Implement filtering on view interfaces (i.e. flow deduplication)

ntop / ntopng

Web-based Traffic and Security Network Traffic Monitoring

http://www.ntop.org

GNU General Public License v3.0

6.16k stars 648 forks source link

Implement filtering on view interfaces (i.e. flow deduplication) #4057

Open lucaderi opened 4 years ago

lucaderi commented 4 years ago

When interfaces are merged in a view, sometimes there are cases where traffic is duplicated. This can happen in cases such

ntopng monitors interface eth0 and eth1
a view:all is created
there are flows between hosts on eth0 and eth1

In essence we need to deduplicate traffic in case is between a host on eth0 with the corresponding recipient on eth1 and vice-versa (this as the flow is reported on both interfaces).

Various strategies could be used to implement deduplications. All the implications must be reported on this ticket prior to implement them.

mailinglists35 commented 3 years ago

how do I enable view:all without explicitly adding interface names? basically I want to let it discover interfaces as they come up and down and keep a dynamic updated "view:all"

simonemainardi commented 3 years ago

how do I enable view:all without explicitly adding interface names? basically I want to let it discover interfaces as they come up and down and keep a dynamic updated "view:all"

please explain your use case. What is the type of interfaces that come up and down?

mailinglists35 commented 3 years ago

ethernet, tun and ppp

use case: home gateway with one internet-facing interface (pppoe over ethernet) and multiple openvpn tunnels and ephemeral ethernet over usb devices (plugging in/out ethernet usb dongles)