Exported Sflow packets from network device using nprobe not vissible in ntopng

Open
#526 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
25/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale

Research direction

Start with the nprobe service configuration and the logged collector endpoint on port 6343, then trace the ZMQ endpoint at tcp://127.0.0.1:5556 into ntopng's --interface setting. Check whether the collected sFlow is handed off successfully and identify why it is not visible in the ntopng web interface. Done means the exported flows appear in ntopng.

Written by the indexing model from the issue text.

Description

Hello Team,

I have configured nprobe to collect exported sflow as below.
--zmq="tcp://127.0.0.1:5556"
#--collector-port=2055
--collector-port=6343
-n=none
-i=none

I have Configured ntopng to read the flow and visualize in ntopng web interface.
--interface="tcp://127.0.0.1:5556"

I am sending sflow from one of the network device on port 6343 of nprobe listner ip address.But not seeing any flow in ntopng.
when i check status of nprobe it says running and collecting sflow from sflow exporter ip address.However it does not show in ntopng.

nprobe.service - nprobe extensible NetFlow v5/v9/IPFIX probe/collector for IPv4/v6
Loaded: loaded (/etc/systemd/system/nprobe.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2022-03-10 12:59:49 UTC; 18min ago
Process: 375107 ExecStartPre=/bin/sh -c /bin/echo "$(/bin/date) nprobe StartPre" >> /var/log/ntop-systemd.log (code=exited, status=0/SUCCESS)
Process: 375110 ExecStartPre=/bin/sh -c /bin/sed "/^-g.$|^-G.|^--daemon-mode.|^--pid-file./s/^/#/" /etc/nprobe/nprobe.conf > /run/nprobe.conf (code=exited, >
Process: 375113 ExecStartPost=/bin/sh -c /bin/echo "$(/bin/date) nprobe StartPost" >> /var/log/ntop-systemd.log (code=exited, status=0/SUCCESS)
Main PID: 375112 (nprobe)
Tasks: 7 (limit: 1082)
Memory: 17.9M
CGroup: /system.slice/nprobe.service
└─375112 /usr/bin/nprobe /run/nprobe.conf

Mar 10 12:59:49 ET-INT-TSTVM5 nprobe[375112]: 10/Mar/2022 12:59:49 [nprobe.c:10429] Learning the public IP address.. Disable it with --disable-startup-checks
Mar 10 12:59:49 ET-INT-TSTVM5 nprobe[375112]: 10/Mar/2022 12:59:49 [nprobe.c:10477] Not capturing packet from interface (collector mode)
Mar 10 12:59:49 ET-INT-TSTVM5 nprobe[375112]: 10/Mar/2022 12:59:49 [util.c:5480] Initializing ZMQ as server
Mar 10 12:59:49 ET-INT-TSTVM5 nprobe[375112]: 10/Mar/2022 12:59:49 [util.c:5559] Succesfully created ZMQ endpoint tcp://127.0.0.1:5556
Mar 10 12:59:49 ET-INT-TSTVM5 nprobe[375112]: 10/Mar/2022 12:59:49 [util.c:4337] Enlarged socket buffer [echo 8388608 > /proc/sys/net/core/rmem_max]
Mar 10 12:59:49 ET-INT-TSTVM5 nprobe[375112]: 10/Mar/2022 12:59:49 [util.c:4386] nProbe changed user to 'nprobe'
Mar 10 12:59:49 ET-INT-TSTVM5 nprobe[375112]: 10/Mar/2022 12:59:49 [collect.c:214] Flow collector listening on port 6343 (IPv4/v6)
Mar 10 12:59:49 ET-INT-TSTVM5 nprobe[375112]: 10/Mar/2022 12:59:49 [export.c:548] Using TLV as serialization format
Mar 10 12:59:49 ET-INT-TSTVM5 nprobe[375112]: 10/Mar/2022 12:59:49 [nprobe.c:10849] nProbe started successfully
Mar 10 13:00:01 ET-INT-TSTVM5 nprobe[375112]: 10/Mar/2022 13:00:01 [collect.c:3109] Collecting flows from 20.124.228.69 [total: 1/4]

What is the issue? can u help please to resolve this issue.

Dominant language
Lua
Stars
1.8k
Forks
51
PR merge metrics
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from ntop/nProbe

All issues in ntop/nProbe

Similar issues

More Lua issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.