Mailing List Archive

ntop pro reporting on pcap interface
Hello,

I'm trying to find a way to generate reports on a pcap interface, but don't seem to be able to. Any start/end dates I select result in empty report output. I have made sure the pcap file is selected in "Filter Report" modal under "Network Interfaces"

Is there a correct way of doing this?

Chris
Re: ntop pro reporting on pcap interface [ In reply to ]
Chris,

Reports are generated by crunching statistics collected over time and thus
are not supported for pcap files. Traffic traces contained in pcaps are
fully processed immediately, hence no historical timeseries (and reports)
are available.

Regards,
Simone

On Fri, Dec 9, 2016 at 4:09 AM, Chris Clements <cclements@arocna3.com>
wrote:

> Hello,
>
>
>
> I’m trying to find a way to generate reports on a pcap interface, but
> don’t seem to be able to. Any start/end dates I select result in empty
> report output. I have made sure the pcap file is selected in “Filter
> Report” modal under “Network Interfaces”
>
>
>
> Is there a correct way of doing this?
>
>
>
> Chris
>
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
>
Re: ntop pro reporting on pcap interface [ In reply to ]
Chris,

Reports are generated by crunching statistics collected over time and thus
are not supported for pcap files. Traffic traces contained in pcaps are
fully processed immediately, hence no historical timeseries (and reports)
are available.

Regards,
Simone

On Fri, Dec 9, 2016 at 4:09 AM, Chris Clements <cclements@arocna3.com>
wrote:

> Hello,
>
>
>
> I’m trying to find a way to generate reports on a pcap interface, but
> don’t seem to be able to. Any start/end dates I select result in empty
> report output. I have made sure the pcap file is selected in “Filter
> Report” modal under “Network Interfaces”
>
>
>
> Is there a correct way of doing this?
>
>
>
> Chris
>
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
>
Re: ntop pro reporting on pcap interface [ In reply to ]
Chris,
what type of reports are you looking for? A pcap is handled as a standard interface and it should be similar to what you see on a live interface with the exception that time is compressed

Luca


> On 9 Dec 2016, at 04:09, Chris Clements <cclements@arocna3.com> wrote:
>
> Hello,
>
> I’m trying to find a way to generate reports on a pcap interface, but don’t seem to be able to. Any start/end dates I select result in empty report output. I have made sure the pcap file is selected in “Filter Report” modal under “Network Interfaces”
>
> Is there a correct way of doing this?
>
> Chris
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it <mailto:Ntop@listgateway.unipi.it>
> http://listgateway.unipi.it/mailman/listinfo/ntop <http://listgateway.unipi.it/mailman/listinfo/ntop>
Re: ntop pro reporting on pcap interface [ In reply to ]
Chris,
what type of reports are you looking for? A pcap is handled as a standard interface and it should be similar to what you see on a live interface with the exception that time is compressed

Luca


> On 9 Dec 2016, at 04:09, Chris Clements <cclements@arocna3.com> wrote:
>
> Hello,
>
> I’m trying to find a way to generate reports on a pcap interface, but don’t seem to be able to. Any start/end dates I select result in empty report output. I have made sure the pcap file is selected in “Filter Report” modal under “Network Interfaces”
>
> Is there a correct way of doing this?
>
> Chris
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it <mailto:Ntop@listgateway.unipi.it>
> http://listgateway.unipi.it/mailman/listinfo/ntop <http://listgateway.unipi.it/mailman/listinfo/ntop>
Re: ntop pro reporting on pcap interface [ In reply to ]
I’m brand new to ntop pro, in fact, we purchased a license just for the reporting, so it is disappointing to hear that reporting is not supported on pcap files, which is our usual use case.

Simple reports we’d be looking for that would be helpful are:


1. Top Talkers
2. Top Src Talkers
3. Top Dest Talkers
4. Top Applications/Ports
5. The above reports with GeoIP filtering (e.g., top talkers to USA destinations)

Moreover, a simple CSV export option of the tables in common ntop views (e.g. country_stats.lua) would be very helpful.

Chris


From: ntop-bounces@listgateway.unipi.it [mailto:ntop-bounces@listgateway.unipi.it] On Behalf Of Luca Deri
Sent: Friday, December 9, 2016 7:51 AM
To: ntop@unipi.it
Cc: ntop@listgateway.unipi.it
Subject: Re: [Ntop] ntop pro reporting on pcap interface

Chris,
what type of reports are you looking for? A pcap is handled as a standard interface and it should be similar to what you see on a live interface with the exception that time is compressed

Luca


On 9 Dec 2016, at 04:09, Chris Clements <cclements@arocna3.com<mailto:cclements@arocna3.com>> wrote:

Hello,

I’m trying to find a way to generate reports on a pcap interface, but don’t seem to be able to. Any start/end dates I select result in empty report output. I have made sure the pcap file is selected in “Filter Report” modal under “Network Interfaces”

Is there a correct way of doing this?

Chris
_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it<mailto:Ntop@listgateway.unipi.it>
http://listgateway.unipi.it/mailman/listinfo/ntop
Re: ntop pro reporting on pcap interface [ In reply to ]
I’m brand new to ntop pro, in fact, we purchased a license just for the reporting, so it is disappointing to hear that reporting is not supported on pcap files, which is our usual use case.

Simple reports we’d be looking for that would be helpful are:


1. Top Talkers
2. Top Src Talkers
3. Top Dest Talkers
4. Top Applications/Ports
5. The above reports with GeoIP filtering (e.g., top talkers to USA destinations)

Moreover, a simple CSV export option of the tables in common ntop views (e.g. country_stats.lua) would be very helpful.

Chris


From: ntop-bounces@listgateway.unipi.it [mailto:ntop-bounces@listgateway.unipi.it] On Behalf Of Luca Deri
Sent: Friday, December 9, 2016 7:51 AM
To: ntop@unipi.it
Cc: ntop@listgateway.unipi.it
Subject: Re: [Ntop] ntop pro reporting on pcap interface

Chris,
what type of reports are you looking for? A pcap is handled as a standard interface and it should be similar to what you see on a live interface with the exception that time is compressed

Luca


On 9 Dec 2016, at 04:09, Chris Clements <cclements@arocna3.com<mailto:cclements@arocna3.com>> wrote:

Hello,

I’m trying to find a way to generate reports on a pcap interface, but don’t seem to be able to. Any start/end dates I select result in empty report output. I have made sure the pcap file is selected in “Filter Report” modal under “Network Interfaces”

Is there a correct way of doing this?

Chris
_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it<mailto:Ntop@listgateway.unipi.it>
http://listgateway.unipi.it/mailman/listinfo/ntop