Next Generation Ntopng network traffic monitoring-Visualization and architecture analysis

What ntopng can does for me? (http://www.ntop.org/products/ntop/)

• Sort network traffic according to many protocols

• Show network traffic and IPV4/V6 active hosts

• Store on disk persistent traffic statistics in RRD format

• Geolocate hosts

• Discover application protocols by leveraging on NDPI, ntop ' s DPI framework.

• Characterise HTTP traffic by leveraging in characterisation services provided by BLOCK.SI. Ntopng comes with a demo characterisation key, and if you need a permanent one, please mail [email protected].

• Show IP Traffic Distribution among the various protocols

• Analyse IP traffic and sort it according to the Source/destination

• Display IP Traffic Subnet matrix (who's talking to the Who?)

• Report IP protocol usage sorted by protocol type

• Act as a netflow/sflow collector for flows generated by routers (e.g. Cisco and Juniper) or switches (e.g. Foundry Network s) when the used together with NProbe.

• Produce Html5/ajax network traffic statistics

Brew Quick Install

yanruidemacbook-pro:~ yanrui$ Ruby-v

Ruby 2.0.0p481 (2014-05-08 revision 45883) [UNIVERSAL.X86_64-DARWIN14]

yanruidemacbook-pro:~ yanrui$ ruby-e "$ (curl-fssl https://raw.githubusercontent.com/Homebrew/install/master/install)"

==> This script would install:

/usr/local/bin/brew

/usr/local/library/...

/usr/local/share/man/man1/brew.1

Press RETURN to continue or any other key to abort

==> downloading and installing Homebrew ...

Remote:counting objects:237423, done.

Remote:compressing objects:100% (1040/1040), done.

Remote:total 237423 (Delta 711), reused 0 (Delta 0), pack-reused 236381

Receiving objects:100% (237423/237423), 32.52 MiB | 1.01 mib/s, done.

Resolving deltas:100% (176649/176649), done.

From Https://github.com/Homebrew/homebrew

* [New branch] master, Origin/master

HEAD is now @ 0faf905 Return early for the = = case in version#<=>

==> installation successful!

==> Next Steps

Run ' Brew Doctor ' before you install anything

Run ' Brew help ' to get started

yanruidemacbook-pro:~ yanrui$ Brew?

Error:unknown command:?

yanruidemacbook-pro:~ yanrui$ Brew?

-bash:brew?: Command not Found

yanruidemacbook-pro:~ yanrui$

yanruidemacbook-pro:~ yanrui$

yanruidemacbook-pro:~ yanrui$ Brew Help

Example usage:

Brew [INFO | home | options] [FORMULA ...]

Brew Install FORMULA ...

Brew Uninstall FORMULA ...

Brew Search [foo]

Brew list [FORMULA ...]

Brew Update

Brew upgrade [FORMULA ...]

Brew Pin/unpin [FORMULA ...]

Troubleshooting:

Brew Doctor

Brew INSTALL-VD FORMULA

Brew [--env | config]

Brewing:

Brew Create [URL [--no-fetch]]

Brew edit [FORMULA ...]

Open https://github.com/Homebrew/homebrew/blob/master/share/doc/homebrew/Formula-Cookbook.md

Further help:

Mans Brew

Brew Home

yanruidemacbook-pro:~ yanrui$ Brew Info

yanruidemacbook-pro:~ yanrui$ Brew Update

Updated Homebrew from 0faf9056 to 90abb002.

==> Updated Formulae

Libdnet

Brew Install Ntopng

yanruidemacbook-pro:~ yanrui$ Brew Install Ntopng

Cairo:xquartz is required to install this formula.

You can install with Homebrew Cask:

Brew Install Caskroom/cask/xquartz

Can download from:

https://xquartz.macosforge.org

Pango:xquartz is required to install this formula.

You can install with Homebrew Cask:

Brew Install Caskroom/cask/xquartz

Can download from:

https://xquartz.macosforge.org

Error:unsatisified requirements failed this build.

yanruidemacbook-pro:~ yanrui$ Brew Install Caskroom/cask/xquartz

Cloning into '/usr/local/library/taps/caskroom/homebrew-cask ' ...

Remote:counting objects:128670, done.

Remote:compressing objects:100% (12/12), done.

Remote:total 128670 (Delta 4), reused 0 (Delta 0), pack-reused 128658

Receiving objects:100% (128670/128670), 37.17 MiB | 6.00 kib/s, done.

Resolving deltas:100% (85113/85113), done.

