Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SRC port and DST port number are switched sometimes in ntopng #8899

Open
ioesoft opened this issue Jan 7, 2025 · 3 comments
Open

SRC port and DST port number are switched sometimes in ntopng #8899

ioesoft opened this issue Jan 7, 2025 · 3 comments
Assignees

Comments

@ioesoft
Copy link

ioesoft commented Jan 7, 2025

Environment:

  • OS name: Ubuntu
  • OS version: 20.04.2 LTS
  • Architecture: x86_64
  • ntopng version/revision: 6.2.250103

What happened:
In ntopng, when checking the flow, there are occasional cases where the source port and target port are swapped. For example, in the case of port 443, which should typically be considered the target port, there are flows that are sometimes displayed as the source port. I previously reported this bug, and Matteo mentioned that it was fixed in version 6.0, but the issue still persists in the latest version.
Regarding the issue mentioned above,
1) Could it be a problem with nprobe, or is it a problem with ntopng?

How did you reproduce it?
FYI, here is my configuration of ntop products:
nProbe(export over ZMQ) --> ntopng(export over Syslog) --> Elastic Search

In my environment, nprobe sends flows data to ntopng via ZMQ. The data volume is very high, and due to limited bandwidth between nprobe and ntopng, a large number of ZMQ drops are occurring.
2) Could these ZMQ drops be the cause of the issue mentioned above?

Debug Information:

Normal vs Abnormal behavior

@lucaderi
Copy link
Member

lucaderi commented Jan 7, 2025

Can you please show the TCP flags per direction (cli->srv and src->cli) of the abnormal flows. Please also report the nprobe configuration for -T

@lucaderi lucaderi self-assigned this Jan 7, 2025
@ioesoft
Copy link
Author

ioesoft commented Jan 7, 2025

Here is the configuraion for -T:
-T="@NTOPNG@ %JA3C_HASH %JA3S_HASH %SRC_AS %DST_AS %SRC_AS_MAP %DST_AS_MAP %MAX_IP_PKT_LEN %ICMP_TYPE %FLOW_END_REASON %APPL_LATENCY_MS %L7_PROTO_RISK %L7_PROTO_RISK_NAME %L7_RISK_SCORE %FLOW_VERDICT %L7_RISK_INFO %SMTP_MAIL_FROM %SMTP_RCPT_TO %HTTP_X_FORWARDED_FOR %CLIENT_TCP_FLAGS %SERVER_TCP_FLAGS"

And, I will also show the TCP flags per direction once I get it from my client.

@lucaderi
Copy link
Member

lucaderi commented Jan 8, 2025

Can you please show the TCP flags per direction (cli->srv and src->cli) of the abnormal flows. Please also report the nprobe configuration for -T

Please show the TCP flags per direction (cli->srv and src->cli) of the abnormal flows. Paste a picture showing one of those flows with wrong direction, to understand the problem.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants