Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have set up a netflow server at our data centre, which is connected via VPN to ~40 remote offices using Cisco ASA 5505. The aim is to analyse usage data and find out exactly how the remote connections are being used.

I followed through to set up ntop and to set up the ASAs. I can see from the Plugin > Netflow > Statistics page that netflow packets from my ASAs are being received - the counter is increasing. However, I am not seeing any breakdown on the Global Traffic Statistic page after switching to the Netflow interface. I'm just seeing a pie chart showing 100% traffic for eth0.

The interfaces and documentation are a little hard to follow so I am not sure I have got things configured correctly.

When setting up my NetFlow-device.2 I can specify Virtual NetFlow Interface Network Address - the web UI says

This value is in the form of a network address and mask on the network where the actual NetFlow probe is located.

  • is this a Network address (e.g. or an actual host IP address (
  • If that should be a network address, is this the network in which one of my ASAs is or the network in which my ntop server is?
  • If a host IP address, is this the IP address used by eth0 on my ntop server, the IP address of an ASA, or something else?
  • Do I need a separate virtual interface for each ASA I am collecting netflow data from?

Any guidance would be greatly welcome.

share|improve this question
up vote 0 down vote accepted

I was advised by the ntop community to update to the SVN version of ntop, and this did indeed start populating the graphs without configuring things differently.

However, I have found that after collecting data for a few weeks, I am not seeing useful results. I have read that there are certain limitations with the netflow data from ASAs which may result in this. I think for better analysis I am probably looking at a different collection mechanism for data, and the lack of current and clear documentation for NTOP means I am probably looking elsewhere for collating and interpreting the data too. Back to the drawing board!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.