• ntopng网络流量实时监控

    　　ntopng is the next generation version of the original ntop, a network traffic probe that monitors network usage. ntopng is based on libpcapand it has been written in a portable way in order to virtually run on every Unix platform, MacOSX and on Windows as well.

    　　ntopng – yes, it’s all lowercase – provides a intuitive, encrypted web user interface for the exploration of realtime and historical traffic information.

    Main Features

    • Sort network traffic according to many criteria including IP address, port, L7 protocol, throughput, Autonomous Systems (ASs)
    • Show realtime network traffic and active hosts
    • Produce long-term reports for several network metrics including throughput and application protocols
    • Top talkers (senders/receivers), top ASs, top L7 applications
    • Monitor and report live throughput, network and application latencies, Round Trip Time (RTT), TCP statistics (retransmissions, out of order packets, packet lost), and bytes and packets transmitted
    • Store on disk persistent traffic statistics to allow future explorations and post-mortem analyses
    • Geolocate and overlay hosts in a geographical map
    • Discover application protocols (Facebook, YouTube, BitTorrent, etc) by leveraging on nDPI, ntop Deep Packet Inspection (DPI) technology
    • Characterise HTTP traffic by leveraging on characterisation services provided by Google and HTTP Blacklist.
    • Analyse IP traffic and sort it according to the source/destination.
    • Report IP protocol usage sorted by protocol type
    • Produce HTML5/AJAX network traffic statistics.
    • Full support for IPv4 and IPv6
    • Full Layer-2 support (including ARP statistics)
    • GTP/GRE detunnelling
    • Support for MySQL, ElasticSearch and LogStash export of monitored data
    • Interactive historical exploration of monitored data exported to MySQL
    • Alerts engine to capture anomalous and suspicious hosts
    • SNMP v1/v2c support and continuous monitoring of SNMP devices

    　　当你在本地网络监控网络流量，根据流量大小、监控平台/接口、数据库类型等等，可以有许多不同的选择。ntopng是一套开源（遵循GPLv3协议）网络流量分析解决方案，提供基于web界面的实时网络流量监控。支持跨平台，包括Linux和MacOS X。ntopng类似于RMON远端网络监控代理，具有内置的Web服务能力，使用Redis键值服务按时间序列存储统计信息。你可以在任何指定的监控服务器上安装ntopng，只需使用任一web浏览器，就能实时访问服务器上的流量报告了。

    技术分享

    技术分享

    技术分享

    基于源码编译（内网环境）

    01、编译底层库

    yum install -y gcc gcc-c++

    yum install -y libpcap  libpcap-devel  

    yum install -y  libxml2 libxml2-devel

    yum install -y glib2 glib2-devel

    yum install -y mysql mysql-server

    yum install -y git autoconf  automake gmake

    yum install -y libcurl-devel

    yum install sqlite sqlite-devel

    yum install libtool 

    02、安装redis

    官网：https://redis.io/

    rpm -ivh redis-2.4.10-1.el6.x86_64.rpm

    配置：/etc/redis.conf  

    service redis start

    [root@100-lab nt]# ss -ln
State      Recv-Q Send-Q                Local Address:Port                  Peer Address:Port 
LISTEN     0      128                       127.0.0.1:6379                             *:*     
LISTEN     0      128                              :::22                              :::*     
LISTEN     0      128                               *:22                               *:*     
LISTEN     0      100                             ::1:25                              :::*     
LISTEN     0      100                       127.0.0.1:25                               *:*

    03、编译ntopng

    官网：http://www.ntop.org/products/traffic-analysis/ntop/

    ntopng-2.2.tar.gz 

    下载：http://pan.baidu.com/s/1dEJnzUD

    解压   tar zxf ntopng-2.2.tar.gz

    ./autogen.sh   #编译git,生成configure

    ./configure     #

    ./gmake         #编译

    make install   #安装 /usr/local/ntopng

    04、配置文件

    vim /etc/ntopng.conf

    #进程号
    -G=/var/tmp/ntopng.gid

    # 指定监听本地的哪些网段
    --local-networks=192.168.100.0/24,192.168.200.0/24
    # 指定监听哪张网卡
    --interface=eth0
    # 指定监听哪个http端口，用于web管理
    --user=root
    --http-port=3000   #http://ip:3000  认证用户admin/admin

    05、启动ntopng

    /etc/rc.d/init.d/redis start
    启动redis
    /usr/local/bin/ntopng /etc/ntopng/ntopng.conf &
    启动ntopng并在后台运行
    访问http://192.168.100.166:3000/，输入默认用户名和密码admin admin

