Mailing List Archive

ntopng installation
First of all I would like to thanks about the great software.

Nowadays I am giving a try to ntopng to monitor our internet usage.
I am monitoring Draytek 2860 mirrored port.
I have 2 nics on my windows pc. One is directly connected to the
mirrored port, and the other one
is connected to another switch on LAN backbone.
Both nics are in the same IP subnet range. I need this because monitored
port is also monitored by draytek app on the same pc and this app
requires this.
I can monitor the port without problem using ntopng.

My question is that I cannot connect the ntopng web server through
another pc on LAN, because of nic IP issue.
On the monitoring pc, web server is accesible. I have to assign
webserver to the other nic in ntopng, i guess.

Another question, i didnt do enabling Promiscuous Mode on pc nic that
monitors mirrored port.
Is it necessary to do this?

Best Regards,
Ali
_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop
Re: ntopng installation [ In reply to ]
Hi Ali
thanks for contacting us.

The web interface should bind to 0.0.0.0 so you should be able to reach the GUI from all interfaces. Can you check with “netstat” from cmd.exe if this is the case? I believe that on the NIC you’re sending traffic to, you do not need to set an IP address.

Promiscuous is necessary as ntopng needs to capture packets not directed to the MAC address of the monitoring NIC

Regards Luca


> On 3 Jan 2018, at 09:08, Ali Kanarya <akanarya@yahoo.com> wrote:
>
> First of all I would like to thanks about the great software.
>
> Nowadays I am giving a try to ntopng to monitor our internet usage.
> I am monitoring Draytek 2860 mirrored port.
> I have 2 nics on my windows pc. One is directly connected to the mirrored port, and the other one
> is connected to another switch on LAN backbone.
> Both nics are in the same IP subnet range. I need this because monitored port is also monitored by draytek app on the same pc and this app requires this.
> I can monitor the port without problem using ntopng.
>
> My question is that I cannot connect the ntopng web server through another pc on LAN, because of nic IP issue.
> On the monitoring pc, web server is accesible. I have to assign webserver to the other nic in ntopng, i guess.
>
> Another question, i didnt do enabling Promiscuous Mode on pc nic that monitors mirrored port.
> Is it necessary to do this?
>
> Best Regards,
> Ali
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop

_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop
Re: ntopng installation [ In reply to ]
Hi Ali
thanks for contacting us.

The web interface should bind to 0.0.0.0 so you should be able to reach the GUI from all interfaces. Can you check with “netstat” from cmd.exe if this is the case? I believe that on the NIC you’re sending traffic to, you do not need to set an IP address.

Promiscuous is necessary as ntopng needs to capture packets not directed to the MAC address of the monitoring NIC

Regards Luca


> On 3 Jan 2018, at 09:08, Ali Kanarya <akanarya@yahoo.com> wrote:
>
> First of all I would like to thanks about the great software.
>
> Nowadays I am giving a try to ntopng to monitor our internet usage.
> I am monitoring Draytek 2860 mirrored port.
> I have 2 nics on my windows pc. One is directly connected to the mirrored port, and the other one
> is connected to another switch on LAN backbone.
> Both nics are in the same IP subnet range. I need this because monitored port is also monitored by draytek app on the same pc and this app requires this.
> I can monitor the port without problem using ntopng.
>
> My question is that I cannot connect the ntopng web server through another pc on LAN, because of nic IP issue.
> On the monitoring pc, web server is accesible. I have to assign webserver to the other nic in ntopng, i guess.
>
> Another question, i didnt do enabling Promiscuous Mode on pc nic that monitors mirrored port.
> Is it necessary to do this?
>
> Best Regards,
> Ali
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop

_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop
Re: ntopng installation [ In reply to ]
Hi Luca,

Thanks for your reply.
I will check the netstat.
For now, I handled the problem by redirecting port 3000 from one nic to other one in windows.

monitoring interface is directly connected to the draytek mirror port.
i understand from your explanation that monitoring interface wont be in the game of standard network traffic, if it is promiscuous, right?
i am also using wireshark, prtg and draytek smart monitor on this interface.
do you think that making promiscuous can unstable these apps?
I am asking this because I have no experince on promiscuous mode, sorry.

Best Regards,
Ali

--------------------------------------------
On Wed, 1/3/18, Luca Deri <deri@ntop.org> wrote:

Subject: Re: [Ntop] ntopng installation
To: ntop@unipi.it
Cc: ntop@listgateway.unipi.it
Date: Wednesday, January 3, 2018, 11:46 PM

Hi Ali
thanks for
contacting us.

The web
interface should bind to 0.0.0.0 so you should be able to
reach the GUI from all interfaces. Can you check with
“netstat” from cmd.exe if this is the case? I believe
that on the NIC you’re sending traffic to, you do not need
to set an IP address.

