Advanced
Mailing List Archive

Mailing List Archive

  1. Home >
  2. NTop>
  3. Users
Nprobe + ntopng packet detailed statistics
mikhaelc at infinidat
Feb 8, 2017, 11:53 PM
Post #1 of 7 (642 views)
Permalink
Hi,
I've just got nprobe (pro), voip plugin, ntopng (ce).
was planned to use it to monitor voip problems.
But could not configure them (nprobe + ntopng) to work right. Ntopng does
not show any VOIP/TOS related statistics

Tried to run it as described there
http://www.ntop.org/nprobe/monitoring-voip-traffic-with-nprobe-and-ntopng/


1. # nprobe -i eth1 -T "%IPV4_SRC_ADDR %IPV4_DST_ADDR %IPV4_NEXT_HOP
%INPUT_SNMP %OUTPUT_SNMP %IN_PKTS %IN_BYTES %FIRST_SWITCHED %LAST_SWITCHED
%L4_SRC_PORT %L4_DST_PORT %TCP_FLAGS %PROTOCOL %L7_PROTO @SIP@ @RTP@"
--redis localhost --zmq tcp://127.0.0.1:1234
2.
3. $ ntopng -i tcp://127.0.0.1:1234


and this version
nprobe -i ens192 -T "%IPV4_SRC_ADDR %IPV4_DST_ADDR %IPV4_NEXT_HOP
%INPUT_SNMP %OUTPUT_SNMP %IN_PKTS %IN_BYTES %FIRST_SWITCHED %LAST_SWITCHED
%L4_SRC_PORT %L4_DST_PORT %TCP_FLAGS %PROTOCOL %L7_PROTO @SIP@ @RTP@"
--redis localhost --zmq-probe-mode --zmq-encrypt-pwd myencryptionkey
--online-license-check


Still see no voip packet or COS/TOS details.


What am I doing wrong ?

Best,
Mike
Re: Nprobe + ntopng packet detailed statistics [ In reply to ]
deri at ntop
Feb 9, 2017, 12:51 AM
Post #2 of 7 (642 views)
Permalink
Mikhael,
are you using the latest development versions of ntopng and nProbe? If
not, please do

Luca


On 02/09/2017 08:53 AM, Mikhael Chernogorsky wrote:
> Hi,
> I've just got nprobe (pro), voip plugin, ntopng (ce).
> was planned to use it to monitor voip problems.
> But could not configure them (nprobe + ntopng) to work right. Ntopng
> does not show any VOIP/TOS related statistics
>
> Tried to run it as described there
> http://www.ntop.org/nprobe/monitoring-voip-traffic-with-nprobe-and-ntopng/
>
> 1. # nprobe -i eth1 -T "%IPV4_SRC_ADDR %IPV4_DST_ADDR %IPV4_NEXT_HOP
> %INPUT_SNMP %OUTPUT_SNMP %IN_PKTS %IN_BYTES %FIRST_SWITCHED
> %LAST_SWITCHED %L4_SRC_PORT %L4_DST_PORT %TCP_FLAGS %PROTOCOL
> %L7_PROTO @SIP@ @RTP@" --redis localhost --zmq
> tcp://127.0.0.1:1234 <http://127.0.0.1:1234>
> 2.
> 3. $ ntopng -i tcp://127.0.0.1:1234 <http://127.0.0.1:1234>
>
>
> and this version
> nprobe -i ens192 -T "%IPV4_SRC_ADDR %IPV4_DST_ADDR %IPV4_NEXT_HOP
> %INPUT_SNMP %OUTPUT_SNMP %IN_PKTS %IN_BYTES %FIRST_SWITCHED
> %LAST_SWITCHED %L4_SRC_PORT %L4_DST_PORT %TCP_FLAGS %PROTOCOL
> %L7_PROTO @SIP@ @RTP@" --redis localhost --zmq-probe-mode
> --zmq-encrypt-pwd myencryptionkey --online-license-check
>
>
> Still see no voip packet or COS/TOS details.
>
>
> What am I doing wrong ?
>
> Best,
> Mike
>
>
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
Re: Nprobe + ntopng packet detailed statistics [ In reply to ]
mikhaelc at infinidat
Feb 9, 2017, 1:23 AM
Post #3 of 7 (642 views)
Permalink
Hi Luca,
nope, using stable one. will check with devs