Checking connectivity ... done.

Ntopng service startup

yanruidemacbook-pro:~ yanrui$ sudo ntopng

19/mar/2015 11:51:40 [ntop.cpp:586] Setting local networks to 192.168.1.0/24,0.0.0.0/32,224.0.0.0/8,239.0.0.0/ 8,255.255.255.255/32,127.0.0.0/8

19/mar/2015 11:51:40 [redis.cpp:74] successfully connected to Redis 127.0.0.1:6379

19/mar/2015 11:51:40 [pcapinterface.cpp:81] Reading packets from interface En0 ...

19/mar/2015 11:51:40 [ntop.cpp:710] Registered interface En0 [id:0]

19/mar/2015 11:51:40 [pcapinterface.cpp:81] Reading packets from interface awdl0 ...

19/mar/2015 11:51:40 [ntop.cpp:710] Registered interface Awdl0 [ID:1]

19/mar/2015 11:51:40 [pcapinterface.cpp:81] Reading packets from interface en1 ...

19/mar/2015 11:51:40 [ntop.cpp:710] Registered interface EN1 [Id:2]

19/mar/2015 11:51:40 [pcapinterface.cpp:81] Reading packets from interface en2 ...

19/mar/2015 11:51:40 [ntop.cpp:710] Registered interface EN2 [Id:3]

19/mar/2015 11:51:40 [pcapinterface.cpp:81] Reading packets from interface p2p0 ...

19/mar/2015 11:51:40 [ntop.cpp:710] Registered interface P2p0 [Id:4]

19/mar/2015 11:51:40 [pcapinterface.cpp:81] Reading packets from interface Lo0 ...

19/mar/2015 11:51:40 [ntop.cpp:710] Registered interface Lo0 [Id:5]

19/mar/2015 11:51:40 [utils.cpp:251] User changed to nobody

19/mar/2015 11:51:40 [main.cpp:184] PID stored in file/var/tmp/ntopng.pid

Error Opening File/usr/local/cellar/ntopng/1.2.1/share/ntopng/httpdocs/geoip/geoipasnum.dat

19/mar/2015 11:51:40 [geolocation.cpp:59] warning:unable to read GeoIP database/usr/local/cellar/ntopng/1.2.1/share/ Ntopng/httpdocs/geoip/geoipasnum.dat

Error Opening File/usr/local/cellar/ntopng/1.2.1/share/ntopng/httpdocs/geoip/geoipasnumv6.dat

19/mar/2015 11:51:40 [geolocation.cpp:59] warning:unable to read GeoIP database/usr/local/cellar/ntopng/1.2.1/share/ Ntopng/httpdocs/geoip/geoipasnumv6.dat

Error Opening File/usr/local/cellar/ntopng/1.2.1/share/ntopng/httpdocs/geoip/geolitecity.dat

19/mar/2015 11:51:40 [geolocation.cpp:59] warning:unable to read GeoIP database/usr/local/cellar/ntopng/1.2.1/share/ Ntopng/httpdocs/geoip/geolitecity.dat

Error Opening File/usr/local/cellar/ntopng/1.2.1/share/ntopng/httpdocs/geoip/geolitecityv6.dat

19/mar/2015 11:51:40 [geolocation.cpp:59] warning:unable to read GeoIP database/usr/local/cellar/ntopng/1.2.1/share/ Ntopng/httpdocs/geoip/geolitecityv6.dat

19/mar/2015 11:51:40 [httpserver.cpp:351] HTTPS disabled:missing SSL certificate/usr/local/cellar/ntopng/1.2.1/share /ntopng/httpdocs/ssl/ntopng-cert.pem

19/mar/2015 11:51:40 [httpserver.cpp:352] please read Https://svn.ntop.org/svn/ntop/trunk/ntopng/README. SSL if you want to enable SSL.

19/mar/2015 11:51:40 [httpserver.cpp:389] Web server dirs [/usr/local/cellar/ntopng/1.2.1/share/ntopng/httpdocs][/ Usr/local/cellar/ntopng/1.2.1/share/ntopng/scripts]

19/mar/2015 11:51:40 [httpserver.cpp:392] HTTP server listening on port 3000

19/mar/2015 11:51:40 [main.cpp:232] working directory:/var/tmp/ntopng

19/mar/2015 11:51:40 [main.cpp:234] scripts/html pages Directory:/usr/local/cellar/ntopng/1.2.1/share/ntopng

19/mar/2015 11:51:40 [ntop.cpp:206] Welcome to Ntopng x86_64 v.1.2.1 (r1.2.1)-(C) 1998-14 ntop.org

19/mar/2015 11:51:40 [periodicactivities.cpp:53] Started Periodic Activities loop ...

