search

lephisto / pfsense-analytics

Pfsense Analytics w/ Graylog, Elasticsearch, InfluxDB and Grafana fully dockerized for Firewall and DPI..
GNU General Public License v3.0
155 stars 56 forks source link

*Feature Request* Client Specific DPI #47

Closed bigjohns97 closed 3 weeks ago

bigjohns97 commented 3 years ago

Has anyone been able to get the NDPI dashboard to be able to show specific types of traffic per host?

I am a grafana noob and don't have the skills to make this happen but would like to be able to select a specific client ip address and then have the NDPI interface show just the traffic for that client.

lephisto commented 3 years ago

You can easily expand the Dashboard for NDPI. What I provide is not meant to provide the full potential that the Timeseries Export Provides.

Look into the measurement host:ndpi_categories

image

From there you can extract which host has generated which type of traffic easily.

bigjohns97 commented 3 years ago

I am trying to find the host:ndpi_categories (do I need to enable something in ntopng to get this table?), I do have a variable defined that should be able to be implemented into some of the panels where it makes sense.

image

bigjohns97 commented 3 years ago

LOL nevermind I see now, I just need to add the where host = $variable to all of the panels.CLICK

this is awsome!

bigjohns97 commented 3 years ago

Well I spoke too soon, this only works for the top panel, I can't seem to either create another AND on the ones where protocol is the selection, I am going to have to keep working on it for other panels but the top one works very easy with this edit.

image

bigjohns97 commented 3 weeks ago

I finally got this working, thanks to @lephisto for pointing me in the right direction.

I had to enable both categories and protocols on ntopng and then I was able to add a where clause pointing to a host variable to the panels I wanted to be able to filter and enable the all as default and voila!