Mailing List Archive

Cisco Nexus 3K/9K switches allow you to run embedded linux containers/vm's.  Has anyone found a good use case for running ntop in this space?  Possibly using the switch to aggregate span/taps from within the environment and sending the data internally to ntop? An all-in-one aggregation/ntop box?         

Hi David
we’re not familiar with these devices but it would be nice to create a container you can use them. Please let us know more about this topic so we can build a ntopng container ready for this platform

Regards Luca

> On 19 Jun 2018, at 19:51, David Kraut <david@rocketmail.com> wrote:
>
> Cisco Nexus 3K/9K switches allow you to run embedded linux containers/vm's. Has anyone found a good use case for running ntop in this space? Possibly using the switch to aggregate span/taps from within the environment and sending the data internally to ntop? An all-in-one aggregation/ntop box?
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Hi Luca, this video does a good job of explaining the concept. Thanks
https://www.youtube.com/watch?v=kYxfTWN4nZI


On Wednesday, June 20, 2018, 1:41:23 AM CDT, Luca Deri <deri@ntop.org> wrote:

Hi Davidwe’re not familiar with these devices but it would be nice to create a container you can use them. Please let us know more about this topic so we can build a ntopng container ready for this platform
Regards Luca


On 19 Jun 2018, at 19:51, David Kraut <david@rocketmail.com> wrote:
Cisco Nexus 3K/9K switches allow you to run embedded linux containers/vm's.  Has anyone found a good use case for running ntop in this space?  Possibly using the switch to aggregate span/taps from within the environment and sending the data internally to ntop? An all-in-one aggregation/ntop box?         
_______________________________________________
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

_______________________________________________
Ntop-misc mailing list
Ntop-misc@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Is it possible to run nprobe and ntopng on the same box?  If so, what is the correct config for Ubuntu 18 assuming I want to ingest both both SPAN and Netflow and ultimately send stale data to ELK (or similar) to maintain ~30 day history.  I'm able to get ntopng working and connect via port 3000, but when I try to install nprobe on the same box, I'm never able to get port 2055 to show as listening via netstat. 
Thanks!     

David
yes you can. When you want to do SPAN + collection you need to start two nprobe instances both exporting to ELK.

So

nprobe -n none -i ethX … --elastic …
nprobe -n none -i none -3 <port> … --elastic …

Regards Luca

> On 12 Jul 2018, at 05:51, David Kraut <david@rocketmail.com> wrote:
>
> Is it possible to run nprobe and ntopng on the same box? If so, what is the correct config for Ubuntu 18 assuming I want to ingest both both SPAN and Netflow and ultimately send stale data to ELK (or similar) to maintain ~30 day history. I'm able to get ntopng working and connect via port 3000, but when I try to install nprobe on the same box, I'm never able to get port 2055 to show as listening via netstat.
>
> Thanks!
>
> _______________________________________________
> Ntop-misc mailing list
> Ntop-misc@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop-misc