[Ntop] Adding interfaces to already running instance of ntopng

[Martin Drašar]

Hi,

I apologize in advance, if this has been discussed somewhere, but I was
unable to find it.

Anyway, I want to ask if it is possible to add interfaces to running
ntopng instance. I have a system, where short-lived virtual interfaces
appear and I would like ntopng to monitor them.

I know that I can restart the ntopng service, but then all the
statistics (like the protocol distribution, host stats, etc.) disappear,
which sadly wipes out the information I would like to keep for the
already unused interfaces.

Any idea?

Thank you.
Martin

[Martin Drašar]

Martin this is possible with the current engine but it is implemented
only for virtual interfaces. Can you please explain the use case?
Example add a USB ethernet interface to a running system?
Thanks Luca

Hi Luca,

thank you for the quick response.

There is a proprietary system running on top of DPDK that I want to
connect to ntop. Because of DPDK, system interfaces are not visible to
ntop, but I could manage an addition to the system that would write
selected data to a dummy interface for ntop processing. Problem is that
the data selection criteria change in time and for each such selection I
would like to have a separate dummy interfaces to keep statistics
separate for each selected data.

So, would it be possible to have let's say one dummy interface that will
be registered with ntop from the beginning and have the DPDK system
create virtual interfaces and write to them and then have separate
statistics for each virtual interface?

Cheers,
Martin

[Martin Drašar]

Post by Martin Drašar
Martin
some more questions (in addition to the question why you use DPDK). What
is a dummy interface? What is the encapsulation of this interface? How
do you inject packet into the interface?
Luca

Hi Luca,

DPDK is a historical decision, I can't really rewrite the project from
scratch.

Dummy interface
(https://elixir.bootlin.com/linux/latest/source/drivers/net/dummy.c) is
an interface type in kernel that can be set up without being connected
to an actual link. I may however need to extend it or go with another
interface type. I am still surveying landscape before commiting to
writing an actual code.

As for injecting packets - so far I was thinking about using libpcap, as
there is an expected cap of 4 Gbps, which could/should be sufficient.

Martin

[Martin Drašar]

Hi,

moving on with my scenario, I have decided to just prepare a bunch of
network interfaces before starting ntop and do not use virtual
interfaces at all.

This worked well, but after some time I hit this error:

Too many interfaces (54): discarded XXXXXX
Hint: reset redis (redis-cli flushall) and then start ntopng again

I know that there is a preset limit in the source for 48 interfaces and
I could change it, but the thing is, I am not using that many
interfaces. I just tested some name changes and ntop seems to be keeping
the links between old names and ids and any new interface I add, its id
gets incremented. Even though I flushed the redis database and even
deleted the contents of /var/tmp/ntopng.

How should I convince ntop to start with clean slate?

Thanks,
Martin