nProbe
nProbe copied to clipboard
nProbe not exporting all flows and IEs to ntopng
nProbe only exports a subset of flows and without all IEs to ntopng. Example:
./nprobe -i ../nDPI/tests/pcap/tls_certificate_too_long.pcap --zmq tcp://127.0.0.1:1234 -T "@NTOPNG@ %TLS_CIPHER %TLS_VERSION %SRC_TO_DST_MAX_THROUGHPUT %JA3C_HASH %JA3S_HASH" --zmq-format j --json-labels
This causes only two flows to be collected and without all IEs such as the JA3 hashes


If I add export to text files, then much more flows arrive and they contain all the IEs
./nprobe -i ../nDPI/tests/pcap/tls_certificate_too_long.pcap --zmq tcp://127.0.0.1:1234 -T "@NTOPNG@ %TLS_CIPHER %TLS_VERSION %SRC_TO_DST_MAX_THROUGHPUT %JA3C_HASH %JA3S_HASH" --zmq-format j --json-labels -D t -P /tmp/