    06、错误解决

    00：

    [root@100-lab ntopng-2.2]# ./autogen.sh 
./autogen.sh: line 11: git: command not found
./autogen.sh: line 14: git: command not found
Wait please...
./autogen.sh: line 35: autoreconf: command not found
    [root@100-lab ntopng-2.2]# ./autogen.sh
Wait please...
Can‘t exec "aclocal": No such file or directory at /usr/share/autoconf/Autom4te/FileUtils.pm lin
e 326.autoreconf: failed to run aclocal: No such file or directory
    checking for sqlite3_open in -lsqlite3... no

    #解决方案

    yum install sqlite sqlite-devel

    yum install -y git autoconf  automake gmake

     附上相关网站：

    http://www.ntop.org/get-started/download/  #官网

    https://github.com/ntop/ntopng                   #官方github

    http://packages.ntop.org/                            #根据平台打压的包

    http://rpmfind.net

    redis-rpm

    https://centos.pkgs.org/6/epel-x86_64/redis-2.4.10-1.el6.x86_64.rpm.html

     

    07、附上RPM安装

    [root@100-lab ~]# rpm -ivh ntopng-3.1.170607-2895.x86_64.rpm   #根据相关缺少包，以此安装
    warning: ntopng-3.1.170607-2895.x86_64.rpm: Header V4 RSA/SHA1 Signature, key ID d1eb60be: NOKEY
    error: Failed dependencies:
    pfring = 6.7.0-1255 is needed by ntopng-3.1.170607-2895.x86_64
    redis >= 2.4.0 is needed by ntopng-3.1.170607-2895.x86_64
    GeoIP >= 1.4.8 is needed by ntopng-3.1.170607-2895.x86_64
    rrdtool >= 1.3.8 is needed by ntopng-3.1.170607-2895.x86_64
    numactl is needed by ntopng-3.1.170607-2895.x86_64
    ntopng-data is needed by ntopng-3.1.170607-2895.x86_64
    zeromq >= 4.0.0 is needed by ntopng-3.1.170607-2895.x86_64
    hiredis is needed by ntopng-3.1.170607-2895.x86_64
    mysql is needed by ntopng-3.1.170607-2895.x86_64
    libnetfilter_queue is needed by ntopng-3.1.170607-2895.x86_64
    bridge-utils is needed by ntopng-3.1.170607-2895.x86_64

    #借鉴别人的，嘻嘻

    ##############################
wget http://download.fedoraproject.org/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm
rpm -ivh epel-release-5-4.noarch.rpm

##############################
yum install -y GeoIP-devel
yum install -y libpcap-devel glib2-devel libxml2-devel libxml2-devel
yum install -y autoconf automake libtool libtoolize autoreconf
yum install -y sqlite-devel
yum install  -y libcurl*
yum -y install mysql++-devel.x86_64 mysql-devel.x86_64  mysql-embedded-devel.x86_64  mysql-proxy-devel.x86_64    soci-mysql-devel.x86_64  libodb-mysql-devel.x86_64 

##############################
yum install redis
service redis start

###########################
#github上的版本为ntopng社区版#
###########################
yum install git
git clone https://github.com/ntop/nDPI.git
cd  nDPI/
./autogen.sh 
make
cd ..
git clone https://github.com/ntop/ntopng.git
./autogen.sh
./configure 
make geoip
make
make install

##############################
cd /etc/
mkdir ntopng
vim ntopng.configure
-G=/var/tmp/ntopng.gid
--local-networks=192.168.10.0/24
--interface=em1
--user=nobody
--http-port=3000

##############################
nohup /usr/local/bin/ntopng /etc/ntopng/ntopng.conf &

web界面登录方式http://ip:port 默认密码为admin,admin

##############################
登录密码修改
redis cli模式下修改ntopng.user.admin.password
然后重启ntopng

    在centos6.x系统下安装最新版本的ntopng服务的步骤:

    #注意：修改配置文件，然后启动redis，再启动ntopng。访问：http://ip:3000，默认用户名密码：admin/admin

    相关软件：

    http://pan.baidu.com/s/1o7Sy7rk 密码: fkua

    参考：

    http://www.centoscn.com/image-text/install/2015/1008/6269.html

    https://my.oschina.net/0eb1/blog/856998  #rpm快速安装

    ntopng网络流量实时监控

    标签：queue   cte   elastics   spi   ...   dpi   内网   soc   sed   

    原文：http://www.cnblogs.com/xiaochina/p/6958113.html
  • 相关阅读:
    软件需求分析阅读笔记2
    Ubuntu上的Hbase集群搭建
    Form的Load事件的添加
    软件需求与分析大作业进度（二）
    软件需求与分析大作业进度(一)
    第四周学习进度总结
    使用vmware+Ubuntu搭建hadoop集群
    团队十日冲刺10
    用户模板和用户场景
    团队十日冲刺9
  • 原文地址：https://www.cnblogs.com/allen-zhang/p/8034308.html
Copyright © 2020-2023  润新知