Mailing List Archive

Network Load graphs
Hello,

I'm running ntop3.2 compiled from code on an FC6 box.

I have several ntop processes running one one box and listening for flows on separate ports. This is to provide separate information for "subnets" under our larger Class B network range. For example, we are interested in seeing stats specific to the network for our Veterinary School as compared to the stats for our Education school...each of which resides on separate address spaces in our Class B network but "reside" off the same physical router.

These processes have their "local-subnets" defined as the network range corresponding to the various colleges. I also have a process which defines a local-subnet as our entire Class B as I'm curious to get a picture of all traffic going in/out of the router.

The odd thing is that the network load graph (Summary -> Network Load) for the entire ClassB is *less* than that for each of the colleges. This doesn't make sense to me. You'd think that the various subnets under our Class B would add up to the total for the Class B!? So, for example, our Veterinary School's network load graph shows an average of 16.2 Mbits, but the total for our entire Class B off that same router shows 16.0Mbits.

Given these are different processes, each analyzing flow data from the same router, they should be seeing the same thing, yet they are coming up with conflicting reports.


I'm not sure why this is, and was wondering if anyone had any ideas or has seen similar results?

Thank you --Greg Redder

===============================================================================
Greg Redder Academic Computing & Networking Services
Colorado State University, ACNS Phone:(970)491-7222 FAX: (970)491-1958
601 S. Howes, Room 625 E-mail: redder@yuma.colostate.edu
Fort Collins, CO 80523 PGP Fprint:CD62EAE6227D96FC7C232B16DFE3B5D9B2F64352
===============================================================================
_______________________________________________
Ntop mailing list
Ntop@unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop
Re: Network Load graphs [ In reply to ]
Hey Greg - same issue again huh? The graphs can definitely be
frustrating - they seem to have various and sometime numerous issues.

Just for kicks, how about wiping the data files/directories and
restarting? Maybe something is corrupted? If you want the existing data
you can always rename it instead of wiping it.

If I remember you have quite a complex config. Are you certain netflow
is configured correctly everywhere - capturing the right traffic in the
directions you want on the interfaces you want?

Have you tried "Host Clusters"? Might give you some of what you want -
generic "network wide" type stats - convenient for grouping and stuff.

G


-----Original Message-----
From: ntop-bounces@unipi.it [mailto:ntop-bounces@unipi.it] On Behalf Of
Redder,Greg
Sent: Tuesday, May 06, 2008 8:51 AM
To: ntop@listgateway.unipi.it
Subject: [Ntop] Network Load graphs


Hello,

I'm running ntop3.2 compiled from code on an FC6 box.

I have several ntop processes running one one box and listening for
flows on separate ports. This is to provide separate information for
"subnets" under our larger Class B network range. For example, we are
interested in seeing stats specific to the network for our Veterinary
School as compared to the stats for our Education school...each of which
resides on separate address spaces in our Class B network but "reside"
off the same physical router.

These processes have their "local-subnets" defined as the network range
corresponding to the various colleges. I also have a process which
defines a local-subnet as our entire Class B as I'm curious to get a
picture of all traffic going in/out of the router.

The odd thing is that the network load graph (Summary -> Network Load)
for the entire ClassB is *less* than that for each of the colleges.
This doesn't make sense to me. You'd think that the various subnets
under our Class B would add up to the total for the Class B!? So, for
example, our Veterinary School's network load graph shows an average of
16.2 Mbits, but the total for our entire Class B off that same router
shows 16.0Mbits.

Given these are different processes, each analyzing flow data from the
same router, they should be seeing the same thing, yet they are coming
up with conflicting reports.


I'm not sure why this is, and was wondering if anyone had any ideas or
has seen similar results?