Thanks,
Mike

On Thu, Feb 9, 2017 at 10:51 AM, Luca Deri <deri@ntop.org> wrote:

> Mikhael,
> are you using the latest development versions of ntopng and nProbe? If
> not, please do
>
> Luca
>
>
>
> On 02/09/2017 08:53 AM, Mikhael Chernogorsky wrote:
>
> Hi,
> I've just got nprobe (pro), voip plugin, ntopng (ce).
> was planned to use it to monitor voip problems.
> But could not configure them (nprobe + ntopng) to work right. Ntopng does
> not show any VOIP/TOS related statistics
>
> Tried to run it as described there
> http://www.ntop.org/nprobe/monitoring-voip-traffic-with-nprobe-and-ntopng/
>
>
> 1. # nprobe -i eth1 -T "%IPV4_SRC_ADDR %IPV4_DST_ADDR %IPV4_NEXT_HOP
> %INPUT_SNMP %OUTPUT_SNMP %IN_PKTS %IN_BYTES %FIRST_SWITCHED %LAST_SWITCHED
> %L4_SRC_PORT %L4_DST_PORT %TCP_FLAGS %PROTOCOL %L7_PROTO @SIP@ @RTP@"
> --redis localhost --zmq tcp://127.0.0.1:1234
> 2.
> 3. $ ntopng -i tcp://127.0.0.1:1234
>
>
> and this version
> nprobe -i ens192 -T "%IPV4_SRC_ADDR %IPV4_DST_ADDR %IPV4_NEXT_HOP
> %INPUT_SNMP %OUTPUT_SNMP %IN_PKTS %IN_BYTES %FIRST_SWITCHED %LAST_SWITCHED
> %L4_SRC_PORT %L4_DST_PORT %TCP_FLAGS %PROTOCOL %L7_PROTO @SIP@ @RTP@"
> --redis localhost --zmq-probe-mode --zmq-encrypt-pwd myencryptionkey
> --online-license-check
>
>
> Still see no voip packet or COS/TOS details.
>
>
> What am I doing wrong ?
>
> Best,
> Mike
>
>
> _______________________________________________
> Ntop mailing listNtop@listgateway.unipi.ithttp://listgateway.unipi.it/mailman/listinfo/ntop
>
>
>
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
>
Re: Nprobe + ntopng packet detailed statistics [ In reply to ]
mikhaelc at infinidat
Feb 9, 2017, 3:10 AM
Post #4 of 7 (642 views)
Permalink
Hi again,

checked with a night build.
Have the same result (no TOS/COS info) for TOS.

Have 12:52:05 [nprobe.c:7312] IP TOS is accounted on probe side

Should this informations be displayed on a flow page ?

Im checking it with ssh (tos 0x10) and ping -Q packets/flows

Thanks,
Mike



On Thu, Feb 9, 2017 at 11:23 AM, Mikhael Chernogorsky <
mikhaelc@infinidat.com> wrote:

