Ntop monitoring software configuration and installation

Ntop monitoring software configuration and installation

1. Introduction to Ntop

1. ntop is a network monitoring tool, namely, a network sniffer. It can monitor network traffic and even list the network bandwidth utilization of each node computer. It can identify various problems on the network by analyzing network traffic, or determine whether a hacker is attacking the network system; it also allows you to easily display detailed information such as specific network protocols, hosts occupying a large amount of bandwidth, target hosts for various communications, transmission time of data packets, and delay of transmitted data packets. By understanding this information, the network management can respond to faults in a timely manner and optimize and adjust the network to ensure the efficiency and security of network operation.

2. ntop mainly provides the following functions:

1) automatically identifies useful information from the network;

2) convert intercepted data packets into a format that is easy to recognize;

3) analyze communication failures in the network environment;

4) detect communication bottlenecks in the network environment;

5) record the time and process of network communication;

6) automatically identifies the operating system in use by the client

Disable SELinux and iptables;

Install common tools and commands:

Yum-y install yum-plugin * telnet nmap lrzsz

2. ntop preparation before installation

2.1 check the installation environment

Ntop requires the following development libraries and software environments: libtool zlib-devel openssl-devel python-devel rrdtool libpcap, libpcap-devel, libpng, gdbm, and gd ,. (We recommend that you use yuminstall XXX * to install the main package and extension package *)

[Root @ test ~] # Rpm-qa | egrep 'libpcap | libpng | gd'

3. Install the required plug-in

3.1 install libpcap

[Root @ localhost ~] # Wgethttp: // www.tcpdump.org/release/libpcap-1.7.2.tar.gz

[Root @ localhost ~] # Tar zxvf libpcap-1.7.2.tar.gz

[Root @ localhost ~] # Cd libpcap-1.7.2

[Root @ localhost libpcap-1.7.2] #./configure

[Root @ localhost libpcap-1.7.2] # make & make install

Install auxiliary software

# Yumgroupinstall "Development Libraries" "Development tools" "Legacy SoftwareDevelopment"-y (install the compiling environment)

[Root @ localhost ~] # Yum installlibart_lgpl-devel

[Root @ localhost ~] # Yum install libxml2-devel

# Yum install gliblibxml2-devel pangopango-devel-y

3.2 install geoip

# If geoip is not installed, an error will be reported when ntop is installed.

[Root @ localhost ~] # Wgethttp: // geolite.maxmind.com/download/geoip/api/c/GeoIP.tar.gz

[Root @ localhost ~] # Tar zxvf GeoIP.tar.gz

[Root @ localhost ~] # Cd GeoIP-1.4.8

[[Email protected] #./configure

[Root @ localhost GeoIP-1.4.8] # make & make install

3.3 install rrdtool

To avoid errors, [root @ localhost ~] # Yum installpcre *

[Root @ localhost ~] # Wgethttp: // oss. oetiker. ch/rrdtool/pub/rrdtool-1.5.0-rc2.tar.gz

[Root @ localhost ~] # Tar zxvf rrdtool-1.5.0-rc2.tar.gz

[Root @ localhost ~] # Cd rrdtool-1.5.0-rc2

[Root @ localhost rrdtool-1.5.0-rc2] #./configure -- prefix =/usr/local/rrdtool # need to specify this path, ntop will find this directory during compilation and Installation

When compiling, the system prompts configure: error: Please fix thelibrary issues listed above and try again errors. Check carefully that some necessary library files are missing. Please execute

[Root @ localhost ~] # Wgethttp: // down1.chinaunix.net/distfiles/cgilib-0.5.tar.gz

[Root @ localhost ~] # Tar zxvf cgilib-0.5.tar.gz

[Root @ localhost ~] # Cd cgilib-0.5

[Root @ localhost cgilib-0.5] # make

[Root @ localhost cgilib-0.5] # cp libcgi. a/usr/local/lib

[Root @ localhost cgilib-0.5] # cp cgi. h/usr/include

After installing the required library file, run./configure -- prefix =/usr/local/rrdtool again.

