search

mbolli / nfsen-ng

Responsive NetFlow visualizer built on top of nfdump tools.
Apache License 2.0
231 stars 43 forks source link

Aggregation in "Statistics" doesn't seem to do anything #56

Closed candlerb closed 3 years ago

candlerb commented 4 years ago

This is with nfsen-ng master (27b7365c) under Ubuntu 18.04.

In the Statistics view, the aggregation buttons don't seem to do anything - they don't change the command sent to nfdump. To reproduce:

The nfdump command it generates is:

 nfdump command: /usr/local/bin/nfdump -M '/var/nfsen/profiles-data/live/gw' -R '2020/06/11/nfcapd.202006110825:2020/06/12/nfcapd.202006120810' -n '10' -o 'csv' -s 'record/flows' 2>&1

Then select "Global Aggregation - Bidirectional", and click "Process data" again, it gives exactly the same command:

nfdump command: /usr/local/bin/nfdump -M '/var/nfsen/profiles-data/live/gw' -R '2020/06/11/nfcapd.202006110825:2020/06/12/nfcapd.202006120810' -n '10' -o 'csv' -s 'record/flows' 2>&1

Unselect Bidirectional, and select IP Aggregation > Source > IP then "Process data". Exactly the same result.

If I enter a filter, like "net 10.0.0.0/8", that is passed to the backend - but the other buttons still don't do anything.

I have checked the traffic with tcpdump. With the "bidirectional" button selected I see

GET /nfsen-ng/api/stats?datestart=1591863845&dateend=1591950365&sources%5B%5D=gw&filter=&top=10&for=record%2Fflows&title=Flow%20Records&aggregate=bidirectional&limit=&output%5Bformat%5D=line&output%5Bcustom%5D= HTTP/1.1

With IP Aggregation > Source > IP selected I see

GET /nfsen-ng/api/stats?datestart=1591863845&dateend=1591950425&sources%5B%5D=gw&filter=&top=10&for=record%2Fflows&title=Flow%20Records&aggregate=srcip&limit=&output%5Bformat%5D=line&output%5Bcustom%5D= HTTP/1.1

Clearly the correct flags are making it into the HTTP request, but for some reason the backend is ignoring them.

Aside: if you select "Statistic for" anything other than "Flow Records", then those buttons are greyed out anyway (and therefore not expected to do anything)

mbolli commented 3 years ago

Hi @candlerb

It looks like nfdump does not support aggregation in statistics mode. A query which combines -s with -a returns Command line switch -s overwrites -a.

So it would be best to hide the fields in the statistics view.