Can you explain your scenario a bit more? Can you describe the device(s) being used?
The nprobe is installed onto a pc and one of the nic's is plugged into a cisco span port. The other is into the normal network port. When you run nprobe you have to specify the source interface to monitor as per:
nprobe /c -i 2 (nprobe shows you what interface nrpobe see's as the index number)
Then you have to speciy the flow in and out source index. The developer of nprobe states that the
-u and -Q settings are the snmp index numbers of the interfaces associated with the flow. If you do
not specify these interfaces then it defaults to the mac octets of the source which is seen by Orion
as being an invalid interface. So i did an snmp walk and obtained the snmp index's.
The command is then
nprobe /c -i2 -n destination ip:port (orion module) -u 65549 -Q 65549
That should work and I have tried 100's of combinations of the above command.
This worked well in the testing environment although I used a pc for this.
I just hoped someone has some idea of the product and my problem with the integration.
I've enclosed a diagram too.
NPROBE2.jpg 62.9 KB
I have also noted problems with using nprobe where the if index is in the 65000 range, I think it may be a bug in nprobe. I have usually got around the problem by using the loopback if's index as this tends to be in the 0 to 10 range
I thought i had tried every combination but i used
nprobe /c -i 1 -nxxx:2055 -u 1 -Q 1
and it worked. I have been working on this solid for about 5 days so I'm really chuffed.