ntopng M license supposed to have up to 16 interface (where up to 8 exporter, 256 exported interfaces)

[612wong]

Environment:

• OS name: [e.g. Ubuntu] Centos7
• OS version: [e.g. 18.04] 7.9.2009
• Architecture: [e.g. amd64] x86_64
• ntopng version/revision: [e.g. 5.1.211223] 6.3.240820

What happened:
I encountered the message saying

20/Aug/2024 23:34:32 [ParserInterface.cpp:104] Flow dropped due to limits to the license. Exporters limit: 8 | Exporters Interfaces limit: 256

we have up to 16 interfaces as follows.
1 interface (src: span) with 2 custom traffic disaggregation (3 interfaces in total)
1 interface (src: span)
1 interface (src: sflow from 2 exporters) with 5 custom traffic disaggregation (6 interfaces in total, 64 interfaces each exporter, 128 interfaces in total)
1 interface (src: sflow from 2 exporters) with 1 custom traffic disaggregation (2 interfaces in total, 24 interfaces each exporter, 48 interfaces in total)
4 interface (src: netflow from 1 exporter each, 12 interfaces each, 48 interfaces in total)

In summary, we have 16 interfaces in the traffic dashboard, 8 exporters (224 exported interfaces in total) are sending traffic to to nprobe running on a server.

We didn't exceed the interface limit (16 and 16 in our case), nor flow exporter limit (8 and 8 in our case) nor exporter interface limit (256 but 224 in our case)

How did you reproduce it?
Upgraded from 6.1.x to 6.3.

Debug Information:
Our ntopng config:
-bash-4.2$ cat ntopng.conf | egrep -iv ^#
-G=/var/run/ntopng.pid
-i=et1 # custom trafrfic disaggregation into 3 'interfaces'
-i=et2 # no custom traffic disaggregation
-i=tcp://10.49.100.244:9996 # 2 exporters, up to 48 interfaces in total
-i=tcp://10.49.100.244:9161 # 1 exporter, up to 12 interfaces
-i=tcp://10.49.100.244:9061 # 1 exporter, up to 12 interfaces
-i=tcp://10.49.100.244:9063 # 2 exporters, up to 128 interfaces in total
-i=tcp://10.49.100.244:9165 # 1 exporter, up to 12 interfaces
-i=tcp://10.49.100.244:9065 # 1 exporter, up to 12 interfaces
-W=3001
-m=10.165.0.0/16
-d=/local/ntopng
-p /etc/ntopng/protocols.txt
-F=clickhouse

Our nprobe config:
#1
-i=none
-n=none
-G=/var/run/nprobe-none_1-sflow.pid
--collector-port=6343
--zmq=tcp://*:9996
-T=@NTOPNG@
--tunnel

#2
-i=none
-n=none
-G=/var/run/nprobe-none_2-netflow.pid
--collector-port=65161
--zmq=tcp://*:9161
-T=@NTOPNG@
--tunnel

#3
-i=none
-n=none
-G=/var/run/nprobe-none_3-netflow.pid
--collector-port=65061
--zmq=tcp://*:9061
-T=@NTOPNG@
--tunnel

#4
-i=none
-n=none
-G=/var/run/nprobe-none_4-sflow.pid
--collector-port=65063
--zmq=tcp://*:9063
-T=@NTOPNG@
--tunnel

#5
-i=none
-n=none
-G=/var/run/nprobe-none_5-netflow.pid
--collector-port=65165
--zmq=tcp://*:9165
-T=@NTOPNG@
--tunnel

#6
-i=none
-n=none
-G=/var/run/nprobe-none_6-netflow.pid
--collector-port=65065
--zmq=tcp://*:9065
-T=@NTOPNG@
--tunnel
-L=10.65.0.0/16

[lucaderi]

can you please report what you have (please update first to the latest dev version of ntopng) in here

[612wong]

I have updated the ntopng to 6.3.240827.
Below are the screenshots.
nprobe #1 config

output for interface (via custom traffic disaggregation)

disaggregation filter

nprobe #2 config

nprobe #3 config

nprobe #4 config

disaggregation filter

interfaces via the custom traffic disaggregation got no flows at all but its master one did.

nprobe #5 config

nprobe #6 config

[Fedmahn99]

hi, same issue with same upgrade path (6.1 -> 6.3)

Version: 6.3.240902 [Enterprise/Professional build]
GIT rev: dev:b99e022cfa41f6bdb1975f5c4d46855ffafd53a1:20240902
Pro rev: r6789
Built on: Debian GNU/Linux 11 (bullseye)
Edition: Enterprise L

With the same message in log : "Flow dropped due to limits to the license. Exporters limit: 16 (16 active) | Interfaces limit: 256 (59 active)".

I am using a similar environment : 16 physical devices are exporting flow in sflow format to nprobe, and pass them to one zmq interface for ntop. Then disaggregation with probe IP criteria.

Could the interfaces be counted twice ? (The limit occur at exactly 8 interfaces).

Regards

[lucaderi]

We have enhanced the GUI to report better information. Can you please share the information below? If you want to expedite this, please contact me via email ([email protected]) so we can schedule a support call.

[MatteoBiscosi]

Closing for inactivity, in case the issue persists please reopen this ticket or open a new one