cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

Welcome to the Cisco Small Business Community

Have a question? Click on a topic board below to get started in the community.

19413
Views
0
Helpful
24
Replies
todd
Beginner

Ntop netflow configuration help

Looking for some direction on getting NTOP to work.  I have the app installed, can access it.  I've configured my 2821 router with Netflow per the example configuration, using the Internet interface as source, and the onplus LAN as destination.  I'm not using the MON port.  My NTOP webpage shows nothing, no packets, summary, etc are all blank.  My router shows no errors when I run "sh ip flow export".  What am I missing???

1 ACCEPTED SOLUTION

Accepted Solutions

That might be it ... you will need to 'active' the NTOP plugin for Netflow. Once it is activated, you will see the 'NetFlow device in the list of devices on the 'Global Taffic Statistics' page. Remember to set the port within the NTOP configuration to 2055 as well.

As for the LAN and MON ports, the LAN port is eth0 and the MON port is eth1. These are only generic passive listening ports and generally, only the 'eth1' port is useful, when connected to a mirror/span port on a switch/router. Neither of these are useful for NetFlow.

Robert

View solution in original post

24 REPLIES 24
jamwyatt
Beginner

Hi Todd,

In the example setup, the NetFlow was configured to send to 192.168.10.15, port 2055. Assuming that you changed out the 192.168.10.15 for the real address of your ON100, the next possible problem is that the default port in the NTOP configuration of a netflow device is '0' and that causes the NTOP NetFlow receiver to be disabled. Did you change the NTOP Netflow configuration to port 2055 when you enabled the NetFlow device?

Robert

Robert,

Yes - I adjusted the example config to reflect my correct IP address.  I am using port 2055.  I made no changes to the NTOP configuration. I did try to change from eth1 (default) to eth0.  But it does not accept that change.  I am not sure which port the LAN vs. MON ports are ( ie. eth0 vs. eth1) can't find any docs on that.  I'll see if there is a port config in NTOP for the UDP port.  Any other suggestions?  Thanks, Todd

That might be it ... you will need to 'active' the NTOP plugin for Netflow. Once it is activated, you will see the 'NetFlow device in the list of devices on the 'Global Taffic Statistics' page. Remember to set the port within the NTOP configuration to 2055 as well.

As for the LAN and MON ports, the LAN port is eth0 and the MON port is eth1. These are only generic passive listening ports and generally, only the 'eth1' port is useful, when connected to a mirror/span port on a switch/router. Neither of these are useful for NetFlow.

Robert

Robert,

Ah....  That was it, I never configured the page under the add-in drop-down.  Working now.  Thanks.

Guys, wanted to revise this thread as I have setup ntop, I see packets arriving and being processed, but do not see any graphs, stats nothing.

Ntop is activated and it is receiving data, but none of the selections show anything?...

What am I missing?

Bob James

Hi Bob,

Can you post some screen shots of what you are looking at? Are you using the default built-in interface or are you using NETFLOW?

Thanks,

Robert

I check the flows and nothing, I check the traffic and nothing, but when I check the stats I see it receiving traffic.

Bob James

Found something else; the Netflow menu in NTop show "Deactive" leading me to think it's activated, but when I go under the Describe menu it says "No" for activate. I click to change it to yes and then redraw the page and it's No again??

Looks like something isn't working as advertised...

Bob James

HI Bob,

Just to clarify, was this ever working or has it never worked for you? If the answer is never, can you send a screen shot of the 'home' screen? The reason is that there is a 'device' selection on the home screen that usually defaults to 'eth1' and you'd have to make sure that you've selected the NetFlow device to see the NetFlow results.

Robert

Hey there,

i have exact this problem.

i see that ntop gets the data from cisco - but don´t display that data.

yes i have already switched the nic on ntop to netflow - can you help me?

Hi Beate,

Do you have the other devices in the network configured to send the Netflow information to the collector? Enabling it on NTOP isn't the only step.

Watch this quick video for steps:

http://www.youtube.com/watch?v=L4RgpPMLkvU&list=PL31DFD175AEFB0FF0&index=11

Thanks,

The OnPlus Team

Hi there,

i have also configured the asa like this:

https://supportforums.cisco.com/docs/DOC-6114

i also see that ntop gets data from the asa, here is the picture.

I'm having the same challenge as Heilingbrunner.  I can see Netflow packets in the NetFlow Statistics screen however my report shows nothing but red X's in the image boxes.

Shawn Eftink CCNA/CCDA Please rate all helpful posts and mark correct answers to assist others searching for solutions in the community.

Here are the stats and log from mine that isn't working.  From what I can see, it should be.

Shawn Eftink CCNA/CCDA Please rate all helpful posts and mark correct answers to assist others searching for solutions in the community.