19/mar/2015 11:51:40 [runtimeprefs.cpp:32] Dump alerts into syslog

19/mar/2015 11:51:40 [networkinterface.cpp:800] Started packet polling on interface En0 [Id:1] ...

19/mar/2015 11:51:40 [networkinterface.cpp:800] Started packet polling on interface awdl0 [Id:2] ...

19/mar/2015 11:51:40 [networkinterface.cpp:800] Started packet polling on interface en1 [Id:3] ...

19/mar/2015 11:51:40 [networkinterface.cpp:800] Started packet polling on interface en2 [Id:4] ...

19/mar/2015 11:51:40 [networkinterface.cpp:800] Started packet polling on interface p2p0 [Id:5] ...

19/mar/2015 11:51:40 [networkinterface.cpp:800] Started packet polling on interface Lo0 [Id:6] ...

Ntopng Dependent Components

Yanruidemacbook-pro:cellar yanrui$ pwd

/usr/local/cellar

Yanruidemacbook-pro:cellar yanrui$ LS-LRT

Total 0

Drwxr-xr-x 3 Yanrui Admin 102 3 15:58 Brew-cask

Drwxr-xr-x 3 Yanrui Admin 102 3 16:13 ReadLine

Drwxr-xr-x 3 Yanrui Admin 102 3 16:13 SQLite

Drwxr-xr-x 3 Yanrui Admin 102 3 16:13 gdbm

Drwxr-xr-x 3 Yanrui Admin 102 3 16:14 OpenSSL

Drwxr-xr-x 3 Yanrui Admin 102 3 16:15 python

Drwxr-xr-x 3 Yanrui Admin 102 3 16:15 autoconf

Drwxr-xr-x 3 Yanrui Admin 102 3 16:16 Automake

Drwxr-xr-x 3 Yanrui Admin 102 3 16:16 Pkg-config

Drwxr-xr-x 3 Yanrui Admin 102 3 16:16 Libtool

Drwxr-xr-x 3 Yanrui Admin 102 3 16:16 GetText

Drwxr-xr-x 3 Yanrui Admin 102 3 16:17 Libffi

Drwxr-xr-x 3 Yanrui Admin 102 3 16:17 GLib

Drwxr-xr-x 3 Yanrui Admin 102 3 16:17 gobject-introspection

Drwxr-xr-x 3 Yanrui Admin 102 3 16:18 Json-glib

Drwxr-xr-x 3 Yanrui Admin 102 3 16:18 wget

Drwxr-xr-x 3 Yanrui Admin 102 3 16:18 ZEROMQ

Drwxr-xr-x 3 Yanrui Admin 102 3 16:18 LIBTASN1

Drwxr-xr-x 3 Yanrui Admin 102 3 16:19 GMP

Drwxr-xr-x 3 Yanrui Admin 102 3 16:19 Nettle

Drwxr-xr-x 3 Yanrui Admin 102 3 16:19 GnuTLS

Drwxr-xr-x 3 Yanrui Admin 102 3 16:19 json-c

Drwxr-xr-x 3 Yanrui Admin 102 3 16:20 libpng

Drwxr-xr-x 3 Yanrui Admin 102 3 16:20 FreeType

Drwxr-xr-x 3 Yanrui Admin 102 3 16:20 fontconfig

Drwxr-xr-x 3 Yanrui Admin 102 3 16:23 Pixman

Drwxr-xr-x 3 Yanrui Admin 102 3 16:24 Cairo

Drwxr-xr-x 3 Yanrui Admin 102 3 16:30 icu4c

Drwxr-xr-x 3 Yanrui Admin 102 3 16:31 Harfbuzz

Drwxr-xr-x 3 Yanrui Admin 102 3 16:31 Pango

Drwxr-xr-x 3 Yanrui Admin 102 3 16:31 RRDtool

Drwxr-xr-x 3 Yanrui Admin 102 3 16:32 Luajit

Drwxr-xr-x 3 Yanrui Admin 102 3 16:32 GeoIP

Drwxr-xr-x 3 Yanrui Admin 102 3 16:33 Redis

Drwxr-xr-x 3 Yanrui Admin 102 3 16:34 ntopng

Next Generation Ntopng network traffic monitoring-Visualization and architecture analysis