High-Speed Web-based Traffic Analysis and Flow Collection
ntopng is the next generation version of the original ntop, a network traffic probe that monitors network usage. ntopng is based on libpcapand it has been written in a portable way in order to virtually run on every Unix platform, MacOSX and on Windows as well.
ntopng – yes, it’s all lowercase – provides a intuitive, encrypted web user interface for the exploration of realtime and historical traffic information.
Main Features
- Sort network traffic according to many criteria including IP address, port, L7 protocol, throughput, Autonomous Systems (ASs)
- Show realtime network traffic and active hosts
- Produce long-term reports for several network metrics including throughput and application protocols
- Top talkers (senders/receivers), top ASs, top L7 applications
- Monitor and report live throughput, network and application latencies, Round Trip Time (RTT), TCP statistics (retransmissions, out of order packets, packet lost), and bytes and packets transmitted
- Store on disk persistent traffic statistics to allow future explorations and post-mortem analyses
- Geolocate and overlay hosts in a geographical map
- Discover application protocols (Facebook, YouTube, BitTorrent, etc) by leveraging on nDPI, ntop Deep Packet Inspection (DPI) technology
- Characterise HTTP traffic by leveraging on characterisation services provided by Google and HTTP Blacklist.
- Analyse IP traffic and sort it according to the source/destination.
- Report IP protocol usage sorted by protocol type
- Produce HTML5/AJAX network traffic statistics.
- Full support for IPv4 and IPv6
- Full Layer-2 support (including ARP statistics)
- GTP/GRE detunnelling
- Support for MySQL, ElasticSearch and LogStash export of monitored data
- Interactive historical exploration of monitored data exported to MySQL
- Alerts engine to capture anomalous and suspicious hosts
- SNMP v1/v2c support and continuous monitoring of SNMP devices
当你在本地网络监控网络流量，根据流量大小、监控平台/接口、数据库类型等等，可以有许多不同的选择。ntopng是一套开源（遵循GPLv3协议）网络流量分析解决方案，提供基于web界面的实时网络流量监控。支持跨平台，包括Linux和MacOS X。ntopng类似于RMON远端网络监控代理，具有内置的Web服务能力，使用Redis键值服务按时间序列存储统计信息。你可以在任何指定的监控服务器上安装ntopng，只需使用任一web浏览器，就能实时访问服务器上的流量报告了。
基于源码编译（内网环境）
01、编译底层库
yum install -y gcc gcc-c++
yum install -y libpcap libpcap-devel
yum install -y libxml2 libxml2-devel
yum install -y glib2 glib2-devel
yum install -y mysql mysql-server
yum install -y git autoconf automake gmake
yum install -y libcurl-devel
yum install sqlite sqlite-devel
yum install libtool
02、安装redis
官网：https://redis.io/
rpm -ivh redis-2.4.10-1.el6.x86_64.rpm
配置：/etc/redis.conf
service redis start
[root@100-lab nt]# ss -ln State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 127.0.0.1:6379 *:* LISTEN 0 128 :::22 :::* LISTEN 0 128 *:22 *:* LISTEN 0 100 ::1:25 :::* LISTEN 0 100 127.0.0.1:25 *:*
03、编译ntopng
官网：http://www.ntop.org/products/traffic-analysis/ntop/
ntopng-2.2.tar.gz
下载：http://pan.baidu.com/s/1dEJnzUD
解压 tar zxf ntopng-2.2.tar.gz
./autogen.sh #编译git,生成configure
./configure #
./gmake #编译
make install #安装 /usr/local/ntopng
04、配置文件
vim /etc/ntopng.conf
#进程号
-G=/var/tmp/ntopng.gid
# 指定监听本地的哪些网段
--local-networks=192.168.100.0/24,192.168.200.0/24
# 指定监听哪张网卡
--interface=eth0
# 指定监听哪个http端口，用于web管理
--user=root
--http-port=3000 #http://ip:3000 认证用户admin/admin
05、启动ntopng
/etc/rc.d/init.d/redis start
启动redis
/usr/local/bin/ntopng /etc/ntopng/ntopng.conf &
启动ntopng并在后台运行
访问http://192.168.100.166:3000/，输入默认用户名和密码admin admin
06、错误解决
00：
