We have relaunched: What's new at ZDNet Asia?

ZDNet / Techguide / Open Source / Story

Monitor network traffic with ntop

By Vincent Danen, TechRepublic on July 23, 2007

Summary

Instead of monitoring system resource usage like top, ntop monitors network usage and provides some very sophisticated and informative data.

Events

Microsoft MSDN/Developer Event
25 Mar 2010

One Marina Boulevard, Microsoft Singapore

IT Architect Regional Conference Singapore 2010
20 - 21 Apr 2010

Singapore Management University, Singapore

The Internet Show 2010
21-22 Apr 2010

Suntec Singapore

Like the command-line tool with a similar name, ntop is a monitoring agent. Instead of monitoring system resource usage like top, ntop monitors network usage and provides some very sophisticated and informative data.

Ntop, available at http://www.ntop.org/, can be downloaded and compiled from source or installed via your Linux vendor's package repositories if available. The ntop Web site also provides Debian and RPM package formats that can be downloaded and installed.

This will start ntop, ask you for the administrative password to use, and then exit. Once that is done, you can start ntop and begin monitoring network traffic.

A very basic invocation of ntop would be:

# ntop -P /var/lib/ntop

This will start ntop and write the database files to the directory /var/lib/ntop. Ntop needs to start as root, but it supports dropping privileges to an unprivileged user. Instead of running ntop as root all the time, run it as a dedicated user. To create the user ntop, execute:

# groupadd ntop

# useradd -M -s /bin/false -d /var/lib/ntop -c "ntop user" -g ntop ntop

These two commands will create the user and group for ntop. Finally, start ntop and tell it to drop privileges to the ntop user:

# ntop -P /var/lib/ntop -u ntop

This starts ntop and leaves it attached to the terminal; using ntop this way is great if you need to quickly visualize network traffic (perhaps to determine where a bottleneck is or to aid in network troubleshooting). Running ntop on a firewall or gateway device is best as it can watch all traffic; if you use Linux for a custom firewall, install ntop there to get the best data. Otherwise, ntop can watch traffic coming to and from the system it is installed on, which may be useful to determine what programs are opening connections, for example, from that system.

To view ntop statistics, connect to port 3000 on the system on which ntop is installed with a Web browser. You can configure the port and decide whether to use HTTPS instead of HTTP by adjusting the command-line options. For instance, to have ntop listen to port 4000 and only accept HTTPS traffic, use ntop -w 0 -W 4000. To have it listen on port 3000 for HTTP traffic and port 4000 for HTTPS traffic, use ntop -w 3000 -W 4000.

To have ntop start at boot and constantly watch traffic, add the following to /etc/init.d/rc.local or a similar script that is started at boot:

ntop -P /var/lib/ntop -u ntop -d

Specifying the -d option tells ntop to daemonize and fork to the background.

Ntop is a great analytical tool that can be extremely useful for seeing what is happening on the network in real-time. By design, ntop can consume a lot of memory, so if there is no need to run it constantly, it's probably best to leave it as part of the troubleshooting arsenal and invoke it when necessary.

Talkback

Add your opinion

In order to post a comment, you need to be registered. (Sign In or register below)

Post your comment
Transform your business interactions with real-time voice, video and telepresence solutions.
Tech Vendor: Cisco

ZDNet Asia Live

www.3w.com.au has seen it's outsourced IT Contracting Business in Manila grow at 4 times the rate of its traditional Australian Based...

6 minutes ago by brucemills on Companies' outsourcing spend to increase

RT @3wconsulting: Whitepaper from http://3W.com.au "Outsourcing Your IT Requirements to Philippines" now on @zdnetaustralia & @zdnetasia http://ow.ly/1oY9f

Whitepaper from http://3W.com.au "Outsourcing Your IT Requirements to Philippines" now on @zdnetaustralia & @zdnetasia http://ow.ly/1oYbA

Whitepaper from http://3W.com.au "Outsourcing Your IT Requirements to Philippines" now on @zdnetaustralia & @zdnetasia http://ow.ly/1oYbz

Zdnetasia.com Estimated Worth $178,365 USD. Daily Ad Revenue:$244 USD, Daily Views:81,445 Pages... - http://www.haplog.com/www.zdneta...

recently estimated website net worth of zdnetasia.com - http://www.haplog.com/www.zdneta...

9 hours 59 minutes ago by haplog on topsy

When I create an event, I click on an approximate time during the day when I want the event to occur, then I click "edit event detail...

1 day 35 minutes ago by bessellbrowne on Google Calendar gets 'smart' rescheduling

ipads break alott i had one it broke three times in the month i had it so i got rid of the damn thing id just go for the laptop Top Grade...

