@antony@logicmonitor:

Hi all,

Is it possible to add the OUTPUT_SNMP field to PFSense netflow data output? If so, how?

Without this field, various monitoring systems discard netflow data (although it is not a mandatory field by the netflow spec).

Many thanks in advance.

The other topic in which you posted actually has the solution - if you can get it to work please let us know :)

https://forum.pfsense.org/index.php?topic=102831.0

Someone should probably move this to the packages->traffic monitoring area…

To try and answer your question, I have more questions:

Which version of pfsense and which version of the ntopng package?  What options do you have selected on the ntopng settings page in regards to local networks?  How many interfaces do you have defined in pfSense?  Are they using virtual IP's?

If you run the following command at a shell prompt, what is the output?

ps auxwwwww | grep ntopng

(In particular, are the IP addresses you listed in your log errors also shown in the displayed command line after a "--local-networks" parameter?)

If that change worked I'd commit it so it would be included in future updates, so that wouldn't be a concern. But either way, I'm glad that seems to have fixed it up for you.

+= pull request:  https://github.com/pfsense/pfsense-packages/pull/1262

(I really hope I didn't miss some guideline documentation on submitting pulls before doing that…)

OK then I will not stress too much with this.

I took a good note of creating a FW rule in the future should I reinstall everything from scratch….

Thanks a lot!

hello guys nice im install ntop in pfsense 2.3.2 and work fantastic but i only need show a historical data can make this ???
any have a tutorial for make this ???

Thanx very much

@morreale:

Is there a simple way to disregard or filter out certain IPs or protocols?  I am looking to remove the traffic from my security camera.  The protocol is RTSP and the cameras are all on a security VLAN that is not monitored but they talk to a monitoring station that is on a monitored interface.  They are always considered the top talkers.

Thanks

anyone?

That did the trick. Thanks.

Thanks NogBadTheBad!

I added it to this thread, and will take a look soon.

https://forum.pfsense.org/index.php?topic=114753.0

See this feed: https://forum.pfsense.org/index.php?topic=110026.0

Darkstat can show all of the individual hostnames/IP addresses that a LAN device connects to. There's no mechanism for "apps" or "categories" that I'm aware of, only a list of every host/IP address on the internet that has accessed.

I don't remember enough about ntop to accurately say anything further about its capabilities. It's a good bit more robust than Darkstat, IIRC… so I wouldn't be surprised if there was some way to group hostnames into apps or categories... but I just don't know. Maybe someone can chime in with some info about ntop, now that 2.3.2 is released and ntop is now available to everyone.

You'll need to packet capture on WAN and see what that traffic is. Squid is a good guess where you're running it, but it could be any number of things, including traffic you're not soliciting (like a DoS of some sort).

Nice, thank you!