ntopng - traffic graph & stats only update once per minute, and on nprobe exit. about ntopng

[apezio]

I have tried --zmq-disable-buffering. I synced the clocks on the cisco 4948e-f and the server.

I've been attempting to use the instructions from:

https://www.ntop.org/nprobe/say-hello-to-netflow-lite-nflite/
and
https://www.ntop.org/guides/ntopng/using_with_other_tools/nprobe.html
and
https://www.ntop.org/NetFlowLite/netflow-lite_webinar-cisco.pdf

A lot of conflicting information to be sure, but i tried just about every combo of options I could possibly imagine might have some effect.

[apezio]

FYI it works as expected when using a local nework interface (i.e. nprobe -i eth0).

[lucaderi]

nflite is a clone of sFlow and it sends traffic as soon as the switch decides it's time to export. CAn you please check with wireshark how often nfLite exports you packet dumps?

[apezio]

Templates are exported every 60 seconds and flows are 1000 packets per second.

[apezio]

Here are some tcpdumps of the nflite UDP packets coming from the cisco 4948e.

nflite.pcap.gz
972nflite-pkts.pcap.gz