ntopng is an Open Source Tool to monitor the network. It is a security network monitoring tool, also monitors web activities passively. It is also used for packet capturing, Traffic Recording, and Network Probing. A huge number of companies like Google, HP, Cisco, IBM, and many more uses ntop. It acts as a central network monitoring console. Packet capturing capacity of ntop is 10 Gbit. It supports major OS including Unix, Windows, and macOS X.
All the flows are stored in SQL Databases. REST API Integration is quite easy to achieve. Ntopng is a product of Ntop team having many more products like ntopng edge for high availability.
Features:
- Open Source
- Easy to manage
- Multiple kinds of analysis possible using filters
- Realtime analysis
- Supports third-party plugins
- Easy to use WebUI
- Customizable
Step-by-step Installation:
Step 1: Enter in root user and run these commands:
sudo su - apt-get update apt-get upgrade apt-get install software-properties-common wget
Step 2: Now, We will add the repository which contains the ntopng program
add-apt-repository universe
Step 3: Next, we have to install the package
apt install ntopng
During Installation, it will look like
After Installation,
To check whether it is installed or not:
systemctl status ntopng
systemctl is a command used to check installed services in linux.
If it is running, then the output will be as below
If it is not running, then the output will be as below
To start it, use the command
systemctl start ntopng
Configuration File
To view the configuration file,
cat /etc/ntopng/ntopng.conf
To choose the port use “–http-port” or “-w” option as
--http-port=:3000
Other options are also there like
--max-num-flows=200000 --max-num-hosts=250000
These are used to set the maximum number of flows and hosts respectively.
To run ntopng as daemon use option in config file “-e|–daemon” as
-e=<path_to_run>
Or use the below command
systemctl enable ntopng
Running and Testing ntopng:
To run ntopng or to start the ntopng
ntopng
This will run ntopng and view it use the URL in your browser
http://<ntopng IP Address>:<port>/
Example:
http://192.168.53.98:3000/
Enter the username as admin and password as admin, then you can view the ntopng
Here you can see we choose the http-port = 3000, and it is running on that port.