Network Monitoring With ntop: Installation and Configuration

1. Introduction

ntop is a network traffic tool that shows network usage in real time. It displays a list of hosts that are currently using the network and reports information concerning the IP (Internet Protocol) and Fibre Channel (FC) traffic generated by each host. The traffic is sorted according to host and protocol. Protocols (user configurable) include:

   * TCP/UDP/ICMP
* (R)ARP
* IPX
* DLC
* Decnet
* AppleTalk
* Netbios
* TCP/UDP
     o FTP
     o HTTP
     o DNS
     o Telnet
     o SMTP/POP/IMAP
     o SNMP
     o NFS
     o X11

One of the good things about this tool is that you can use a web browser to manage and navigate through ntop traffic information to better understand network status.

    * a web interface
* limited configuration and administration via the web interface
* reduced CPU and memory usage (they vary according to network size and traffic) 

make ntop easy to use and suitable for monitoring various kind of networks.

2. Prerequisites

Ntop 3.2
LIBPCAP
GDBM

libpcap is a system-independent interface for user-level packet capture. libpcap provides a portable framework for low-level network monitoring.

3. Download

Please download the G-LIB rpm as well as ntop rpms.

http://dag.wieers.com/rpm/packages/ntop
http://rpmfind.net/linux/RPM/fedora/4/i386/
     glib-1.2.10-16.i386.html 

4. Installation

1- Installing G-LIB:

# wget ftp://download.fedora.redhat.com/pub/fedora/
     linux/core/4/SRPMS/glib-1.2.10-16.src.rpm
# rpm -ivh  glib-1.2.10-16.i386.rpm 

2- Installing ntop:

# wget http://dag.wieers.com/rpm/packages/ntop/
     ntop-3.2-1.el3.rf.i386.rpm
# rpm -ivh ntop-3.2-1.el3.rf.i386.rpm 

5. Running ntop

1- Initialize ntop:

ntop :That will initialize ntop and it will ask you to enter your username and password.

The default username: admin
Please enter the password for the admin user:
Please enter the password again: 

Once the admin password set, you will get a message at the command prompt something like.

"Thu 22 Mar 2007 11:01:04 PM MDT  Admin user password has been set"

2- Start ntop service:

# service ntop start
Starting ntop:                                             [  OK  ]

6. Log In To The Web Interface

ntop can be managed through a web interface. You can enter your server address in your web browser:

http://ServerIP:3000
https://ServerIP:3001

Now you can monitor your hosts and manage your ntop configuration your admin login.

7. Plugins

The following plugins can be configured for the system through the ntop web interface.

1. Host Last Seen: This plugin produces a report about the last time packets were seen from each specific host.A note card database is available for recording additional information.
2. icmpWatch: This plugin produces a report about the ICMP packets that ntop has seen. The report includes each host, byte and per-type counts (sent/received).
3. snmpPlugin: This plugin is used to monitor host traffic using the SNMP protocol.
4. Round Robin Database: This plugin is used to setup, activate and deactivate ntop's rrd support. This plugin also produces the graphs of rrd data, available via a link from the various 'Info about host xxxxx' reports.
5. NetFlow: This plugin is used to setup, activate and deactivate NetFlow support. ntop can both collect and receive NetFlow V1/V5/V7/V9 and IPFIX (draft) data. Received flow data is reported as a separate 'NIC' in the regular ntop reports.
6. sFlow: This plugin is used to setup, activate and deactivate ntop's sFlow support. ntop can both collect and receive sFlow data.
7. PDAPlugin: This plugin produces a minimal ntop report, suitable for display on a pda.

. References

1.http://www.ntop.org/
2.http://ntop.ethereal.com/ntop.html