Hi, Is the clock of the ASA set properly? How often flows are exported? My guess is that timestamps of received flows are not in sync with the ntopng clock and thus hosts are considered idle and not shown in the web UI.
You may also want to increase idle timeouts from the ntopng preferences web page. Regards, Simone On Wed, Mar 1, 2017 at 6:46 PM, Matt Kettler <matt.kett...@fourthdim.com> wrote: > I'm currently testing out a demo copy of nprobe/ntopng, on an Ubuntu LTS > 16.04 to evaluate if it is worth purchasing. > > > > This seems to work partially, I can see flows, protocol breakdowns etc. > However, the population of hosts doesn’t seem to be working so well. > > > > I generally see that there are hosts in the status block in the lower > right, but when I go to "hosts" from the top menu, there are no hosts found. > > > > Flows on the other hand populate correctly, and I can even click on a host > IP in there and get a summary of the host. > > > > I've tried tinkering with various things, like changing the idle timeouts, > and adding local hosts as sticky, but that doesn't seem to help. At one > point I got some local hosts to populate, and they stayed for a while as I > was using sticky locals, but I realized no remotes were ever being added, > so I tried restarting it with sticky-hosts=none, and now nothing is > populated. > > > > I've also tried updating a few times, currently I am running: > > ntopng --version > > v.2.5.170301 [Enterprise/Professional Edition] > > > > and was running: > > v.2.5.170228 [Enterprise/Professional Edition] > > > > and prior to that I was running whatever was current on the apt repo last > friday. > > > > Have I misconfigured something? Failing to understand a limit of the demo > versions? > > > > I'm using this sending netflows from a Cisco ASA to nprobe, which then > zmq's them to ntopng, so these are my conf files: (minor censoring of bits > with xxx's) > > > > nprobe: > > --collector=none > > --interface=none > > --zmq="tcp://*:5556" > > --collector-port=2055 > > --lifetime-timeout=180 > > --idle-timeout=60 > > -g=/var/run/nprobe-none.pid > > --vlanid-as-iface-idx=none > > --as-list=/usr/share/ntopng/httpdocs/geoip/GeoIPASNum.dat > > --daemon-mode > > --dump-stats=/var/log/nprobe/none-0_flows_stats.txt > > --city-list=/usr/share/ntopng/httpdocs/geoip/GeoLiteCity.dat > > -V=5 > > > > ntopng: > > -G=/var/run/ntopng.pid > > --interface="tcp://127.0.0.1:5556" > > --local-networks="192.168.0.0/16,10.0.0.0/8,xx.xx.xx.xx/xx" > > --daemon > > --http-port=3000 > > --sticky-hosts=none > > --dump-hosts=none > > -F "mysql;xxxx;ntopng;flows;xxxxx;xxxxx" > *This e-mail is intended solely for the addressee. Access to this email by > anyone else is unauthorized. If you have received this e-mail in error, > please notify the sender immediately, delete the e-mail from your computer > and do not copy or disclose it to anyone else.* *THE INFORMATION IN THIS > EMAIL AND ANY ATTACHMENTS CONSTITUTE THE PROPRIETARY INFORMATION OF FOURTH > DIMENSION ENGINEERING, LLC.* Any disclosure, copying, distribution or any > action taken or omitted to be taken in reliance on it, is prohibited and > may be unlawful. Fourth Dimension is not responsible for any damages caused > by your unauthorized use of the materials in this e-mail. > > _______________________________________________ > Ntop mailing list > Ntop@listgateway.unipi.it > http://listgateway.unipi.it/mailman/listinfo/ntop >
_______________________________________________ Ntop mailing list Ntop@listgateway.unipi.it http://listgateway.unipi.it/mailman/listinfo/ntop
