ntopng is the next generation version of the original ntop, a network traffic probe that monitors network usage. ntopng is based on libpcap and it has been written in a portable way in order to virtually run on every Unix platform, MacOSX and on Windows as well.
ntopng – yes, it’s all lowercase – provides an intuitive, encrypted web user interface for the exploration of real time and historical traffic information.
Main Features
- Sort network traffic according to many criteria including IP address, port, L7 protocol, throughput, Autonomous Systems (ASs).
- Show real time network traffic and active hosts.
- Produce long-term reports for several network metrics including throughput and application protocols.
- Top talkers (senders/receivers), top ASs, top L7 applications.
- Monitor and report live throughput, network and application latency, Round Trip Time (RTT), TCP statistics (retransmission’s, out of order packets, packet lost), and bytes and packets transmitted.
- Store on disk persistent traffic statistics to allow future explorations and post-mortem analyses.
- Geo locate and overlay hosts in a geographical map.
- Discover application protocols (Facebook, YouTube, BitTorrent, etc) by leveraging on nDPI, ntop Deep Packet Inspection (DPI) technology.
- Characterize HTTP traffic by leveraging on characterization services provided by Google and HTTP Blacklist.
- Analyze IP traffic and sort it according to the source/destination.
- Report IP protocol usage sorted by protocol type.
- Produce HTML5/AJAX network traffic statistics.
- Full support for IPv4 and IPv6.
- Full Layer-2 support (including ARP statistics).
- GTP/GRE detunnelling.
- Support for MySQL, Elastic Search and Log Stash export of monitored data.
- Interactive historical exploration of monitored data exported to MySQL.
- Alerts engine to capture anomalous and suspicious hosts.
- SNMP v1/v2c support and continuous monitoring of SNMP devices.
How to Install
yum install -y subversion autoconf automake make gcc tcpdump libpcap-devel libxml2-devel sqlite-devel libtool glib2-devel gcc-c++ libmaxminddb-devel yum --enablerepo=epel install redis -y useradd -d /var/lib/ntopng ntopng mkdir -p /etc/ntopng
Install Supported dependency
cd /usr/local/src git clone https://github.com/ntop/nDPI.git cd nDPI ./autogen.sh make
Install Ntopng
cd /usr/local/src git clone https://github.com/ntop/ntopng.git cd ntopng ./autogen.sh ./configure make make install /usr/bin/gmake geoip
Setup Additional requirements
cp /usr/local/src/ntopng/httpdocs/misc/ntopng-utils-manage-config /usr/bin/ntopng-utils-manage-config
Copy and paste all lines not one by one.
cat > /etc/ntopng/ntopng.conf << "EOF" -G=/var/run/ntopng.pid -d=/var/lib/ntopng -w=3000 -i=any -1=/usr/local/src/ntopng/httpdocs -2=/usr/local/src/ntopng/scripts EOF
Setup Startup Service
Centos 6
cp /usr/local/src/ntopng/packages/etc/init.d/ntopng /etc/init.d/ntopng touch /etc/ntopng/ntopng.start ln -s /usr/local/bin/ntopng /usr/bin/ntopng
Centos 7
cp /usr/local/src/ntopng/packages/etc/systemd/system/ntopng.service /usr/lib/systemd/system/ntopng.service
Start Services
service redis start service ntopng start