Thank you --Greg Redder

========================================================================
=======
Greg Redder Academic Computing & Networking
Services
Colorado State University, ACNS Phone:(970)491-7222 FAX:
(970)491-1958
601 S. Howes, Room 625 E-mail: redder@yuma.colostate.edu
Fort Collins, CO 80523 PGP
Fprint:CD62EAE6227D96FC7C232B16DFE3B5D9B2F64352
========================================================================
=======
_______________________________________________
Ntop mailing list
Ntop@unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop





<font size="1">
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'>
</div>
"This email is intended to be reviewed by only the intended recipient
and may contain information that is privileged and/or confidential.
If you are not the intended recipient, you are hereby notified that
any review, use, dissemination, disclosure or copying of this email
and its attachments, if any, is strictly prohibited. If you have
received this email in error, please immediately notify the sender by
return email and delete this email from your system."
</font>

_______________________________________________
Ntop mailing list
Ntop@unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop
Re: Network Load graphs [ In reply to ]
Hi Gary, et al,

Based on my past experiences, I was a little afraid/embarrassed to even post again ;-) However, this was different. I have two identical processes running - receiving identical streams of flows from the router and one just looks at 129.82.236.0/22 and one looks at all of 129.82.0.0/16. The one for the /22 has more traffic than the one for the /16 when you look at the network load graphs!

It is possible that the data files are corrupt - I can try clearing things out and checking again, but I've actually duplicated this problem on several different ntop boxes and different source routers(I have one for each of our 5 core routers) and I see the same results.

I'm pretty sure, with your previous help, I have the routers configured properly as I analyzed one of the network's traffic to ensure the proper throughput. It seems to be right each time....it's just that this problem really made me start to question it again.

I'll have to look at host clusters too - haven't done that yet ;-)


Thanks again and as always!! --Greg

-----Original Message-----
From: ntop-bounces@unipi.it [mailto:ntop-bounces@unipi.it] On Behalf Of Gary Gatten
Sent: Tuesday, May 06, 2008 9:54 AM
To: ntop@unipi.it
Subject: Re: [Ntop] Network Load graphs

Hey Greg - same issue again huh? The graphs can definitely be frustrating - they seem to have various and sometime numerous issues.

Just for kicks, how about wiping the data files/directories and restarting? Maybe something is corrupted? If you want the existing data you can always rename it instead of wiping it.

If I remember you have quite a complex config. Are you certain netflow is configured correctly everywhere - capturing the right traffic in the directions you want on the interfaces you want?

Have you tried "Host Clusters"? Might give you some of what you want - generic "network wide" type stats - convenient for grouping and stuff.

G


-----Original Message-----
From: ntop-bounces@unipi.it [mailto:ntop-bounces@unipi.it] On Behalf Of Redder,Greg
Sent: Tuesday, May 06, 2008 8:51 AM
To: ntop@listgateway.unipi.it
Subject: [Ntop] Network Load graphs


Hello,

I'm running ntop3.2 compiled from code on an FC6 box.

I have several ntop processes running one one box and listening for
flows on separate ports. This is to provide separate information for
"subnets" under our larger Class B network range. For example, we are interested in seeing stats specific to the network for our Veterinary School as compared to the stats for our Education school...each of which resides on separate address spaces in our Class B network but "reside"
off the same physical router.

These processes have their "local-subnets" defined as the network range corresponding to the various colleges. I also have a process which defines a local-subnet as our entire Class B as I'm curious to get a picture of all traffic going in/out of the router.

The odd thing is that the network load graph (Summary -> Network Load) for the entire ClassB is *less* than that for each of the colleges.
This doesn't make sense to me. You'd think that the various subnets under our Class B would add up to the total for the Class B!? So, for example, our Veterinary School's network load graph shows an average of
16.2 Mbits, but the total for our entire Class B off that same router shows 16.0Mbits.

Given these are different processes, each analyzing flow data from the same router, they should be seeing the same thing, yet they are coming up with conflicting reports.


I'm not sure why this is, and was wondering if anyone had any ideas or has seen similar results?

Thank you --Greg Redder

========================================================================
=======
Greg Redder Academic Computing & Networking
Services
Colorado State University, ACNS Phone:(970)491-7222 FAX:
(970)491-1958
601 S. Howes, Room 625 E-mail: redder@yuma.colostate.edu
Fort Collins, CO 80523 PGP
Fprint:CD62EAE6227D96FC7C232B16DFE3B5D9B2F64352
========================================================================
=======
_______________________________________________
Ntop mailing list
Ntop@unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop





<font size="1">
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential.
If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system."
</font>

_______________________________________________
Ntop mailing list
Ntop@unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop
_______________________________________________
Ntop mailing list
Ntop@unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop
Re: Network Load graphs [ In reply to ]
Hmmmm - sounds like you've done the basics and then some. Have you
checked the netflow statistics for each instance to ensure they're both
receiving the same number of flows, etc? Maybe post some of your config
info - I've had typo's before that 5 people missed. After dozens of
hours trying to fix it someone discovers a missing "." or whatever.

-----Original Message-----
From: ntop-bounces@unipi.it [mailto:ntop-bounces@unipi.it] On Behalf Of
Redder,Greg
Sent: Tuesday, May 06, 2008 11:24 AM
To: ntop@unipi.it
Subject: Re: [Ntop] Network Load graphs


Hi Gary, et al,

Based on my past experiences, I was a little afraid/embarrassed to even
post again ;-) However, this was different. I have two identical
processes running - receiving identical streams of flows from the router
and one just looks at 129.82.236.0/22 and one looks at all of
129.82.0.0/16. The one for the /22 has more traffic than the one for
the /16 when you look at the network load graphs!

It is possible that the data files are corrupt - I can try clearing
things out and checking again, but I've actually duplicated this problem
on several different ntop boxes and different source routers(I have one
for each of our 5 core routers) and I see the same results.

I'm pretty sure, with your previous help, I have the routers configured
properly as I analyzed one of the network's traffic to ensure the
proper throughput. It seems to be right each time....it's just that
this problem really made me start to question it again.

I'll have to look at host clusters too - haven't done that yet ;-)


Thanks again and as always!! --Greg

-----Original Message-----
From: ntop-bounces@unipi.it [mailto:ntop-bounces@unipi.it] On Behalf Of
Gary Gatten
Sent: Tuesday, May 06, 2008 9:54 AM
To: ntop@unipi.it
Subject: Re: [Ntop] Network Load graphs

Hey Greg - same issue again huh? The graphs can definitely be
frustrating - they seem to have various and sometime numerous issues.

Just for kicks, how about wiping the data files/directories and
restarting? Maybe something is corrupted? If you want the existing data
you can always rename it instead of wiping it.

If I remember you have quite a complex config. Are you certain netflow
is configured correctly everywhere - capturing the right traffic in the
directions you want on the interfaces you want?

Have you tried "Host Clusters"? Might give you some of what you want -
generic "network wide" type stats - convenient for grouping and stuff.

G


-----Original Message-----
From: ntop-bounces@unipi.it [mailto:ntop-bounces@unipi.it] On Behalf Of
Redder,Greg
Sent: Tuesday, May 06, 2008 8:51 AM
To: ntop@listgateway.unipi.it
Subject: [Ntop] Network Load graphs


Hello,

I'm running ntop3.2 compiled from code on an FC6 box.

I have several ntop processes running one one box and listening for
flows on separate ports. This is to provide separate information for
"subnets" under our larger Class B network range. For example, we are
interested in seeing stats specific to the network for our Veterinary
School as compared to the stats for our Education school...each of which
resides on separate address spaces in our Class B network but "reside"
off the same physical router.

These processes have their "local-subnets" defined as the network range
corresponding to the various colleges. I also have a process which
defines a local-subnet as our entire Class B as I'm curious to get a
picture of all traffic going in/out of the router.

The odd thing is that the network load graph (Summary -> Network Load)
for the entire ClassB is *less* than that for each of the colleges.
This doesn't make sense to me. You'd think that the various subnets
under our Class B would add up to the total for the Class B!? So, for
example, our Veterinary School's network load graph shows an average of
16.2 Mbits, but the total for our entire Class B off that same router
shows 16.0Mbits.

Given these are different processes, each analyzing flow data from the
same router, they should be seeing the same thing, yet they are coming
up with conflicting reports.


I'm not sure why this is, and was wondering if anyone had any ideas or
has seen similar results?

