{"action":"closed","issue":{"url":"https://api.github.com/repos/ntop/ntopng/issues/1729","repository_url":"https://api.github.com/repos/ntop/ntopng","labels_url":"https://api.github.com/repos/ntop/ntopng/issues/1729/labels{/name}","comments_url":"https://api.github.com/repos/ntop/ntopng/issues/1729/comments","events_url":"https://api.github.com/repos/ntop/ntopng/issues/1729/events","html_url":"https://github.com/ntop/ntopng/issues/1729","id":310587773,"number":1729,"title":"Problem with Cisco ASA and nTopNG","user":{"login":"cepsum","id":22373826,"avatar_url":"https://avatars3.githubusercontent.com/u/22373826?v=4","gravatar_id":"","url":"https://api.github.com/users/cepsum","html_url":"https://github.com/cepsum","followers_url":"https://api.github.com/users/cepsum/followers","following_url":"https://api.github.com/users/cepsum/following{/other_user}","gists_url":"https://api.github.com/users/cepsum/gists{/gist_id}","starred_url":"https://api.github.com/users/cepsum/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cepsum/subscriptions","organizations_url":"https://api.github.com/users/cepsum/orgs","repos_url":"https://api.github.com/users/cepsum/repos","events_url":"https://api.github.com/users/cepsum/events{/privacy}","received_events_url":"https://api.github.com/users/cepsum/received_events","type":"User","site_admin":false},"labels":[{"id":206040829,"url":"https://api.github.com/repos/ntop/ntopng/labels/question","name":"question","color":"cc317c","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-04-02T19:46:20Z","updated_at":"2018-04-20T10:14:44Z","closed_at":"2018-04-20T10:14:44Z","author_association":"NONE","body":"Hello,\r\n\r\nI try to configure my Cisco router with nProbe/nTopNG.\r\n\r\nMy configuration is the following:\r\nCisco router --> nProbe (linux) --> nTopNG (Linux)\r\n\r\nCisco conf:\r\nflow-export destination inside 192.168.111.30 2055 <-- this the nProbe's IP address with the port\r\nflow-export template timeout-rate 1\r\nflow-export delay flow-create 15\r\n\r\nFlow export v9 is enabled for main cache\r\n  Export source and destination details : \r\n  VRF ID : Default\r\n    Source(1)       192.168.111.1 (Vlan1)\r\n    Source(2)       192.168.111.1 (Vlan1)\r\n    Destination(1)  192.168.111.30 (2055) \r\n  Version 9 flow records\r\n  33319 flows exported in 1295 udp datagrams\r\n  0 flows failed due to lack of export packet\r\n  0 export packets were sent up to process level\r\n  0 export packets were dropped due to no fib\r\n  0 export packets were dropped due to adjacency issues\r\n  0 export packets were dropped due to fragmentation failures\r\n  0 export packets were dropped due to encapsulation fixup failures\r\n\r\nnProbe status:\r\n\r\n                      nprobe.service - nprobe extensible NetFlow v5/v9/IPFIX probe/collector for IPv4/v6\r\n   Loaded: loaded (/etc/systemd/system/nprobe.service; enabled; vendor preset: disabled)\r\n   Active: active (running) since Mon 2018-04-02 13:58:18 EDT; 1h 15min ago\r\n  Process: 1247 ExecStopPost=/bin/rm -rf /run/nprobe.conf (code=exited, status=0/SUCCESS)\r\n  Process: 1250 ExecStartPre=/bin/sh -c /bin/sed \"/-g.