Mailing List Archive

Martin
this is possible with the current engine but it is implemented only for virtual interfaces. Can you please explain the use case? Example add a USB ethernet interface to a running system?

Thanks Luca



> On 20 Mar 2018, at 14:06, Martin Drašar <drasar@ics.muni.cz> wrote:
>
> Hi,
>
> I apologize in advance, if this has been discussed somewhere, but I was
> unable to find it.
>
> Anyway, I want to ask if it is possible to add interfaces to running
> ntopng instance. I have a system, where short-lived virtual interfaces
> appear and I would like ntopng to monitor them.
>
> I know that I can restart the ntopng service, but then all the
> statistics (like the protocol distribution, host stats, etc.) disappear,
> which sadly wipes out the information I would like to keep for the
> already unused interfaces.
>
> Any idea?
>
> Thank you.
> Martin
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop

_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

Martin
this is possible with the current engine but it is implemented only for virtual interfaces. Can you please explain the use case? Example add a USB ethernet interface to a running system?

Thanks Luca



> On 20 Mar 2018, at 14:06, Martin Drašar <drasar@ics.muni.cz> wrote:
>
> Hi,
>
> I apologize in advance, if this has been discussed somewhere, but I was
> unable to find it.
>
> Anyway, I want to ask if it is possible to add interfaces to running
> ntopng instance. I have a system, where short-lived virtual interfaces
> appear and I would like ntopng to monitor them.
>
> I know that I can restart the ntopng service, but then all the
> statistics (like the protocol distribution, host stats, etc.) disappear,
> which sadly wipes out the information I would like to keep for the
> already unused interfaces.
>
> Any idea?
>
> Thank you.
> Martin
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop

_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

Dne 20.3.2018 v 15:45 Luca Deri napsal(a):
> Martin this is possible with the current engine but it is implemented
> only for virtual interfaces. Can you please explain the use case?
> Example add a USB ethernet interface to a running system?
>
> Thanks Luca



Hi Luca,

thank you for the quick response.

There is a proprietary system running on top of DPDK that I want to
connect to ntop. Because of DPDK, system interfaces are not visible to
ntop, but I could manage an addition to the system that would write
selected data to a dummy interface for ntop processing. Problem is that
the data selection criteria change in time and for each such selection I
would like to have a separate dummy interfaces to keep statistics
separate for each selected data.

So, would it be possible to have let's say one dummy interface that will
be registered with ntop from the beginning and have the DPDK system
create virtual interfaces and write to them and then have separate
statistics for each virtual interface?

Cheers,
Martin

Dne 20.3.2018 v 15:45 Luca Deri napsal(a):
> Martin this is possible with the current engine but it is implemented
> only for virtual interfaces. Can you please explain the use case?
> Example add a USB ethernet interface to a running system?
>
> Thanks Luca



Hi Luca,

thank you for the quick response.

There is a proprietary system running on top of DPDK that I want to
connect to ntop. Because of DPDK, system interfaces are not visible to
ntop, but I could manage an addition to the system that would write
selected data to a dummy interface for ntop processing. Problem is that
the data selection criteria change in time and for each such selection I
would like to have a separate dummy interfaces to keep statistics
separate for each selected data.

So, would it be possible to have let's say one dummy interface that will
be registered with ntop from the beginning and have the DPDK system
create virtual interfaces and write to them and then have separate
statistics for each virtual interface?

Cheers,
Martin

Martin
some more questions (in addition to the question why you use DPDK). What
is a dummy interface? What is the encapsulation of this interface? How
do you inject packet into the interface?

Luca

On 03/20/2018 04:05 PM, Martin Drašar wrote:
> Dne 20.3.2018 v 15:45 Luca Deri napsal(a):
>> Martin this is possible with the current engine but it is implemented
>> only for virtual interfaces. Can you please explain the use case?
>> Example add a USB ethernet interface to a running system?
>>
>> Thanks Luca
>
>
> Hi Luca,
>
> thank you for the quick response.
>
> There is a proprietary system running on top of DPDK that I want to
> connect to ntop. Because of DPDK, system interfaces are not visible to
> ntop, but I could manage an addition to the system that would write
> selected data to a dummy interface for ntop processing. Problem is that
> the data selection criteria change in time and for each such selection I
> would like to have a separate dummy interfaces to keep statistics
> separate for each selected data.
>
> So, would it be possible to have let's say one dummy interface that will
> be registered with ntop from the beginning and have the DPDK system
> create virtual interfaces and write to them and then have separate
> statistics for each virtual interface?
>
> Cheers,
> Martin
>
>
>
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop

Dne 21.3.2018 v 10:23 Luca Deri napsal(a):
> Martin
> some more questions (in addition to the question why you use DPDK). What
> is a dummy interface? What is the encapsulation of this interface? How
> do you inject packet into the interface?
>
> Luca

Hi Luca,

DPDK is a historical decision, I can't really rewrite the project from
scratch.

Dummy interface
(https://elixir.bootlin.com/linux/latest/source/drivers/net/dummy.c) is
an interface type in kernel that can be set up without being connected
to an actual link. I may however need to extend it or go with another
interface type. I am still surveying landscape before commiting to
writing an actual code.

As for injecting packets - so far I was thinking about using libpcap, as
there is an expected cap of 4 Gbps, which could/should be sufficient.

Martin

Hi,

moving on with my scenario, I have decided to just prepare a bunch of
network interfaces before starting ntop and do not use virtual
interfaces at all.

This worked well, but after some time I hit this error:

Too many interfaces (54): discarded XXXXXX
Hint: reset redis (redis-cli flushall) and then start ntopng again

I know that there is a preset limit in the source for 48 interfaces and
I could change it, but the thing is, I am not using that many
interfaces. I just tested some name changes and ntop seems to be keeping
the links between old names and ids and any new interface I add, its id
gets incremented. Even though I flushed the redis database and even
deleted the contents of /var/tmp/ntopng.

How should I convince ntop to start with clean slate?

Thanks,
Martin

Hi,

Please open an issue on our github page https://github.com/ntop
describing the issue.

Regards,
Emanuele


On 03/26/2018 05:11 PM, Martin Drašar wrote:
> Hi,
>
> moving on with my scenario, I have decided to just prepare a bunch of
> network interfaces before starting ntop and do not use virtual
> interfaces at all.
>
> This worked well, but after some time I hit this error:
>
> Too many interfaces (54): discarded XXXXXX
> Hint: reset redis (redis-cli flushall) and then start ntopng again
>
> I know that there is a preset limit in the source for 48 interfaces and
> I could change it, but the thing is, I am not using that many
> interfaces. I just tested some name changes and ntop seems to be keeping
> the links between old names and ids and any new interface I add, its id
> gets incremented. Even though I flushed the redis database and even
> deleted the contents of /var/tmp/ntopng.
>
> How should I convince ntop to start with clean slate?
>
> Thanks,
> Martin
>
>
>
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop

Martin,

> On 26 Mar 2018, at 17:11, Martin Drašar <drasar@ics.muni.cz> wrote:
>
> Hi,
>
> moving on with my scenario, I have decided to just prepare a bunch of
> network interfaces before starting ntop and do not use virtual
> interfaces at all.
>
> This worked well, but after some time I hit this error:
>
> Too many interfaces (54): discarded XXXXXX
> Hint: reset redis (redis-cli flushall) and then start ntopng again
>
> I know that there is a preset limit in the source for 48 interfaces and
> I could change it, but the thing is, I am not using that many
> interfaces. I just tested some name changes and ntop seems to be keeping
> the links between old names and ids and any new interface I add, its id
> gets incremented.

Yes, this is normal and is the expected behavior. ntopng must uniquely identify and remember interfaces it has seen, even across restarts. Silently re-using ids would cause data from different interfaces to be mixed unpredictably.

> Even though I flushed the redis database and even
> deleted the contents of /var/tmp/ntopng.
>
> How should I convince ntop to start with clean slate?

to start clean:
- stop ntopng
- redis cli flushall
- rm -rf /var/tmp/ntopng
- start ntopng


Simone

>
> Thanks,
> Martin
>
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop

_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop