search

ntop / nProbe

Open source components and extensions for nProbe
http://ntop.org
GNU General Public License v2.0
1.65k stars 44 forks source link

nProbe and netflow-lite missing packets #335

Open ervingayle opened 5 years ago

ervingayle commented 5 years ago

We are currently evaluating nProbe + Netflow-Lite along Scrutinizer for their UI and reporting capabilities. Our environment is currently combination of Cisco 4948E-S switches that support only netflow-lite which is our reason for needing to build a solution based on nProbe.

On a 4948E, we have the necessary configuration and on the nProbe server, we can see all of the samples being exported and reaching the server using tcpdump and looking at udp traffic. Over 1000 samples for 10-15 seconds. However, this data does not equate to a 1:1 map between nProbe and Scrutinizer and it doesn't appear that nProbe is forwarding the sampled packets appropriately as for every 1000 that we see leaving the switch, maybe 10 samples are being exported.

Here is the command that we are running: nprobe –nflite 2055 -i eth0 -n scrutinizersvrip:2056 -V 9 -t 60 -d 15

simonemainardi commented 5 years ago

can you provide a capture of the nflite on port 2055 so we can try and reproduce it in our lab?

apezio commented 3 months ago

I'm having this same issue. Here is a tcpdump of the 4948e flows and templates.

nflite.pcap.gz