*$\\|-G.*\\|--daemon-mode.*\\|--pid-file.*/s/^/#/\" /etc/nprobe/nprobe.conf > /run/nprobe.conf (code=exited, status=0/SUCCESS)\r\n Main PID: 1253 (nprobe)\r\n   CGroup: /system.slice/nprobe.service\r\n           ‚îî‚îÄ1253 /usr/local/bin/nprobe /run/nprobe.conf\r\n\r\nApr 02 13:58:18 nTop-Probe nprobe[1253]: 02/Apr/2018 13:58:18 [util.c:451] GeoIP: loaded AS IPv6 config file /usr/share/ntopng/httpdocs/geoip/GeoIPASNumv6.dat\r\nApr 02 13:58:18 nTop-Probe nprobe[1253]: 02/Apr/2018 13:58:18 [nprobe.c:8622] IPv6 traffic will NOT be exported/accounted by this probe\r\nApr 02 13:58:18 nTop-Probe nprobe[1253]: 02/Apr/2018 13:58:18 [nprobe.c:8623] due to configuration options (e.g. use NetFlow v9)\r\nApr 02 13:58:18 nTop-Probe nprobe[1253]: 02/Apr/2018 13:58:18 [nprobe.c:8624] Please use -V to set the version to other than NetFlow V5\r\nApr 02 13:58:18 nTop-Probe nprobe[1253]: 02/Apr/2018 13:58:18 [nprobe.c:8775] Not capturing packet from interface (collector mode)\r\nApr 02 13:58:18 nTop-Probe nprobe[1253]: 02/Apr/2018 13:58:18 [util.c:4511] Initializing ZMQ as server\r\nApr 02 13:58:18 nTop-Probe nprobe[1253]: 02/Apr/2018 13:58:18 [util.c:4554] Succesfully created ZMQ endpoint tcp://*:5556\r\nApr 02 13:58:18 nTop-Probe nprobe[1253]: 02/Apr/2018 13:58:18 [util.c:3589] nProbe changed user to 'nobody'\r\nApr 02 13:58:18 nTop-Probe nprobe[1253]: 02/Apr/2018 13:58:18 [collect.c:144] Flow collector listening on port 2055 (IPv4/v6)\r\nApr 02 13:58:18 nTop-Probe nprobe[1253]: 02/Apr/2018 13:58:18 [nprobe.c:8992] nProbe started successfully\r\n\r\nnProbe conf:\r\n--daemon-mode\r\n-i=none\r\n-n=none\r\n--collector-port=2055\r\n--zmq=\"tcp://*:5556\"\r\n-V 9\r\n\r\n[xxxx@nTop-Probe ~]# netstat -tulpn\r\nActive Internet connections (only servers)\r\nProto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    \r\ntcp        0      0 0.0.0.0:5556            0.0.0.0:*               LISTEN      1253/nprobe               \r\nudp        0      0 0.0.0.0:2055            0.0.0.0:*                           1253/nprobe                \r\nudp6       0      0 :::2055                 :::*                                1253/nprobe         \r\n\r\nnTopNG status:\r\nntopng.service - ntopng high-speed web-based traffic monitoring and analysis tool\r\n   Loaded: loaded (/etc/systemd/system/ntopng.service; enabled; vendor preset: disabled)\r\n   Active: active (running) since Mon 2018-04-02 14:13:52 EDT; 1h 3min ago\r\n  Process: 19944 ExecStopPost=/bin/rm -rf /run/ntopng.conf (code=exited, status=0/SUCCESS)\r\n  Process: 19946 ExecStartPre=/bin/sh -c /bin/sed \"/-e.*$\\|-G.*\\|--daemon.*\\|--pid.*/s/^/#/\" /etc/ntopng/ntopng.conf > /run/ntopng.conf (code=exited, status=0/SUCCESS)\r\n Main PID: 19948 (ntopng)\r\n   CGroup: /system.slice/ntopng.service\r\n           ‚îî‚îÄ19948 /usr/local/bin/ntopng /run/ntopng.conf\r\n\r\nApr 02 14:45:00 ntopng ntopng[19948]: 02/Apr/2018 14:45:00 [Lua.cpp:6559] [Discover] Started periodic discovery on interface ens192\r\nApr 02 14:45:11 ntopng ntopng[19948]: 02/Apr/2018 14:45:11 [Lua.cpp:6559] [Discover] Completed periodic discovery on interface ens192\r\nApr 02 15:00:01 ntopng ntopng[19948]: 02/Apr/2018 15:00:01 [Lua.cpp:6559] [Discover] Started periodic discovery on interface lo\r\nApr 02 15:00:01 ntopng ntopng[19948]: 02/Apr/2018 15:00:01 [Lua.cpp:6559] [Discover] Completed periodic discovery on interface lo\r\nApr 02 15:00:01 ntopng ntopng[19948]: 02/Apr/2018 15:00:01 [Lua.cpp:6559] [Discover] Started periodic discovery on interface ens192\r\nApr 02 15:00:12 ntopng ntopng[19948]: 02/Apr/2018 15:00:12 [Lua.cpp:6559] [Discover] Completed periodic discovery on interface ens192\r\nApr 02 15:15:03 ntopng ntopng[19948]: 02/Apr/2018 15:15:03 [Lua.cpp:6559] [Discover] Started periodic discovery on interface lo\r\nApr 02 15:15:03 ntopng ntopng[19948]: 02/Apr/2018 15:15:03 [Lua.cpp:6559] [Discover] Completed periodic discovery on interface lo\r\nApr 02 15:15:03 ntopng ntopng[19948]: 02/Apr/2018 15:15:03 [Lua.cpp:6559] [Discover] Started periodic discovery on interface ens192\r\nApr 02 15:15:14 ntopng ntopng[19948]: 02/Apr/2018 15:15:14 [Lua.cpp:6559] [Discover] Completed periodic discovery on interface ens192\r\n\r\nnProbe conf:\r\n--daemon\r\n-interface=\"tcp://192.168.100.91:5556\"\r\n-w=4000\r\n--dns-mode=1\r\n--sticky-hosts=local\r\n--local-networks=\"192.168.0.0/16,10.0.0.0/8,172.16.0.0/12\"\r\n\r\n[xxxx@ntopng ~]# netstat -tulpn\r\nActive Internet connections (only servers)\r\nProto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    \r\ntcp        0      0 127.0.0.1:6379          0.0.0.0:*               LISTEN      12730/redis-server            \r\ntcp        0      0 0.0.0.0:4000            0.0.0.0:*               LISTEN      19948/ntopng                   \r\nudp        0      0 192.168.100.91:59376    0.0.0.0:*                           19948/ntopng        \r\nudp        0      0 0.0.0.0:42139           0.0.0.0:*                           19948/ntopng        \r\nudp        0      0 0.0.0.0:36007           0.0.0.0:*                           19948/ntopng        \r\n\r\nFor my part, everything seems correct, but I do not receive any trace of traffic coming from the Internet (cisco router). Top Remote Destinations is empty except \"broadcast\" entry sometimes. I see the subnet traffic only where nTopNG and nProbe are located and because I activated a Network Discovery (I suppose).\r\n\r\ntcpdump -i ens224 -n udp port 2055\r\ntcpdump: verbose output suppressed, use -v or -vv for full protocol decode\r\nlistening on ens224, link-type EN10MB (Ethernet), capture size 262144 bytes\r\n11:31:01.028468 IP 192.168.111.1.62235 > 192.168.111.30.iop: UDP, length 194\r\n11:31:02.072731 IP 192.168.111.1.54884 > 192.168.111.30.iop: UDP, length 1428\r\n11:31:03.028550 IP 192.168.111.1.62235 > 192.168.111.30.iop: UDP, length 228\r\n11:31:05.028571 IP 192.168.111.1.62235 > 192.168.111.30.iop: UDP, length 262\r\n^C\r\n4 packets captured\r\n4 packets received by filter\r\n0 packets dropped by kernel\r\n\r\nSomebody might tell me what's wrong with what I did.\r\n\r\nThanks for your help"}}
{"actor":{"display_login":"emanuele-f"}}