ntop is a network traffic tool that shows network usage in real time. It displays a list of hosts that are currently using the network and reports information concerning the IP (Internet Protocol) and Fibre Channel (FC) traffic generated by each host. The traffic is sorted according to host and protocol. Protocols (user configurable) include:
One of the good things about this tool is that you can use a web browser to manage and navigate through ntop traffic information to better understand network status.
* a web interfacemake ntop easy to use and suitable for monitoring various kind of networks.
* limited configuration and administration via the web interface
* reduced CPU and memory usage (they vary according to network size and traffic)
libpcap is a system-independent interface for user-level packet capture. libpcap provides a portable framework for low-level network monitoring.
Please download the G-LIB rpm as well as ntop rpms.
1- Installing G-LIB:
# wget ftp://download.fedora.redhat.com/pub/fedora/
# rpm -ivh glib-1.2.10-16.i386.rpm
2- Installing ntop:
# wget http://dag.wieers.com/rpm/packages/ntop/
# rpm -ivh ntop-3.2-1.el3.rf.i386.rpm
5. Running ntop
1- Initialize ntop:
ntop :That will initialize ntop and it will ask you to enter your username and password.
The default username: adminOnce the admin password set, you will get a message at the command prompt something like.
Please enter the password for the admin user:
Please enter the password again:
"Thu 22 Mar 2007 11:01:04 PM MDT Admin user password has been set"
2- Start ntop service:
# service ntop start
Starting ntop: [ OK ]
6. Log In To The Web Interfacentop can be managed through a web interface. You can enter your server address in your web browser:
http://ServerIP:3000Now you can monitor your hosts and manage your ntop configuration your admin login.
7. PluginsThe following plugins can be configured for the system through the ntop web interface.
- Host Last Seen: This plugin produces a report about the last time packets were seen from each specific host.A note card database is available for recording additional information.
- icmpWatch: This plugin produces a report about the ICMP packets that ntop has seen. The report includes each host, byte and per-type counts (sent/received).
- snmpPlugin: This plugin is used to monitor host traffic using the SNMP protocol.
- Round Robin Database: This plugin is used to setup, activate and deactivate ntop's rrd support. This plugin also produces the graphs of rrd data, available via a link from the various 'Info about host xxxxx' reports.
- NetFlow: This plugin is used to setup, activate and deactivate NetFlow support. ntop can both collect and receive NetFlow V1/V5/V7/V9 and IPFIX (draft) data. Received flow data is reported as a separate 'NIC' in the regular ntop reports.
- sFlow: This plugin is used to setup, activate and deactivate ntop's sFlow support. ntop can both collect and receive sFlow data.
- PDAPlugin: This plugin produces a minimal ntop report, suitable for display on a pda.