Good morning Luca - I have not configured -m, you are correct. I assume you mean on the device running nProbe?
> 1. ntopng keeps in memory hosts as long as they are active What period of time is considered 'active'? This pertains to not just local but remote as well? > 2. idle local hosts are then purged from memory and put on redis for some > time. This allows them to be restored if they make traffic again within 1h or > so No (interesting) devices are local to the device running nProbe. There are other servers on its subnet but I would not expect any traffic from them except broadcasts. The same for the system running ntopng. > This said what do you need exactly: ability to keep in memory all local hosts > only, right? The hosts I am interested in seeing data about will not be local to nProbe or ntopng systems. All the devices of interest are in our WAN. I need to be able to answer the questions: When did (nProbe) last see traffic from system X? How much traffic has system X sent/received in the last Y period? > Local hosts are now persistent (unless configured differently). This means > that is host a.b.c.d is idle and is purged from memory, its state is saved in > redis and thus as soon as a.b.c.d starts making traffic again, it is restored > from the cache with all previous counters (in the original ntop all counters > start from zero again). Obviously you can restore an host at any time, simply > searching it on the search box. I will configure ntopng to view all 10.x.x.x addresses as local and see if that produces the results I am interested in. Even though they are not truly local, that won't matter. Notice: This e-mail message and its attachments are the property of The Wendy's Company or one of its subsidiaries and may contain confidential or legally privileged information intended solely for the use of the addressee(s). If you are not an intended recipient, then any use, copying or distribution of this message or its attachments is strictly prohibited. If you received this message in error, please notify the sender and delete this message entirely from your system. _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
