search

mbolli / nfsen-ng

Responsive NetFlow visualizer built on top of nfdump tools.
Apache License 2.0
231 stars 43 forks source link

Selecting a single 5-minute bucket - 503 error #53

Closed candlerb closed 3 years ago

candlerb commented 4 years ago

(Expansion of issue mentioned in #31)

One of the things I do most often in nfsen is to move the marker to a single 5-minute bucket. For example, see the peak at 20:55 (UTC) here:

image

It's very easy then to run queries on this bucket in the bottom half.

Using nfsen-ng, the same peak exists (note: this time it's showing local time, BST, so it's at 21:55)

image

So I then drag the start and end boundaries as close as I can around the peak:

image

and switch to "Statistics" - but unfortunately I get a 503 error when running the query.

image

It does work if I select a larger time range, say 15 minutes, but that dilutes the query somewhat.

So I see two issues here:

candlerb commented 3 years ago

I'm not sure if this bug is related to the change, but I just tried this. Click to zoom is accepted, but when I go to Statistics and try to show top bytes for "Any IP Address", I get:

General error:
Notice: Undefined index: ipv6 in /var/www/html/nfsen-ng/backend/api/api.php on line 183
["\/usr\/local\/bin\/nfdump -M '\/var\/nfsen\/profiles-data\/live\/gw1:gw2' -R '2020\/09\/11\/nfcapd.202009111800:2020\/09\/11\/nfcapd.202009111800' -n '10' -o 'csv' -s 'ip\/bytes' 2>&1
<\/b>",["ts","te","td","pr","val","fl","flP","pkt","pktP","byt","bytP","pps","bps","bpp"],["2020-09-11 17:59:02","2020-09-11 18:04:31","328.670","any","XXXX::45","199","19.1","6691","54.1","542335","23.7","20","13200","81"],... snip rest of flow records...]
mbolli commented 3 years ago

not related, but fixed!

candlerb commented 3 years ago

Great, thank you!

FYI: the "Full IPv6 address" button does add or remove the -6 option to nfdump, but AFAICS, it makes no difference to the output. I see the full IPv6 address both times.

nfsen-ng sets -o csv, and testing shows that nfdump gives the full IPv6 address always with -o csv. (I am using nfdump version 1.6.20). The -6 flag does affect the output when no -o is provided, or -o line.

mbolli commented 3 years ago

Thanks for the investigation -- on my testing setup I have no ipv6 at all, so I assumed some people still might use it. The output field selectors like line is processed/filtered by nfsen-ng itself, as csv output is always full. I'll probably drop the ipv6 flag entirely then.