search

zaneclaes / network-traffic-metrics

Monitor network traffic with Prometheus & Grafana
103 stars 21 forks source link

Net 192.168.0.0/24 hardcoded on Grafana Dashboard + other observations #1

Closed rafaelreis-r closed 4 years ago

rafaelreis-r commented 4 years ago

Hey @zaneclaes. Very nifty script! I was looking into something to catch flows from my DD-WRT flashed EA8500 router into TIG stack, and accidentaly came by your work.

DD-WRT has NetFlow v5 and SNMP built in, and there are many commercial / heavywhight solutions for that protocol but very few end into Grafana. Most of them do not work very well, trust me, I've tested most of them.

Since the rooted router supports opkg (package manager), I was easily able to install the dependencies and run your script directly in the router.

Pointed it to vlan1 (which is the internal LAN "switch") and tweaked the tcpdump filter to my network and it started catching flows right away. Command used:

python network-traffic-metrics.py --fqdn --interface vlan1 "src net 192.168.0.0/16 or dst net 192.168.0.0/16"

Checked 192.168.1.1:8000 and it was catching the data correctly. Deployed Prometheus on my Docker Server alongside InfluxDB and Grafana, using your prometheus.yml and it did start caching the flows from the router right away,

That's when I got stumped. Nothing showed up on Grafana, regardless of all my best efforts. Checked promQL queries, checked prometheus built in Graphing with the same queries and the data was there. It turns out the "LocalIPs" filter in the dash hard limits the network to 192.168.0.0/24. Changed the 0 to 1 and the data poped up.

Performance considerations:

The dual core ARMV7l router (32bit) is pretty capable of handling flows for up to 200mbit speeds. CPU usage never reaches over 60%, which is nice.

However after 3 or 4 hours running, I've been getting a python error regarding memory management. The script does not quit, but rather freezes forcing me to kill python and restart it. 

root@RREIS_HOME:~# python --version
Python 3.8.3

root@RREIS_HOME:~# tcpdump --version
tcpdump version 4.9.2
libpcap version 1.7.2

I don't have the memory error output saved right away, but I'll try to replicate it one more time, and add it here.

zaneclaes commented 4 years ago

Nothing showed up on Grafana, regardless of all my best efforts

So, perhaps it's worth making a distinction between "Grafana" and "Prometheus." If the data is in Prometheus, it is in Grafana. Grafana is just a frontend for data stores, like Prometheus.

How are you attempting to find the data? I always recommend that you use the "Explore" tab first to inspect the metrics being reported & gain some familiarity with Grafana.

If you've jumped straight to importing the dashboard, you will need to use the dropdown menus at the top of the screen to change your filters to those appropriate to your network / desires.