> Hi Luca,
> nope, using stable one. will check with devs
>
> Thanks,
> Mike
>
> On Thu, Feb 9, 2017 at 10:51 AM, Luca Deri <deri@ntop.org> wrote:
>
>> Mikhael,
>> are you using the latest development versions of ntopng and nProbe? If
>> not, please do
>>
>> Luca
>>
>>
>>
>> On 02/09/2017 08:53 AM, Mikhael Chernogorsky wrote:
>>
>> Hi,
>> I've just got nprobe (pro), voip plugin, ntopng (ce).
>> was planned to use it to monitor voip problems.
>> But could not configure them (nprobe + ntopng) to work right. Ntopng does
>> not show any VOIP/TOS related statistics
>>
>> Tried to run it as described there
>> http://www.ntop.org/nprobe/monitoring-voip-traffic-with-npro
>> be-and-ntopng/
>>
>>
>> 1. # nprobe -i eth1 -T "%IPV4_SRC_ADDR %IPV4_DST_ADDR %IPV4_NEXT_HOP
>> %INPUT_SNMP %OUTPUT_SNMP %IN_PKTS %IN_BYTES %FIRST_SWITCHED %LAST_SWITCHED
>> %L4_SRC_PORT %L4_DST_PORT %TCP_FLAGS %PROTOCOL %L7_PROTO @SIP@ @RTP@"
>> --redis localhost --zmq tcp://127.0.0.1:1234
>> 2.
>> 3. $ ntopng -i tcp://127.0.0.1:1234
>>
>>
>> and this version
>> nprobe -i ens192 -T "%IPV4_SRC_ADDR %IPV4_DST_ADDR %IPV4_NEXT_HOP
>> %INPUT_SNMP %OUTPUT_SNMP %IN_PKTS %IN_BYTES %FIRST_SWITCHED %LAST_SWITCHED
>> %L4_SRC_PORT %L4_DST_PORT %TCP_FLAGS %PROTOCOL %L7_PROTO @SIP@ @RTP@"
>> --redis localhost --zmq-probe-mode --zmq-encrypt-pwd myencryptionkey
>> --online-license-check
>>
>>
>> Still see no voip packet or COS/TOS details.
>>
>>
>> What am I doing wrong ?
>>
>> Best,
>> Mike
>>
>>
>> _______________________________________________
>> Ntop mailing listNtop@listgateway.unipi.ithttp://listgateway.unipi.it/mailman/listinfo/ntop
>>
>>
>>
>> _______________________________________________
>> Ntop mailing list
>> Ntop@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>
>
>
Re: Nprobe + ntopng packet detailed statistics [ In reply to ]
jphuman at gmail
Feb 9, 2017, 4:42 AM
Post #5 of 7 (642 views)
Permalink
Hi Luca

Upgraded to nightly however no changes, see the attached image.

https://imagebin.ca/v/3BnZuBaPazqu

Thanks
Jean-Pierre Human

On Thu, Feb 9, 2017 at 1:10 PM, Mikhael Chernogorsky <mikhaelc@infinidat.com
> wrote:

> Hi again,
>
> checked with a night build.
> Have the same result (no TOS/COS info) for TOS.
>
> Have 12:52:05 [nprobe.c:7312] IP TOS is accounted on probe side
>
> Should this informations be displayed on a flow page ?
>
> Im checking it with ssh (tos 0x10) and ping -Q packets/flows
>
> Thanks,
> Mike
>
>
>
> On Thu, Feb 9, 2017 at 11:23 AM, Mikhael Chernogorsky <
> mikhaelc@infinidat.com> wrote:
>
>> Hi Luca,
>> nope, using stable one. will check with devs
>>
>> Thanks,
>> Mike
>>
>> On Thu, Feb 9, 2017 at 10:51 AM, Luca Deri <deri@ntop.org> wrote:
>>
>>> Mikhael,
>>> are you using the latest development versions of ntopng and nProbe? If
>>> not, please do
>>>
>>> Luca
>>>
>>>
>>>
>>> On 02/09/2017 08:53 AM, Mikhael Chernogorsky wrote:
>>>
>>> Hi,
>>> I've just got nprobe (pro), voip plugin, ntopng (ce).
>>> was planned to use it to monitor voip problems.
>>> But could not configure them (nprobe + ntopng) to work right. Ntopng
>>> does not show any VOIP/TOS related statistics
>>>
>>> Tried to run it as described there
>>> http://www.ntop.org/nprobe/monitoring-voip-traffic-with-npro
>>> be-and-ntopng/
>>>
>>>
>>> 1. # nprobe -i eth1 -T "%IPV4_SRC_ADDR %IPV4_DST_ADDR %IPV4_NEXT_HOP
>>> %INPUT_SNMP %OUTPUT_SNMP %IN_PKTS %IN_BYTES %FIRST_SWITCHED %LAST_SWITCHED
>>> %L4_SRC_PORT %L4_DST_PORT %TCP_FLAGS %PROTOCOL %L7_PROTO @SIP@ @RTP@"
>>> --redis localhost --zmq tcp://127.0.0.1:1234
>>> 2.
>>> 3. $ ntopng -i tcp://127.0.0.1:1234
>>>
>>>
>>> and this version
>>> nprobe -i ens192 -T "%IPV4_SRC_ADDR %IPV4_DST_ADDR %IPV4_NEXT_HOP
>>> %INPUT_SNMP %OUTPUT_SNMP %IN_PKTS %IN_BYTES %FIRST_SWITCHED %LAST_SWITCHED
>>> %L4_SRC_PORT %L4_DST_PORT %TCP_FLAGS %PROTOCOL %L7_PROTO @SIP@ @RTP@"
>>> --redis localhost --zmq-probe-mode --zmq-encrypt-pwd myencryptionkey
>>> --online-license-check
>>>
>>>
>>> Still see no voip packet or COS/TOS details.
>>>
>>>
>>> What am I doing wrong ?
>>>
>>> Best,
>>> Mike
>>>
>>>
>>> _______________________________________________
>>> Ntop mailing listNtop@listgateway.unipi.ithttp://listgateway.unipi.it/mailman/listinfo/ntop
>>>
>>>
>>>
>>> _______________________________________________
>>> Ntop mailing list
>>> Ntop@listgateway.unipi.it
>>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>>
>>
>>
>
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
>
Re: Nprobe + ntopng packet detailed statistics [ In reply to ]
jphuman at gmail
Feb 9, 2017, 4:43 AM
Post #6 of 7 (642 views)
Permalink
Sorry wrong thread...

On Thu, Feb 9, 2017 at 2:42 PM, Jean-Pierre Human <jphuman@gmail.com> wrote:

> Hi Luca
>
> Upgraded to nightly however no changes, see the attached image.
>
> https://imagebin.ca/v/3BnZuBaPazqu
>
> Thanks
> Jean-Pierre Human
>
> On Thu, Feb 9, 2017 at 1:10 PM, Mikhael Chernogorsky <
> mikhaelc@infinidat.com> wrote:
>
>> Hi again,
>>
>> checked with a night build.
>> Have the same result (no TOS/COS info) for TOS.
>>
>> Have 12:52:05 [nprobe.c:7312] IP TOS is accounted on probe side
>>
>> Should this informations be displayed on a flow page ?
>>
>> Im checking it with ssh (tos 0x10) and ping -Q packets/flows
>>
>> Thanks,
>> Mike
>>
>>
>>
>> On Thu, Feb 9, 2017 at 11:23 AM, Mikhael Chernogorsky <
>> mikhaelc@infinidat.com> wrote:
>>
>>> Hi Luca,
>>> nope, using stable one. will check with devs
>>>
>>> Thanks,
>>> Mike
>>>
>>> On Thu, Feb 9, 2017 at 10:51 AM, Luca Deri <deri@ntop.org> wrote:
>>>
>>>> Mikhael,
>>>> are you using the latest development versions of ntopng and nProbe? If
>>>> not, please do
>>>>
>>>> Luca
>>>>
>>>>
>>>>
>>>> On 02/09/2017 08:53 AM, Mikhael Chernogorsky wrote:
>>>>
>>>> Hi,
>>>> I've just got nprobe (pro), voip plugin, ntopng (ce).
>>>> was planned to use it to monitor voip problems.
>>>> But could not configure them (nprobe + ntopng) to work right. Ntopng
>>>> does not show any VOIP/TOS related statistics
>>>>
>>>> Tried to run it as described there
>>>> http://www.ntop.org/nprobe/monitoring-voip-traffic-with-npro
>>>> be-and-ntopng/
>>>>
>>>>
>>>> 1. # nprobe -i eth1 -T "%IPV4_SRC_ADDR %IPV4_DST_ADDR
>>>> %IPV4_NEXT_HOP %INPUT_SNMP %OUTPUT_SNMP %IN_PKTS %IN_BYTES %FIRST_SWITCHED
>>>> %LAST_SWITCHED %L4_SRC_PORT %L4_DST_PORT %TCP_FLAGS %PROTOCOL %L7_PROTO
>>>> @SIP@ @RTP@" --redis localhost --zmq tcp://127.0.0.1:1234
>>>> 2.
>>>> 3. $ ntopng -i tcp://127.0.0.1:1234
>>>>
>>>>
>>>> and this version
>>>> nprobe -i ens192 -T "%IPV4_SRC_ADDR %IPV4_DST_ADDR %IPV4_NEXT_HOP
>>>> %INPUT_SNMP %OUTPUT_SNMP %IN_PKTS %IN_BYTES %FIRST_SWITCHED %LAST_SWITCHED
>>>> %L4_SRC_PORT %L4_DST_PORT %TCP_FLAGS %PROTOCOL %L7_PROTO @SIP@ @RTP@"
>>>> --redis localhost --zmq-probe-mode --zmq-encrypt-pwd myencryptionkey
>>>> --online-license-check
>>>>
>>>>
>>>> Still see no voip packet or COS/TOS details.
>>>>
>>>>
>>>> What am I doing wrong ?
>>>>
>>>> Best,
>>>> Mike
>>>>
>>>>
>>>> _______________________________________________
>>>> Ntop mailing listNtop@listgateway.unipi.ithttp://listgateway.unipi.it/mailman/listinfo/ntop
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> Ntop mailing list
>>>> Ntop@listgateway.unipi.it
>>>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>>>
>>>
>>>
>>
>> _______________________________________________
>> Ntop mailing list
>> Ntop@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>
>
>
Re: Nprobe + ntopng packet detailed statistics [ In reply to ]
mikhaelc at infinidat
Feb 20, 2017, 4:09 AM
Post #7 of 7 (609 views)
Permalink
It works with -V 9 key

nprobe -i ens192 -n none -T "%IPV4_SRC_ADDR %IPV4_DST_ADDR %IPV4_NEXT_HOP
%INPUT_SNMP %OUTPUT_SNMP %IN_PKTS %IN_BYTES %FIRST_SWITCHED %LAST_SWITCHED
%L4_SRC_PORT %L4_DST_PORT %TCP_FLAGS %PROTOCOL %L7_PROTO @SIP@ @RTP@"
--tunnel --redis localhost --zmq tcp://127.0.0.1:1234 --zmq-probe-mode
--zmq-encrypt-pwd myencryptionkey --online-license-check -V 9


(--tunnel for erspan)

Best,
Mike

On Thu, Feb 9, 2017 at 2:43 PM, Jean-Pierre Human <jphuman@gmail.com> wrote:

> Sorry wrong thread...
>
> On Thu, Feb 9, 2017 at 2:42 PM, Jean-Pierre Human <jphuman@gmail.com>
> wrote:
>
>> Hi Luca
>>
>> Upgraded to nightly however no changes, see the attached image.
>>
>> https://imagebin.ca/v/3BnZuBaPazqu
>>
>> Thanks
>> Jean-Pierre Human
>>
>> On Thu, Feb 9, 2017 at 1:10 PM, Mikhael Chernogorsky <
>> mikhaelc@infinidat.com> wrote:
>>
>>> Hi again,
>>>
>>> checked with a night build.
>>> Have the same result (no TOS/COS info) for TOS.
>>>
>>> Have 12:52:05 [nprobe.c:7312] IP TOS is accounted on probe side
>>>
>>> Should this informations be displayed on a flow page ?
>>>
>>> Im checking it with ssh (tos 0x10) and ping -Q packets/flows
>>>
>>> Thanks,
>>> Mike
>>>
>>>
>>>
>>> On Thu, Feb 9, 2017 at 11:23 AM, Mikhael Chernogorsky <
>>> mikhaelc@infinidat.com> wrote:
>>>
>>>> Hi Luca,
>>>> nope, using stable one. will check with devs
>>>>
>>>> Thanks,
>>>> Mike
>>>>
>>>> On Thu, Feb 9, 2017 at 10:51 AM, Luca Deri <deri@ntop.org> wrote:
>>>>
>>>>> Mikhael,
>>>>> are you using the latest development versions of ntopng and nProbe? If
>>>>> not, please do
>>>>>
>>>>> Luca
>>>>>
>>>>>
>>>>>
>>>>> On 02/09/2017 08:53 AM, Mikhael Chernogorsky wrote:
>>>>>
>>>>> Hi,
>>>>> I've just got nprobe (pro), voip plugin, ntopng (ce).
>>>>> was planned to use it to monitor voip problems.
>>>>> But could not configure them (nprobe + ntopng) to work right. Ntopng
>>>>> does not show any VOIP/TOS related statistics
>>>>>
>>>>> Tried to run it as described there
>>>>> http://www.ntop.org/nprobe/monitoring-voip-traffic-with-npro
>>>>> be-and-ntopng/
>>>>>
>>>>>
>>>>> 1. # nprobe -i eth1 -T "%IPV4_SRC_ADDR %IPV4_DST_ADDR
>>>>> %IPV4_NEXT_HOP %INPUT_SNMP %OUTPUT_SNMP %IN_PKTS %IN_BYTES %FIRST_SWITCHED
>>>>> %LAST_SWITCHED %L4_SRC_PORT %L4_DST_PORT %TCP_FLAGS %PROTOCOL %L7_PROTO
>>>>> @SIP@ @RTP@" --redis localhost --zmq tcp://127.0.0.1:1234
>>>>> 2.
>>>>> 3. $ ntopng -i tcp://127.0.0.1:1234
>>>>>
>>>>>
>>>>> and this version
>>>>> nprobe -i ens192 -T "%IPV4_SRC_ADDR %IPV4_DST_ADDR %IPV4_NEXT_HOP
>>>>> %INPUT_SNMP %OUTPUT_SNMP %IN_PKTS %IN_BYTES %FIRST_SWITCHED %LAST_SWITCHED
>>>>> %L4_SRC_PORT %L4_DST_PORT %TCP_FLAGS %PROTOCOL %L7_PROTO @SIP@ @RTP@"
>>>>> --redis localhost --zmq-probe-mode --zmq-encrypt-pwd myencryptionkey
>>>>> --online-license-check
>>>>>
>>>>>
>>>>> Still see no voip packet or COS/TOS details.
>>>>>
>>>>>
>>>>> What am I doing wrong ?
>>>>>
>>>>> Best,
>>>>> Mike
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> Ntop mailing listNtop@listgateway.unipi.ithttp://listgateway.unipi.it/mailman/listinfo/ntop
>>>>>
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> Ntop mailing list
>>>>> Ntop@listgateway.unipi.it
>>>>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>>>>
>>>>
>>>>
>>>
>>> _______________________________________________
>>> Ntop mailing list
>>> Ntop@listgateway.unipi.it
>>> http://listgateway.unipi.it/mailman/listinfo/ntop
>>>
>>
>>
>
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
>

©2024 GT.net. A Gossamer Threads company.
5th Floor, 455 Granville St., Vancouver, BC V6C 1T1, Canada | Legal