On 16 May 2017 at 19:29, Emanuele Faranda faranda-at-ntop.org |ntop-flugle| <[email protected]> wrote:
> Hi Peter and Andrew, > > Please see below. > >> On 05/16/2017 01:33 PM, Peter Shute wrote: >> I'm also interested in this. I can get from my ISP daily totals for our >> internet usage. I would like ntopng to be able to replicate those daily >> totals (to give confidence our data is correct), and then analyse the >> totals to see which devices contributed. Eg. If we have an above average >> daily total, I want to know why. >> >> > > Ntopng can actually produce a traffic report where it shows the top > local/remote talkers for a specified time frame (e.g. a day), but this is a > pro only feature. > I don't object to paying for the license, but this still doesn't get me what I want, I think. I want to look back over a historical graph (or jump to a time and day, if I believe there was a problem at that time) and drill down to see the protocols invloved, and the hosts. Top 10 talkers may not include the information I want. > On 16 May 2017, at 4:01 am, Andrew Hilborne > <[email protected]<mailto:[email protected]> > <[email protected]>> wrote: > > > On 15 May 2017 at 17:10, Emanuele Faranda > faranda-at-ntop.org<http://faranda-at-ntop.org> <http://faranda-at-ntop.org> > |ntop-flugle| <[email protected]<mailto:[email protected]> > <[email protected]>> wrote: > > You are right, network stats are calculated every minute, whereas interface > stats are updated each second. > > Please note that these stats are dumped to RRD files, not to the MySQL > database. > > Would it be possible t change this? Is the issue storage space in the MySQL > database? This is what I want to know (initially): > > No, this is something different. MySQL database exports *flows* as data, > whereas RRD is *timeseries* database, so they play different roles. > I do understand the difference between flows and and the RDD timeseries. However, typical 5-minute RDD data is useless for investigating traffic peaks; I think you may know this, because n2disk can now detect 'micro-bursts'. I don't suggest that storing sufficient information to provide a near real-time breakdown of traffic is easy, but it would be interesting. If I am reduced to going back to using RDDtool type data, there are better tools than ntopng for that purpose. Maybe I'm not using ntopng properly? Andrew
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
