sending netflow packets with our own DPI information as Application Id and name, and this is not presented in the ntop pages about nprobe

[lucaderi]

I have looked at your pcap and you are receiving NBAR application ID (no nDPI), so you need to export this info using this information element
95] %APPLICATION_ID %application_id Collected Application Id (Cisco or IXIA)

and not with L7_PROTO

[anartahamim]

Hi Luca,

1.   I am the one creating the netflow data, so I can create whatever fields I need. Just tell me what to add.
   

2.   What do you mean export  this information? I run the nprobe with the field APPLICATION_ID in the Template and I see the data as NBAR field in the ntop interface, but I wish to see this as Application. How can I do this?
   

   Thanks,
   Anat

From: Luca Deri [mailto:[email protected]]
Sent: Sunday, November 15, 2015 9:34 PM
To: ntop/nProbe
Cc: Anaty Rahamim Bar Kat
Subject: Re: [nProbe] sending netflow packets with our own DPI information as Application Id and name, and this is not presented in the ntop pages (#6)

I have looked at your pcap and you are receiving NBAR application ID (no nDPI), so you need to export this info using this information element
95] %APPLICATION_ID %application_id Collected Application Id (Cisco or IXIA)

and not with L7_PROTO

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/6#issuecomment-156845715.

[anartahamim]

I Luca,

1.   I am the one creating the netflow data, so I can create whatever fields I need. Just tell me what to add.
   

2.   What do you mean export  this information? I run the nprobe with the field APPLICATION_ID in the Template and I see the data as NBAR field in the ntop interface, but I wish to see this as Application. How can I do this?
   

   Thanks,
   Anat