Messages

Ntopng solution is fine for me, it just seems to be able to do so much morenthan what i need, so i was afraid it will impact resources too much? Does it?

Thank you, ntopng does the trick. I'm not sure how many resources does it use, though, and if it interferes with the ids? Probably not :)

As for exporting the data, i'm a home user, would like to use something simple, just to see some reports from time to time what happens in the network

No ideas?

Hi guys!
I haven't found yet how can i see the traffic totals per IP per day/month. I can see live traffic in reporting/traffic. But no totals. From what i searched i should enable netflow and then look in insight? if i do that i only see like 700 bytes form the interface lol
Thanks!

Damn it, it was Suricata! ssid 2027757 block dns to .to domains...
It always is what you never think of :(
It probably did this on a recent update, as i had it working last week. And i thought it was the lan change that did this to me.
Thanks everyone for helping!

Hmm, didnt think of suricata. Will check, thanks

Yes, but tried adding exception, also disabling completely, same

Just had an idea. It looks like unbound can't solve ANY us.to domains! For example usac.us.to
What gives?

I did not have this issue for a year now. I had to change the lan adresses from 192x to 10x and only then thia issue appeared. So it must have a cause related to that, i think. Also, why did unbound chose this ddns domain to be added? I have 2 if them, the other one resolves fine. And us.to is not even the first of the two in the ddns client updater.

Edit: disabled leases, still the same

That alone will not help. The DNS entry still exists after that in /var/unbound/dhcpleases.conf, you have to delete the entry manually and restart unbound.

I have checked the 'flush dns on restart'. That is not enough either?
Also, i would not disable this dhcp names unless  i cant find another solution, as this would make it impossible to find a pc in the lan with only its name, right?

The Domain was NOT .home.arpa but unbound added it to the search anyway? Correct?

No. Whatever domain i set, gets added by unbound. If i set domain 'xxxxx', it gets added.

Well, now i set it to home.arpa. before, itwas something random,like xxdomain. And unbound added that to my us.to. so, whatever i put there gets added. Lol, just had an idea, ill try to put nothing
Edit: it wont let me, i have to put something lol

The router itself is called 'xxx', but not us.to. And it started doing this only after i changed the lan addresses from 192.x to 10.x. yes, i have it set to register dhcp leases,but it had no problem until now
Edit: disabled leases, still the same

Hi
So i have a ddns domain, lets call it xxx.us.to. it gers updated fine to my ip with the inbuilt ddns client with the afraid.org site.
The problem is that if i try to access it from my network, it does not resolve. From other networks it works fine. From what i can see in the logs, when i try to ping it, unbound searches it as xxx.us.to.home.arpa. why would it think to add my local, nonexistent domain to it? i never told the system that this is my domain. Also, i have another ddns domain that gets updated via same builtin ddnsclient, xxx.nsupdate.info. this one gets resolved just fine...
Anything i can do?
Thanks

Ok, thank you.
For now, i've changed my lan to 10.9.99.0. Maybe it will work better