Thank you --Greg Redder

========================================================================
=======
Greg Redder Academic Computing & Networking
Services
Colorado State University, ACNS Phone:(970)491-7222 FAX:
(970)491-1958
601 S. Howes, Room 625 E-mail: redder@yuma.colostate.edu
Fort Collins, CO 80523 PGP
Fprint:CD62EAE6227D96FC7C232B16DFE3B5D9B2F64352
========================================================================
=======
_______________________________________________
Ntop mailing list
Ntop@unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop





<font size="1">
<div style='border:none;border-bottom:double windowtext
2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be
reviewed by only the intended recipient and may contain information
that is privileged and/or confidential.
If you are not the intended recipient, you are hereby notified that
any review, use, dissemination, disclosure or copying of this email and
its attachments, if any, is strictly prohibited. If you have received
this email in error, please immediately notify the sender by return
email and delete this email from your system."
</font>

_______________________________________________
Ntop mailing list
Ntop@unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop
_______________________________________________
Ntop mailing list
Ntop@unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop





<font size="1">
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'>
</div>
"This email is intended to be reviewed by only the intended recipient
and may contain information that is privileged and/or confidential.
If you are not the intended recipient, you are hereby notified that
any review, use, dissemination, disclosure or copying of this email
and its attachments, if any, is strictly prohibited. If you have
received this email in error, please immediately notify the sender by
return email and delete this email from your system."
</font>

_______________________________________________
Ntop mailing list
Ntop@unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop
Re: Network Load Graphs [ In reply to ]
Hi



Its probably a fonts issue. You should be getting some messages from
Cairo/Pango saying that they cannot find any fonts in your ntop logs.



If this is on Linux you need to install some trutype fonts in etc/fonts



KR's



Mark



From: ntop-bounces@listgateway.unipi.it
[mailto:ntop-bounces@listgateway.unipi.it] On Behalf Of Chris Woods
Sent: 15 February 2012 22:33
To: ntop@listgateway.unipi.it
Subject: [Ntop] Network Load Graphs



I have Ntop running and collecting data but my graphs come up and the
x/y-axis labels show as squares no text. I am thinking this is a simple
missing library but can't find which one I have missing. Any help would
be greatly appreciated.



Chris.


--
This message has been scanned for viruses and
dangerous content by MailScanner <http://www.mailscanner.info/> , and is

believed to be clean.
Re: Network Load Graphs [ In reply to ]
Resolved my own problem, didn't have graphviz installed.

Thanks
Chris.

-----Original Message-----
From: ntop-bounces@listgateway.unipi.it [mailto:ntop-bounces@listgateway.unipi.it] On Behalf Of ntop-request@listgateway.unipi.it
Sent: Thursday, February 16, 2012 5:00 AM
To: ntop@listgateway.unipi.it
Subject: Ntop Digest, Vol 93, Issue 8

Send Ntop mailing list submissions to
ntop@listgateway.unipi.it

To subscribe or unsubscribe via the World Wide Web, visit
http://listgateway.unipi.it/mailman/listinfo/ntop
or, via email, send a message with subject or body 'help' to
ntop-request@listgateway.unipi.it

You can reach the person managing the list at
ntop-owner@listgateway.unipi.it

When replying, please edit your Subject line so it is more specific than "Re: Contents of Ntop digest..."


Today's Topics:

1. Network Load Graphs (Chris Woods)


----------------------------------------------------------------------

Message: 1
Date: Wed, 15 Feb 2012 16:32:47 -0600
From: Chris Woods <cwoods@Netstandard.com>
To: "ntop@listgateway.unipi.it" <ntop@listgateway.unipi.it>
Subject: [Ntop] Network Load Graphs
Message-ID:
<A5D5F84A3339D445AC511452EE709DF41AB7C0F213@nsi-exch07.NSI.inc>
Content-Type: text/plain; charset="us-ascii"

I have Ntop running and collecting data but my graphs come up and the x/y-axis labels show as squares no text. I am thinking this is a simple missing library but can't find which one I have missing. Any help would be greatly appreciated.

