ntopng has a fixed number of max flows that could be active at the same time and this parameter can be tuned with startup options. In any case the flow expiration happens after a few seconds (by default 60 for local network) of flow inactivity, hence it might happen that when you try to access a flow it is already expired. About 2), based on the network traffic ntopng cannot understand who is the user connected to traffic produced because ntopng knows the “ip”. For the problem you have probably this might help you. http://www.ntop.org/nprobe/combining-system-and-network-visibility-using-nprobe-and-sysdig/ <http://www.ntop.org/nprobe/combining-system-and-network-visibility-using-nprobe-and-sysdig/> Regards, Yuri ############################################### Yuri Francalacci - [email protected] - http://www.ntop.org "Simplicity is the ultimate sophistication" - Leonardo da Vinci ###############################################
> On 11 Aug 2015, at 17:34, alek markus <[email protected]> wrote: > > Hello , > > 1.why sometimes iv'e got message like this when im trying to see more > details about Flow > > > This flow cannot be found (expired ?) > > > 2. is it possible to see which user is using the Protocols / Http info and > not only the name of the Workstation ? Because i have 4 terminals and each > terminal has 20 users > > > > > Best Regards, > Alek > _______________________________________________ > Ntop-misc mailing list > [email protected] <mailto:[email protected]> > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > <http://listgateway.unipi.it/mailman/listinfo/ntop-misc>
_______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
