Use ntop to monitor hosts in linux

Use ntop to monitor linux host-Linux Enterprise Application-Linux server application information. The following is a detailed description. 1. installation:
# Rpm-ivh ntop-3.2-1.el4.rf.i386.rpm
2. Create a log file directory:
# Mkdir/var/log/ntop/
Create an account:
# Useradd-g ntop-s/bin/true-M ntop
3. Start for the first time (root)
/Usr/bin/ntop-P/usr/share/ntop-u ntop-
#-P [directory] specifies the. db file storage path
#-U [user] specifies the service to start the user
#-A: Set the admin password. ntop will build the admin account in ntop.

4. view the actions required for the first startup
Less/usr/share/doc/ntop-3.0/1STRUN.txt

5. Compile/etc/ntop. conf file
Vi/etc/ntop. conf
The content is as follows:
# Eth0 is my single Nic lo is a loop
-- Interface eth0, lo
# -- No-mac
# Because I am only a machine, the following is not added. If you are on a vro or gateway, please change the corresponding ip segment to your own
-- Local-subnets 192.168.10.0/24
# Running Port
-- Http-server 3000
# Database storage path
-- Db-file-path/usr/share/ntop
# Daemon running
-- Daemon
# Username
-- User ntop
# Default running level
-- Trace-level 3
# Skip all errors
-- Disable-schedyield

6. Start ntop
/Etc/init. d/ntop start (or # ntop-I eth0)

7. View network traffic
Http: // localhost: 3000/

8. Stop
/Etc/init. d/ntop stop

If ntop is deployed under the hub, all packets on the network can be monitored. However, if it is set up in a switch environment, only the packets sent to itself can be monitored unless the SPAN function is enabled.
The local testing environment is single-host and standard installation. If no plug-in is configured. If you are interested, study the plug-in on your own.
Because ntop needs to listen to ports, it is best to use iptables to limit certain ip addresses to be browsed.
Otherwise, security issues may occur.