Some more details...
# tcpdump port 2055
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes
10:05:50.824802 IP 192.168.13.254.18656 > Netflow.2055: UDP, length 1460
10:05:50.963017 IP 192.168.13.254.18656 > Netflow.2055: UDP, length 1408
10:05:51.426415 IP 192.168.13.254.18656 > Netflow.2055: UDP, length 1440
10:05:51.716595 IP 192.168.13.254.18656 > Netflow.2055: UDP, length 1472
10:05:51.800322 IP 192.168.13.254.18656 > Netflow.2055: UDP, length 1424
10:05:52.186109 IP 192.168.13.254.18656 > Netflow.2055: UDP, length 1424
# tcpdump port 2057
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes
10:06:08.466601 IP 192.168.0.1.19156 > Netflow.2057: UDP, length 1440
10:06:09.177377 IP 192.168.0.1.19156 > Netflow.2057: UDP, length 1400
10:06:09.749476 IP 192.168.0.1.19156 > Netflow.2057: UDP, length 1396
10:06:12.030970 IP 192.168.0.1.19156 > Netflow.2057: UDP, length 1400
10:06:14.848377 IP 192.168.0.1.19156 > Netflow.2057: UDP, length 1468
10:06:16.072222 IP 192.168.0.1.19156 > Netflow.2057: UDP, length 1420
10:06:18.071092 IP 192.168.0.1.19156 > Netflow.2057: UDP, length 1456
10:06:19.440800 IP 192.168.0.1.19156 > Netflow.2057: UDP, length 1472
here's the 2 nprobes listening...
root 6965 6798 0 09:38 pts/2 00:00:00 nprobe --zmq
tcp://*:5557 -i none -n none --collector-port 2057
root 6994 6798 0 10:04 pts/2 00:00:00 nprobe --zmq
tcp://*:5555 -i none -n none --collector-port 2055
tcp://*:5557 shows flows in ntoppng, tcp://*:5555 says "No Results Found"
ufw status = disabled.
Completely baffled to why some collectors show flows, and others show
"No results found".
Starting nprobe in verbose mode shows nothing unusual... ntopng says "No
Results Found"
# nprobe --verbose 2 --zmq tcp://*:5555 -i none -n none --collector-port
2055
21/Dec/2015 10:02:05 [nprobe.c:3130] Valid nProbe license found
21/Dec/2015 10:02:05 [nprobe.c:4488] WARNING: The output interfaceId is
set to 0: did you forget to use -Q perhaps ?
21/Dec/2015 10:02:05 [nprobe.c:4491] WARNING: The input interfaceId is
set to 0: did you forget to use -u perhaps ?
21/Dec/2015 10:02:05 [nprobe.c:4552] Welcome to nProbe v.7.2.151204
($Revision: 4471 $) for x86_64-unknown-linux-gnu with native PF_RING
acceleration
21/Dec/2015 10:02:05 [nprobe.c:4562] Running on Ubuntu 14.04.2 LTS
21/Dec/2015 10:02:05 [nprobe.c:4573] [LICENSE] nProbe SystemId:
4A831FDA09B1B8A9
21/Dec/2015 10:02:05 [nprobe.c:4584] [LICENSE] nProbe License: xxxx
21/Dec/2015 10:02:05 [nprobe.c:4587] [LICENSE] nProbe Edition: Standard
[without PF_RING Acceleration]
21/Dec/2015 10:02:05 [nprobe.c:4614] [LICENSE] Maintenance is available
until Sat Dec 10 10:48:50 2016 [355 days left]
21/Dec/2015 10:02:05 [nprobe.c:4620] Tracing enabled
21/Dec/2015 10:02:05 [plugin.c:248] 0 plugin(s) loaded [0 delete][0 packet].
21/Dec/2015 10:02:05 [nprobe.c:6526] Welcome to nprobe v.7.2.151204 for
x86_64-unknown-linux-gnu
21/Dec/2015 10:02:05 [nprobe.c:5752] Compiling flow templates...
21/Dec/2015 10:02:05 [plugin.c:1000] 0 plugin(s) enabled
21/Dec/2015 10:02:05 [nprobe.c:6203] Non IPv4/v6 traffic is discarded
according to the template
21/Dec/2015 10:02:05 [util.c:287] GeoIP: loaded AS config file
/usr/share/ntopng/httpdocs/geoip/GeoIPASNum.dat
21/Dec/2015 10:02:05 [util.c:296] GeoIP: loaded AS IPv6 config file
/usr/share/ntopng/httpdocs/geoip/GeoIPASNumv6.dat
21/Dec/2015 10:02:05 [nprobe.c:5121] Using packet capture length 128
21/Dec/2015 10:02:05 [nprobe.c:6698] IPv6 traffic will NOT be
exported/accounted by this probe
21/Dec/2015 10:02:05 [nprobe.c:6699] due to configuration options (e.g.
use NetFlow v9)
21/Dec/2015 10:02:05 [nprobe.c:6702] The flows hash has 131072 buckets
21/Dec/2015 10:02:05 [nprobe.c:6704] Flows older than 120 seconds will
be exported
21/Dec/2015 10:02:05 [nprobe.c:6707] Flows inactive for at least 30
seconds will be exported
21/Dec/2015 10:02:05 [nprobe.c:6710] Expired flows will not be queued
for more than 30 seconds
21/Dec/2015 10:02:05 [nprobe.c:6717] Exported flows with engineType 0
and engineId 173
21/Dec/2015 10:02:05 [nprobe.c:6739] TCP TOS will be ignored and set to 0.
21/Dec/2015 10:02:05 [nprobe.c:6757] After 1 flow packets are sent,
we'll delay at least 1 ms
21/Dec/2015 10:02:05 [nprobe.c:6777] Flows will be emitted in NetFlow 5
format
21/Dec/2015 10:02:05 [nprobe.c:6807] Flow input interface index is set to 0
21/Dec/2015 10:02:05 [nprobe.c:6813] Flow output interface index is set to 0
21/Dec/2015 10:02:05 [nprobe.c:6827] Not capturing packet from interface
(collector mode)
21/Dec/2015 10:02:05 [util.c:3840] Succesfully created ZMQ endpoint
tcp://*:5555
21/Dec/2015 10:02:05 [collect.c:86] Created UDP sockets
21/Dec/2015 10:02:05 [collect.c:90] Created a SCTP socket (22)
21/Dec/2015 10:02:05 [collect.c:145] Flow collector listening on port
2055 (IPv4/v6)
21/Dec/2015 10:02:05 [nprobe.c:6947] Starting 1 packet fetch thread(s)
21/Dec/2015 10:02:05 [engine.c:3210] Starting bucket dequeue thread
21/Dec/2015 10:02:05 [nprobe.c:7035] nProbe started successfully
Regards,
Warren
_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