Chris.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listgateway.unipi.it/pipermail/ntop/attachments/20120215/65e9cb29/attachment-0001.htm>

------------------------------

_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop


End of Ntop Digest, Vol 93, Issue 8
***********************************
_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop
Re: Network Load Graphs [ In reply to ]
Hi

Chris, graphviz is not a dependency so i would suggest that it reset
your fonts. The graphs are produced by rrdtool which has a dependency
chain of:

Pango
Cairo
Pixman
Fontconfig
freetype

I would suggest that graphviz may have updated your fonts and cured the
problem in the process of installation.

Anyway glad your problem is resolved.

KR's

Mark
-----Original Message-----
From: ntop-bounces@listgateway.unipi.it
[mailto:ntop-bounces@listgateway.unipi.it] On Behalf Of Chris Woods
Sent: 16 February 2012 17:21
To: ntop@listgateway.unipi.it
Subject: Re: [Ntop] Network Load Graphs




Resolved my own problem, didn't have graphviz installed.

Thanks
Chris.

-----Original Message-----
From: ntop-bounces@listgateway.unipi.it
[mailto:ntop-bounces@listgateway.unipi.it] On Behalf Of
ntop-request@listgateway.unipi.it
Sent: Thursday, February 16, 2012 5:00 AM
To: ntop@listgateway.unipi.it
Subject: Ntop Digest, Vol 93, Issue 8

Send Ntop mailing list submissions to
ntop@listgateway.unipi.it

To subscribe or unsubscribe via the World Wide Web, visit
http://listgateway.unipi.it/mailman/listinfo/ntop
or, via email, send a message with subject or body 'help' to
ntop-request@listgateway.unipi.it

You can reach the person managing the list at
ntop-owner@listgateway.unipi.it

When replying, please edit your Subject line so it is more specific than
"Re: Contents of Ntop digest..."


Today's Topics:

1. Network Load Graphs (Chris Woods)


----------------------------------------------------------------------

Message: 1
Date: Wed, 15 Feb 2012 16:32:47 -0600
From: Chris Woods <cwoods@Netstandard.com>
To: "ntop@listgateway.unipi.it" <ntop@listgateway.unipi.it>
Subject: [Ntop] Network Load Graphs
Message-ID:
<A5D5F84A3339D445AC511452EE709DF41AB7C0F213@nsi-exch07.NSI.inc>
Content-Type: text/plain; charset="us-ascii"

I have Ntop running and collecting data but my graphs come up and the
x/y-axis labels show as squares no text. I am thinking this is a simple
missing library but can't find which one I have missing. Any help would
be greatly appreciated.

Chris.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://listgateway.unipi.it/pipermail/ntop/attachments/20120215/65e9cb2
9/attachment-0001.htm>

------------------------------

_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop


End of Ntop Digest, Vol 93, Issue 8
***********************************
_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

--
This message has been scanned for viruses and dangerous content by
MailScanner, and is believed to be clean.

_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop
Re: Network Load Graphs [ In reply to ]
Hi Antonio,

have you already checked the log of ntop? Because sometimes you could have
some problems with user permissions, and (you can see this in the log,
something like "Permission denied") data is not saved, consequently you can
not see the rrd graph.

2012/6/21 Antônio Marcos Rodrigues Franco <antoniom@minasligas.com.br>

> ** **
>
> Hello all,
>
> I'm having problems with network load graphs.****
>
> When the rrd graphs are generated by the caption characters are replaced
> by squares.
> I've seen a topic related to this problem (opened by colleague Chris),
> which was installed GraphViz to solve the problem.
> I already have GraphViz installed, and also all dependencies rrdtool
> (cairo, pango, Pixman, fontconfig, freetype), but still the problem
> persists.
> Have checked with ldd is missing some library for ntop and rrdtool
> binaries, but is not.
> I think that is a problem library version.
> You know me say something about it?
>
> Thank you!****
>
> ** **
>
> ** **
>
> Att.*
> ANTÔNIO MARCOS RODRIGUES FRANCO*****
>
> ** **
>
> ** **
>
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop
>
>


--
R.