The following error occurs: configure: error: you needeither glib with g_regex support or libpcre to compile rrdtool. you need to install pcre.

[Root @ localhost rrdtool-1.5.0-rc2] # make

The following error occurs:

Cairo package support is required when rrdtool is installed, while cairo also requires support for pkg-config, glib, pixman, pango, freetype, and fontconfig packages.

[Root @ localhost pkg-config-0.23] # yuminstall pixman-devel

[Root @ localhost rrdtool-1.4.9] # make install

4. install and configure ntop

4.1 edit and install ntop

[Root @ localhost ~] # Wgethttp: // down1.chinaunix.net/distfiles/ntop-4.1.0.tar.gz

[Root @ localhost ~] # Tar zxvf ntop-4.1.0.tar.gz

[Root @ localhost ~] # Cd ntop-4.1.0

[Root @ localhost ntop-4.1.0] #./autogen. sh -- with-tcpwrap -- with-rrd-home =/usr/local/rrdtool

Configure -- with-tcpwrap option to support TCP Wrappers Access Control

[Root @ localhost ntop-4.1.0] # make

[[Email protected] # make install

You must automatically download etter. finger. OS when installing the supervisor. If you do not connect to the Internet, the following error will be reported:

4.2 create a user

[Root @ localhost ~] # Useradd ntop

[Root @ localhost ~] # Passwd ntop

Create a log storage directory folder

[Root @ localhost ~] # Cd/var/log/

[Root @ localhost log] # mkdirntop

Set directory folder owner and group

[Root @ localhost log] # chownntop. ntop/

Set ntop folder owner and group

[Root @ localhost ~] # Cd/usr/local/share/

[Root @ localhost share] # chown ntop. ntop/usr/local/share/ntop-R

4.2.1 edit the configuration file

Ntop does not have a configuration file by default. You need to copy it from the original installation package.

[Root @ localhost ~] # Cp ntop-4.1.0/packages/RedHat/ntop. conf. sample/etc/ntop. conf

[Root @ localhost ~] # Vi/etc/ntop. conf note the following fields

-- Run as user ntop

-- Db-file-path/usr/local/share/ntop data storage directory

-- Interface Nic monitored by eth0

-- Http-server 3000 Port

4.2.2 set a password for the Administrator

Set the password for the NTOP administrator. The default Administrator for the NTOP is admin. To ensure security, you need to set a password for the NTOP administrator. In addition, when modifying the NTOP settings or disabling the NTOP service through the web page, you must use the administrator user name and password for verification:

#./Ntop-A -- set-admin-password = ntopadmin set the admin password

4.2.3 set TCP Wrapper Permissions

Set TCP Wrapper permissions. When compiling ntop, we use the -- with-tcpwrap configuration item. Therefore, we can control ntop access through the TCP Wrapper policy:

(This step can be modified or omitted based on the actual situation)

# Vi/etc/hosts. allow ntop: 192.168.1.199 // only the NTOP service of the host 192.168.1.199 is allowed #

Vim/etc/hosts. deny ntop: ALL

4.2.4 start ntop

NTop is started for the first time

First Run Description: before the first start, use the following command to set a management password, which will be used for web page settings. The user name is admin by default, and the password is set by the following command.

/Usr/bin/ntop-P-u-

-P [directory] specifies the database storage path

-U [user] specifies the service to start the user

-A: Set the admin password. ntop will include the admin Administrator Account in ntop.

Start running

#/Usr/local/bin/ntop-p/usr/local/var/ntop /&

Or add the startup script (if the network device cannot be found, you can specify-I eth0 !)

# Echo "/usr/local/bin/ntop-p/usr/local/var/ntop/&">/etc/rc. d/rc. local

Browse

Http://xxx.xxx.xxx.xxx: 3000

Install NTOP in Red Hat Enterprise Linux 5.3

Install ntop in CentOS 5.5

Ntop configuration notes under CentOS 6.3

This article permanently updates the link address: