@Mission-Ghost My understanding is that Traffic Totals uses vnstat for data collection. There are a whole host of options that can be set in the /usr/local/etc/vnstat.conf file. Only 1 or two of them are exposed via the GUI.

@hulleyrob said in Ntopng changing live traffic list from 10 to 20 crashed 6100 Max: Is Ntopng just that dangerous to leave running or is there something else going on? While I do not generally recommend running ntopng on a continuous basis, doing so should not cause pfSense itself to become unresponsive. Although ntopng is a rather large and busy program, it runs in user space rather than kernel space and as such should not be able to crash the kernel. You may have an underlying system problem. If it happens again, my recommendation would be to connect to the console and see what you can discover.

@lohphat Netgate has always announced an end of sale and end of life date, and actually emailed registered purchasers about the 3100 (the "EOL in 5 days" email). However they have also provided pfSense for all models "until they can't anymore" due to insufficient RAM or other incompatibilities. It sounds like it is more of a "best effort" vs "guaranteed to work." Given we all had "5 days" notice I would consider multiple years' time as a bonus. Perhaps what they need to do, if the package list is still dwindling, is to add a note on the 3100's package pages to explain why, if it's not in the release notes. Based on a prior discussion I once had, 3100 support is not mentioned in the current release notes because it is not a new issue/change, and (my interpretation) they assume one has read all previous notes.

@Leon-Straathof @Leon-Straathof said in capybara clicker Limiting ntopng disk usage: @dennypage Hi, do you know if there is a way to purge old data automated? I would want to run this permanent as my system is more then capable to keep up. The only thing that is a problem is running out of diskspace over a long period. I just have the need to view things of the last couple of days i do not care if things have happened weeks ago. If your goal is simply to automatically delete old data every few days to prevent your hard drive from filling up, there are several fairly gentle and sustainable ways to do that depending on the system you are using (pfSense, Linux, Windows, NAS, etc.).

@johnpoz The decoded base 64 isn't something I recognise. It's simply "teamspeak5:" and then a random string of numbers/letters/symbols.

@luckman212 Heck yeah! Thanks for the help!

Just thought I'd share my experience, while not on pfsense, using ntopng Community v.6.7.260105 rev.27191 (FreeBSD 14.0), disabling "Active Network Discovery" was all that was needed for the crashes to stop. Since I disabled this, the service has been up and running nonstop for ~3 days now. Before, it wouldn't last longer than 4-12 hours before crashing/stopping with no logs.

@johnpoz said in Arpwatch not downloading vendor ID's: I noticed this - and looked at all of my other interfaces and they all show age of 0. Doc for the underlying ANDwatch query is here. Age is the number of days since the record was last updated.

@tinfoilmatt that os is new to me.

@kabeda If memory serves, that old version of ntopng did not run as user ntopng, but as user nobody. There are lots of problems in that old version. Anyway, check the ownership and permissions of /var/db/ntopng and make sure it matches the user that ntopng runs as. You may need to set ownership of the entire hierarchy. Example: /usr/sbin/chown -R nobody:nobody /var/db/ntopng However, the better choice would be to upgrade to a more recent version.

@Antibiotic No it’s not possible with NtopNG as it is not a Netflow collector. You need nProbe for that which will “translate” recieved netflows into flows that NtopNG understands and can visualize (with very very little detail might I add as Netflows has no additonal information apart from sender/reciever and volume). The NtopNG package and the product in general is more geared towards visualising and recording traffic details from actual packet captures. This contains MUCH more metadata about the sessions than netflows (DNS names, protocol information and myriads of other things). But pffSense Plus has a builtin Netflow exporter if you have an external netflow collector on hand.

@pulsartiger The database name is vnstat.db and its location is under /var/db/vnstat. With "Backup Files/Dir" we are able to do backup or also with a cron.

@StealthNet said in Outgoing Portscans - ntopng?: Tbh I never thought a default package would do some kind of outbound network discovery based on class C scanning of internet hosts. I don´t think this is ok. I agree. I was rather shocked when I discovered this while diagnosing the same issue with another pfSense user who happens to be a close friend of min. He had also enabled it because ntopng's description made it sound like a good thing. Anyway, I appreciate your, and others, input on this. I believe I will add a set of warning to the next version of the package, to at least have put forth the information/warning. Thank you.