Re: flow monitoring recommendations

[Martin Neitzel <neitzel%hackett.marshlabs.gaertner.de@localhost>]

I wrote:

MN> Then there's another pkg:  ntopng-6.2.
MN>
MN> This is a flow collector and visiualizer (web based) in one, again
MN> by Luca Deri.  I have no experience with that pkg (yet).  [...]
MN> I don't even know if the "community ntopng" provides a "nprobe" tool.
MN> I guess not, [...]

I just gave the "ntopng" pkg a try and it can probe a local interface
on its own.   So you would be good to go with this package and
nothing else on your router.  Well, "nothing else" being a bit of
an understatement because ntopng has a long dependency list.

My quick-and-dirty attempt to get it running involved these steps:
(on a netbsd-10-stable amd64 box):

	# pkgin in ntopng
	# rehash
	# redis-server /usr/pkg/share/examples/redis/redis.conf.example
	# ntopng -i bnx0 -d /tmp/xxx-ntopng

Use -i with your interface(s), of course.  ntopng felt unable to
work with its default data directory /var/lib/ntopng -- even while
it was able to create it.   The default /usr/pkg/share/examples/rc.d/ntopng
doesn't depend on / start redis on its own, so this needed to be
started separately.

Then use a modern browser to visit ntopng's WEB GUI at http://<yourbox>:3000/

You'll be immediately asked to change the default "admin" password to
something else.  A too short? weak? password won't be accepted, alas
without any complaint indicated -- that took me some time to recognize.

Have fun,
						Martin Neitzel