Hi guys,
I have a running nprobe+ntopng server, collecting netflow from several sources.
My collectors are routers connected to different Peers / Transit providers on different interfaces.
Currently, each source send a global flow to my nprobe server, and each nprobe instance expose data to ntopng using different ZMQ endpoints.
So I have traffic statistics by router.
Now, I would like to get statistics by peer/provider, and not just by router.
So I would like to have have one zmq interface by peer/provider in ntopng.
To achieve this, I need to be able to filter the collected flow using the interface on the source router, but I cannot find the proper way to do this, as it seems I cannot use BPF filters in collector mode.
Here is the way I try to make it :
Peer1;if1 -- zmq localhost:5556
\ / \
Router1 --- (netflow v5 udp:1234) ---> nprobe ntopng
/ \ /
Peer2:if2 -- zmq localhost;5557
Do you know how I could achieve this ?
Thaks & regards
I have a running nprobe+ntopng server, collecting netflow from several sources.
My collectors are routers connected to different Peers / Transit providers on different interfaces.
Currently, each source send a global flow to my nprobe server, and each nprobe instance expose data to ntopng using different ZMQ endpoints.
So I have traffic statistics by router.
Now, I would like to get statistics by peer/provider, and not just by router.
So I would like to have have one zmq interface by peer/provider in ntopng.
To achieve this, I need to be able to filter the collected flow using the interface on the source router, but I cannot find the proper way to do this, as it seems I cannot use BPF filters in collector mode.
Here is the way I try to make it :
Peer1;if1 -- zmq localhost:5556
\ / \
Router1 --- (netflow v5 udp:1234) ---> nprobe ntopng
/ \ /
Peer2:if2 -- zmq localhost;5557
Do you know how I could achieve this ?
Thaks & regards