[root@100-lab ntopng-2.2]# ./autogen.sh ./autogen.sh: line 11: git: command not found ./autogen.sh: line 14: git: command not found Wait please... ./autogen.sh: line 35: autoreconf: command not found
[root@100-lab ntopng-2.2]# ./autogen.sh Wait please... Can't exec "aclocal": No such file or directory at /usr/share/autoconf/Autom4te/FileUtils.pm lin e 326.autoreconf: failed to run aclocal: No such file or directory
checking for sqlite3_open in -lsqlite3... no
#解决方案
yum install sqlite sqlite-devel
yum install -y git autoconf automake gmake
附上相关网站：
http://www.ntop.org/get-started/download/ #官网
https://github.com/ntop/ntopng #官方github
http://packages.ntop.org/ #根据平台打压的包
http://rpmfind.net
redis-rpm
https://centos.pkgs.org/6/epel-x86_64/redis-2.4.10-1.el6.x86_64.rpm.html
07、附上RPM安装
[root@100-lab ~]# rpm -ivh ntopng-3.1.170607-2895.x86_64.rpm #根据相关缺少包，以此安装
warning: ntopng-3.1.170607-2895.x86_64.rpm: Header V4 RSA/SHA1 Signature, key ID d1eb60be: NOKEY
error: Failed dependencies:
pfring = 6.7.0-1255 is needed by ntopng-3.1.170607-2895.x86_64
redis >= 2.4.0 is needed by ntopng-3.1.170607-2895.x86_64
GeoIP >= 1.4.8 is needed by ntopng-3.1.170607-2895.x86_64
rrdtool >= 1.3.8 is needed by ntopng-3.1.170607-2895.x86_64
numactl is needed by ntopng-3.1.170607-2895.x86_64
ntopng-data is needed by ntopng-3.1.170607-2895.x86_64
zeromq >= 4.0.0 is needed by ntopng-3.1.170607-2895.x86_64
hiredis is needed by ntopng-3.1.170607-2895.x86_64
mysql is needed by ntopng-3.1.170607-2895.x86_64
libnetfilter_queue is needed by ntopng-3.1.170607-2895.x86_64
bridge-utils is needed by ntopng-3.1.170607-2895.x86_64
#借鉴别人的，嘻嘻
############################## wget http://download.fedoraproject.org/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm rpm -ivh epel-release-5-4.noarch.rpm ############################## yum install -y GeoIP-devel yum install -y libpcap-devel glib2-devel libxml2-devel libxml2-devel yum install -y autoconf automake libtool libtoolize autoreconf yum install -y sqlite-devel yum install -y libcurl* yum -y install mysql++-devel.x86_64 mysql-devel.x86_64 mysql-embedded-devel.x86_64 mysql-proxy-devel.x86_64 soci-mysql-devel.x86_64 libodb-mysql-devel.x86_64 ############################## yum install redis service redis start ########################### #github上的版本为ntopng社区版# ########################### yum install git git clone https://github.com/ntop/nDPI.git cd nDPI/ ./autogen.sh make cd .. git clone https://github.com/ntop/ntopng.git ./autogen.sh ./configure make geoip make make install ############################## cd /etc/ mkdir ntopng vim ntopng.configure -G=/var/tmp/ntopng.gid --local-networks=192.168.10.0/24 --interface=em1 --user=nobody --http-port=3000 ############################## nohup /usr/local/bin/ntopng /etc/ntopng/ntopng.conf & web界面登录方式http://ip:port 默认密码为admin,admin ############################## 登录密码修改 redis cli模式下修改ntopng.user.admin.password 然后重启ntopng
在centos6.x系统下安装最新版本的ntopng服务的步骤:
-
cd /etc/yum.repos.d/ -
wget http://packages.ntop.org/centos/ntop.repo -O ntop.repo -
wget http://packages.ntop.org/centos/epel-6.repo -O epel.repo -
wget https://copr.fedoraproject.org/coprs/saltstack/zeromq4/repo/epel-6/saltstack-zeromq4-epel-6.repo -
yum erase zeromq3 -
yum clean all -
yum update -
yum install pfring n2disk nprobe ntopng ntopng-data cento nbox -
yum install pfring-drivers-zc-dkms
#注意：修改配置文件，然后启动redis，再启动ntopng。访问：http://ip:3000，默认用户名密码：admin/admin
相关软件：
http://pan.baidu.com/s/1o7Sy7rk 密码: fkua
参考：
http://www.centoscn.com/image-text/install/2015/1008/6269.html
https://my.oschina.net/0eb1/blog/856998 #rpm快速安装