Promiscuous is necessary as ntopng needs to
capture packets not directed to the MAC address of the
monitoring NIC

Regards
Luca


>
On 3 Jan 2018, at 09:08, Ali Kanarya <akanarya@yahoo.com>
wrote:
>
> First of
all I would like to thanks about the great software.
>
> Nowadays I am giving
a try to ntopng to monitor our internet usage.
> I am monitoring Draytek 2860 mirrored
port.
> I have 2 nics on my windows pc.
One is directly connected to the mirrored port, and the
other one
> is connected to another
switch on LAN backbone.
> Both nics are
in the same IP subnet range. I need this because monitored
port is also monitored by draytek app on the same pc and
this app requires this.
> I can monitor
the port without problem using ntopng.
>

> My question is that I cannot connect
the ntopng web server through another pc on LAN, because of
nic IP issue.
> On the monitoring pc, web
server is accesible. I have to assign webserver to the other
nic in ntopng, i guess.
>
> Another question, i didnt do enabling
Promiscuous Mode on pc nic that monitors mirrored port.
> Is it necessary to do this?
>
> Best Regards,
> Ali
>
_______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop

_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop
_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop
Re: ntopng installation [ In reply to ]
Hi Luca,

Thanks for your reply.
I will check the netstat.
For now, I handled the problem by redirecting port 3000 from one nic to other one in windows.

monitoring interface is directly connected to the draytek mirror port.
i understand from your explanation that monitoring interface wont be in the game of standard network traffic, if it is promiscuous, right?
i am also using wireshark, prtg and draytek smart monitor on this interface.
do you think that making promiscuous can unstable these apps?
I am asking this because I have no experince on promiscuous mode, sorry.

Best Regards,
Ali

--------------------------------------------
On Wed, 1/3/18, Luca Deri <deri@ntop.org> wrote:

Subject: Re: [Ntop] ntopng installation
To: ntop@unipi.it
Cc: ntop@listgateway.unipi.it
Date: Wednesday, January 3, 2018, 11:46 PM

Hi Ali
thanks for
contacting us.

The web
interface should bind to 0.0.0.0 so you should be able to
reach the GUI from all interfaces. Can you check with
“netstat” from cmd.exe if this is the case? I believe
that on the NIC you’re sending traffic to, you do not need
to set an IP address.

Promiscuous is necessary as ntopng needs to
capture packets not directed to the MAC address of the
monitoring NIC

Regards
Luca


>
On 3 Jan 2018, at 09:08, Ali Kanarya <akanarya@yahoo.com>
wrote:
>
> First of
all I would like to thanks about the great software.
>
> Nowadays I am giving
a try to ntopng to monitor our internet usage.
> I am monitoring Draytek 2860 mirrored
port.
> I have 2 nics on my windows pc.
One is directly connected to the mirrored port, and the
other one
> is connected to another
switch on LAN backbone.
> Both nics are
in the same IP subnet range. I need this because monitored
port is also monitored by draytek app on the same pc and
this app requires this.
> I can monitor
the port without problem using ntopng.
>

> My question is that I cannot connect
the ntopng web server through another pc on LAN, because of
nic IP issue.
> On the monitoring pc, web
server is accesible. I have to assign webserver to the other
nic in ntopng, i guess.
>
> Another question, i didnt do enabling
Promiscuous Mode on pc nic that monitors mirrored port.
> Is it necessary to do this?
>
> Best Regards,
> Ali
>
_______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop

_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop
_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop
Re: ntopng installation [ In reply to ]
Dear Ali,

Putting the interface in promiscuous mode means that the interface will pass all the L2 frames to the host -- by default, interfaces immediately check MAC addresses and discard packets that are not destined to them.
This causes the IP stack of the host to see all the traffic. Apart from the extra CPU cycles required to process all the packets, this is typically safe and doesn't prevent the interface from being used for standard communications over the network.


