
>
>
> Today's Topics:
>
> 1. Re: nProbe and ntopng - Collecting sFlow Data
> (Karl van der Schyff)
> 2. Re: nProbe and ntopng - Collecting sFlow Data (Luca Deri)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Fri, 6 May 2016 09:35:07 +0200
> From: Karl van der Schyff <karl@vanderschyff.net>
> To: ntop-misc@listgateway.unipi.it
> Subject: Re: [Ntop-misc] nProbe and ntopng - Collecting sFlow Data
> Message-ID:
> <
> CAOBUDpRQsuVYWiy4dvxZmMMEb0UeNfv4qeG05cOQc3aFDRBi7g@mail.gmail.com>
> Content-Type: text/plain; charset="utf-8"
>
> Hello
>
> I have been trying to get these two products to collect sFlow data from our
> Dell switches, but just can't get it working. I am currently running nProbe
> with the following arguments:
>
> nprobe --zmq tcp://127.0.0.1:5556 -i none -n none --collector-port 2055 -G
>
> and ntopng with these arguments:
>
> ntopng -G /var/tmp/ntopng.pid -e -i tcp://127.0.0.1:5556 -w 3000 -m
> 192.168.1.0/24 -n 1 -d /var/tmp/ntopng -q
>
> When I log into ntopng I get absolutely nothing. When i run tcpdump -v I
> also seem to only see traffic actually destined for the machine I am
> running nProbe on. Assuming that the switch is correctly configured should
> tcpdump be showing me the sflow traffic? If so, my assumption is incorrect.
>
> Any help would be appreciated.
>
> Thanks
> Karl
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <
> http://listgateway.unipi.it/mailman/private/ntop-misc/attachments/20160506/7036121d/attachment-0001.htm
> >
>
> ------------------------------
>
> Message: 2
> Date: Fri, 6 May 2016 10:06:12 +0200
> From: Luca Deri <deri@ntop.org>
> To: ntop-misc@listgateway.unipi.it
> Subject: Re: [Ntop-misc] nProbe and ntopng - Collecting sFlow Data
> Message-ID: <84FC95AE-9FB3-4ABD-95E8-21E092E4365D@ntop.org>
> Content-Type: text/plain; charset="utf-8"
>
> Karl,
> can you please add ?-b 2? to nProbe to see if flows are properly
> collected? Please note that we need packet samples in sflows (not just
> bytes and counters)
>
> Regard Luca
>
> > On 06 May 2016, at 09:35, Karl van der Schyff <karl@vanderschyff.net>
> wrote:
> >
> > Hello
> >
> > I have been trying to get these two products to collect sFlow data from
> our Dell switches, but just can't get it working. I am currently running
> nProbe with the following arguments:
> >
> > nprobe --zmq tcp://127.0.0.1:5556 <http://127.0.0.1:5556/> -i none -n
> none --collector-port 2055 -G
> >
> > and ntopng with these arguments:
> >
> > ntopng -G /var/tmp/ntopng.pid -e -i tcp://127.0.0.1:5556 <
> http://127.0.0.1:5556/> -w 3000 -m 192.168.1.0/24 <http://192.168.1.0/24>
> -n 1 -d /var/tmp/ntopng -q
> >
> > When I log into ntopng I get absolutely nothing. When i run tcpdump -v I
> also seem to only see traffic actually destined for the machine I am
> running nProbe on. Assuming that the switch is correctly configured should
> tcpdump be showing me the sflow traffic? If so, my assumption is incorrect.
> >
> > Any help would be appreciated.
> >
> > Thanks
> > Karl
> > _______________________________________________
> > Ntop-misc mailing list
> > Ntop-misc@listgateway.unipi.it
> > http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <
> http://listgateway.unipi.it/mailman/private/ntop-misc/attachments/20160506/31cd0df5/attachment-0001.htm
> >
>
> ------------------------------
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
> End of Ntop-misc Digest, Vol 143, Issue 4
> *****************************************
>
I stopped nProbe and started it again with the same command line (just
added the -b 2 option). Still no flows or any other traffic. I think this
is a switch problem. This morning I asked for the sampling rate to be
adjusted on the switch, which then immediately gave me results on ntopng
although no flows or protocol data was available. We then tried another
uplink port and no data came through. To be honest I think this is a Dell
switch limitation. This port is part of a LAG so I think that's
interfering. Let me try another port again and get back to you. Also, if we
wish to save this info as we are getting the flows what command line option
should i add?
On Fri, May 6, 2016 at 12:00 PM, <ntop-misc-request@listgateway.unipi.it>
wrote:
> Send Ntop-misc mailing list submissions to
> ntop-misc@listgateway.unipi.it
>
> To subscribe or unsubscribe via the World Wide Web, visit
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
> or, via email, send a message with subject or body 'help' to
> ntop-misc-request@listgateway.unipi.it
>
> You can reach the person managing the list at
> ntop-misc-owner@listgateway.unipi.it
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Ntop-misc digest..."
>
>
> Today's Topics:
>
> 1. Re: nProbe and ntopng - Collecting sFlow Data
> (Karl van der Schyff)
> 2. Re: nProbe and ntopng - Collecting sFlow Data (Luca Deri)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Fri, 6 May 2016 09:35:07 +0200
> From: Karl van der Schyff <karl@vanderschyff.net>
> To: ntop-misc@listgateway.unipi.it
> Subject: Re: [Ntop-misc] nProbe and ntopng - Collecting sFlow Data
> Message-ID:
> <
> CAOBUDpRQsuVYWiy4dvxZmMMEb0UeNfv4qeG05cOQc3aFDRBi7g@mail.gmail.com>
> Content-Type: text/plain; charset="utf-8"
>
> Hello
>
> I have been trying to get these two products to collect sFlow data from our
> Dell switches, but just can't get it working. I am currently running nProbe
> with the following arguments:
>
> nprobe --zmq tcp://127.0.0.1:5556 -i none -n none --collector-port 2055 -G
>
> and ntopng with these arguments:
>
> ntopng -G /var/tmp/ntopng.pid -e -i tcp://127.0.0.1:5556 -w 3000 -m
> 192.168.1.0/24 -n 1 -d /var/tmp/ntopng -q
>
> When I log into ntopng I get absolutely nothing. When i run tcpdump -v I
> also seem to only see traffic actually destined for the machine I am
> running nProbe on. Assuming that the switch is correctly configured should
> tcpdump be showing me the sflow traffic? If so, my assumption is incorrect.
>
> Any help would be appreciated.
>
> Thanks
> Karl
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <
> http://listgateway.unipi.it/mailman/private/ntop-misc/attachments/20160506/7036121d/attachment-0001.htm
> >
>
> ------------------------------
>
> Message: 2
> Date: Fri, 6 May 2016 10:06:12 +0200
> From: Luca Deri <deri@ntop.org>
> To: ntop-misc@listgateway.unipi.it
> Subject: Re: [Ntop-misc] nProbe and ntopng - Collecting sFlow Data
> Message-ID: <84FC95AE-9FB3-4ABD-95E8-21E092E4365D@ntop.org>
> Content-Type: text/plain; charset="utf-8"
>
> Karl,
> can you please add ?-b 2? to nProbe to see if flows are properly
> collected? Please note that we need packet samples in sflows (not just
> bytes and counters)
>
> Regard Luca
>
> > On 06 May 2016, at 09:35, Karl van der Schyff <karl@vanderschyff.net>
> wrote:
> >
> > Hello
> >
> > I have been trying to get these two products to collect sFlow data from
> our Dell switches, but just can't get it working. I am currently running
> nProbe with the following arguments:
> >
> > nprobe --zmq tcp://127.0.0.1:5556 <http://127.0.0.1:5556/> -i none -n
> none --collector-port 2055 -G
> >
> > and ntopng with these arguments:
> >
> > ntopng -G /var/tmp/ntopng.pid -e -i tcp://127.0.0.1:5556 <
> http://127.0.0.1:5556/> -w 3000 -m 192.168.1.0/24 <http://192.168.1.0/24>
> -n 1 -d /var/tmp/ntopng -q
> >
> > When I log into ntopng I get absolutely nothing. When i run tcpdump -v I
> also seem to only see traffic actually destined for the machine I am
> running nProbe on. Assuming that the switch is correctly configured should
> tcpdump be showing me the sflow traffic? If so, my assumption is incorrect.
> >
> > Any help would be appreciated.
> >
> > Thanks
> > Karl
> > _______________________________________________
> > Ntop-misc mailing list
> > Ntop-misc@listgateway.unipi.it
> > http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <
> http://listgateway.unipi.it/mailman/private/ntop-misc/attachments/20160506/31cd0df5/attachment-0001.htm
> >
>
> ------------------------------
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc
>
> End of Ntop-misc Digest, Vol 143, Issue 4
> *****************************************
>