1 day 37 minutes ago by bessellbrowne on Report: 'Hundreds of thousands' of iPad preorders

There are a number of websites that still require Internet Explorer to view and IE for Mac Stinks (it is really ies4osx which is the Wind...

1 day 39 minutes ago by bessellbrowne on Microsoft: Only minor tweaks in Windows 7 SP1

The receivers don't transmit back to the satellite. Unless there is a phone line attached to the receiver, they don't have any wa...

1 day 41 minutes ago by bessellbrowne on Apple to join the geolocation craze?

What to expect from open source Symbian http://is.gd/aPIGL

1 day 56 minutes ago by rebelk0de on topsy

"Lead Cognos BI Developer Insurance - Jobs - ZDNet Asia" http://bit.ly/bRcxOG

1 day 36 minutes ago by rhrcognos on topsy

whatever little understanding I have we 'll only progress toward end of the world if we use HPCs to lenthen life of human being. Huma...

1 day 48 minutes ago by abhi32002@gmail.com on High computing promises elixir of life

Thanks for the knowledgeable article on SDDs. Allas...when all this reasearch will happen in Indian Universities. Hope the new bill on Fo...

1 day 1 minute ago by abhi32002@gmail.com on APAC HPC users eye solid-state drives

It was a good article. This brings a good opportunity for Indian IT firms to come up with new solutions in this field. HPC can become a b...

1 day 19 minutes ago by abhi32002@gmail.com on High computing most-wanted job in Asia

COL KR DHARMADHIKARY(RETD) its very late to reply the link, but if it is still alive and looking for opportunity, i would like to know th...

1 day 17 minutes ago by deb021280 on Education takes off in rural India, helped by PCs

It was just a matter of time until google was marginalised anyway. I'm afraid this will be forgotten in China very quickly. Still, it...

1 day 21 minutes ago by robinsmith on Report: Google to leave China on April 10

High performance computing (HPC) most-wanted job in Asia http://bit.ly/9vFC3i (via @zdnetasia) #singapore

He doesn't care if her shoes are of glass, All he wants to see is a huge rack and nice a*s. Sleeping beauty's not awoken by true ...

1 day 50 minutes ago by warlowdavies on One pair of 3D glasses to rule them all

RT @zdnetasia: EMC COO, Pat Gelsinger, on bridging gaps in the organization and its cloud ambitions in Asia. (cont) http://tl.gd/i5jjd

EMC COO, Pat Gelsinger, on bridging gaps in the organization and its cloud ambitions in Asia. http://bit.ly/9etOZW

Asian SMBs need to pay more attention to disaster recovery planning http://bit.ly/bDet08 via @zdnetasia

Asian SMBs need to pay more attention to disaster recovery planning http://bit.ly/bDet08

[TECH] URL Shorteners slow Web redirection. - http://bit.ly/bySnWK @zdnetasia

URL shorteners are great but they can slow web redirection & you pray it would never go down http://bit.ly/bySnWK via @zdnetasia

Temasek Holdings eyeing tech stocks, indicating optimistic outlook on IT sector. http://bit.ly/aM7VwU

URL shorteners slow Web redirection. http://bit.ly/bySnWK

Chinese agencies cry foul over Google. http://bit.ly/by6rwV

all of sg's isps have been practising compulsory invisible proxy for all home subscribers at their backend since many years back alre...

2 days 252047 seconds ago by melvinchia on Web filters mean bad news for business

it is not to good for china.
Proactol

3 days 45 minutes ago by nathonastle on Chinese ad partners beg Google for information

IT security insiders rob casinos of $50K http://is.gd/aPIKR

3 days 17 minutes ago by rebelk0de on topsy

Very good explanation of JMX

3 days 50 minutes ago by Babith B on Managing applications with JMX

The reaction to a report issued Tuesday by Flurry Analytics managed to completely overlook some interesting news--the Android-based Motorola Droid outsold the original iPhone over the same period of time following their respective launches--to focus instead on the sales numbers for the Nexus One.

4 days 54 minutes ago by lonemavericks on diggs

Another ZTE story....

4 days 56 minutes ago by Moderate Your Greed on Philippines opens bid for final 3G license

Keep up with ZDNet Asia

Linkedin Join our network

RSS Feeds Subscribe now

Newsletters Subscribe today

Twitter Follow us

Inside ZDNet Asia

Special Report: Tech Focus in 2010

Latest Videos on Tech Industry

Insight: Interviews with Newsmakers

Search for over 15,000 Tech Jobs in Asia

Find your Tech answers in TechGuides

IT Library: Over 60,000 IT papers at your fingertips

Download IT Priorities 2010 Report