Simone



> On 3 Jan 2018, at 22:06, Ali Kanarya <akanarya@yahoo.com> wrote:
>
> Hi Luca,
>
> Thanks for your reply.
> I will check the netstat.
> For now, I handled the problem by redirecting port 3000 from one nic to other one in windows.
>
> monitoring interface is directly connected to the draytek mirror port.
> i understand from your explanation that monitoring interface wont be in the game of standard network traffic, if it is promiscuous, right?
> i am also using wireshark, prtg and draytek smart monitor on this interface.
> do you think that making promiscuous can unstable these apps?
> I am asking this because I have no experince on promiscuous mode, sorry.
>
> Best Regards,
> Ali
>
> --------------------------------------------
> On Wed, 1/3/18, Luca Deri <deri@ntop.org> wrote:
>
> Subject: Re: [Ntop] ntopng installation
> To: ntop@unipi.it
> Cc: ntop@listgateway.unipi.it
> Date: Wednesday, January 3, 2018, 11:46 PM
>
> Hi Ali
> thanks for
> contacting us.
>
> The web
> interface should bind to 0.0.0.0 so you should be able to
> reach the GUI from all interfaces. Can you check with
> “netstat” from cmd.exe if this is the case? I believe
> that on the NIC you’re sending traffic to, you do not need
> to set an IP address.
>
> Promiscuous is necessary as ntopng needs to
> capture packets not directed to the MAC address of the
> monitoring NIC
>
> Regards
> Luca
>
>
>>
> On 3 Jan 2018, at 09:08, Ali Kanarya <akanarya@yahoo.com>
> wrote:
>>
>> First of
> all I would like to thanks about the great software.
>>
>> Nowadays I am giving
> a try to ntopng to monitor our internet usage.
>> I am monitoring Draytek 2860 mirrored
> port.
>> I have 2 nics on my windows pc.
> One is directly connected to the mirrored port, and the
> other one
>> is connected to another
> switch on LAN backbone.
>> Both nics are
> in the same IP subnet range. I need this because monitored
> port is also monitored by draytek app on the same pc and
> this app requires this.
>> I can monitor
> the port without problem using ntopng.
>>
>
>> My question is that I cannot connect
> the ntopng web server through another pc on LAN, because of
> nic IP issue.
>> On the monitoring pc, web
> server is accesible. I have to assign webserver to the other
> nic in ntopng, i guess.
>>
>> Another question, i didnt do enabling
> Promiscuous Mode on pc nic that monitors mirrored port.
>> Is it necessary to do this?
>>
>> Best Regards,
>> Ali
>>
> _______________________________________________
>> Ntop mailing list
>> Ntop@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop
>
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop

_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop
Re: ntopng installation [ In reply to ]
Dear Ali,

Putting the interface in promiscuous mode means that the interface will pass all the L2 frames to the host -- by default, interfaces immediately check MAC addresses and discard packets that are not destined to them.
This causes the IP stack of the host to see all the traffic. Apart from the extra CPU cycles required to process all the packets, this is typically safe and doesn't prevent the interface from being used for standard communications over the network.


Simone



> On 3 Jan 2018, at 22:06, Ali Kanarya <akanarya@yahoo.com> wrote:
>
> Hi Luca,
>
> Thanks for your reply.
> I will check the netstat.
> For now, I handled the problem by redirecting port 3000 from one nic to other one in windows.
>
> monitoring interface is directly connected to the draytek mirror port.
> i understand from your explanation that monitoring interface wont be in the game of standard network traffic, if it is promiscuous, right?
> i am also using wireshark, prtg and draytek smart monitor on this interface.
> do you think that making promiscuous can unstable these apps?
> I am asking this because I have no experince on promiscuous mode, sorry.
>
> Best Regards,
> Ali
>
> --------------------------------------------
> On Wed, 1/3/18, Luca Deri <deri@ntop.org> wrote:
>
> Subject: Re: [Ntop] ntopng installation
> To: ntop@unipi.it
> Cc: ntop@listgateway.unipi.it
> Date: Wednesday, January 3, 2018, 11:46 PM
>
> Hi Ali
> thanks for
> contacting us.
>
> The web
> interface should bind to 0.0.0.0 so you should be able to
> reach the GUI from all interfaces. Can you check with
> “netstat” from cmd.exe if this is the case? I believe
> that on the NIC you’re sending traffic to, you do not need
> to set an IP address.
>
> Promiscuous is necessary as ntopng needs to
> capture packets not directed to the MAC address of the
> monitoring NIC
>
> Regards
> Luca
>
>
>>
> On 3 Jan 2018, at 09:08, Ali Kanarya <akanarya@yahoo.com>
> wrote:
>>
>> First of
> all I would like to thanks about the great software.
>>
>> Nowadays I am giving
> a try to ntopng to monitor our internet usage.
>> I am monitoring Draytek 2860 mirrored
> port.
>> I have 2 nics on my windows pc.
> One is directly connected to the mirrored port, and the
> other one
>> is connected to another
> switch on LAN backbone.
>> Both nics are
> in the same IP subnet range. I need this because monitored
> port is also monitored by draytek app on the same pc and
> this app requires this.
>> I can monitor
> the port without problem using ntopng.
>>
>
>> My question is that I cannot connect
> the ntopng web server through another pc on LAN, because of
> nic IP issue.
>> On the monitoring pc, web
> server is accesible. I have to assign webserver to the other
> nic in ntopng, i guess.
>>
>> Another question, i didnt do enabling
> Promiscuous Mode on pc nic that monitors mirrored port.
>> Is it necessary to do this?
>>
>> Best Regards,
>> Ali
>>
> _______________________________________________
>> Ntop mailing list
>> Ntop@listgateway.unipi.it
>> http://listgateway.unipi.it/mailman/listinfo/ntop
>
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop

_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop