ntopng v4 has introduced the concept of plugins that are short scripts written in Lua. They allow people to code ntopng extensions for triggering alerts when specific conditions are met, or extend the engine by adding new external data feeds. Possibilities are manyfold. In the next ntopng release we want to simplify the addition of […]
You’re invited to the ntop Virtual Meetup: April 2nd
This is to invite you to join or webinar about ntopng v4. We want to introduce you to the new application features, and assist you with first time installation. This will also be the right time to meet with out community and hear your feedback. We hope this to be just the first meetup. Meetup […]
Introducing n2n 2.6 with AES Encryption
This is to introduce you the latest n2n 2.6 stable release. This is mostly a maintenance release to address the issues of 2.4 that has been the first release since a long time of silence. The main features are AES encryption that features an overall speed bump (12x speed) and security with respect to twofish […]
Introducing nProbe 9.0: Traffic Behaviour Analysis and High Speed Flow Collection (Even Behind a Firewall)
This is to introduce nProbe 9.0 stable release whose the two main features are traffic behaviour analysis and high speed flow collection. Traffic Behaviour Analysis When in 2002 nProbe™ development started, the idea was to create a drop-in replacement for physical probes present in routers. Later the advent of IPFIX pushed the monitoring community towards […]
Securing Flow Collection Using Data Encryption
NetFlow/IPFIX specifications have not considered privacy and confidentiality important. Exported flows are sent over unencrypted channels that prevent them to be exchanged on public networks unless techniques such as VPNs are used. Today encryption is no longer an option, and thus we have added encryption support in all our tools when flows are exchanged over […]
How We Managed to Turn ntopng Into a Cybersecurity Tool
Last year you have read how we have integrated Suricata support into ntopng. While an IDS is a good source of data, it is just a sensor, how has no knowledge of the big network picture including the network overview, past host/flow history and device type. In essence an IDS is a nice to have […]
Towards Traffic Behaviour Analysis: Introducing nDPI 3.2
This is to announce the new stable release of nDPI 3.2. The main trend of nDPI is to move from “simple” application protocol detection towards behavioral traffic interpretation. This has been implemented with the integration of modules for detecting attacks (e.g. SQL injections and XSS in HTTP) and behavioral indications on packet length/time/entropy as well […]
Call for Talks for NtopConf ’20
Update Due to SARS-Covid-19 Infection, the conference will be rescheduled once the health situation will improve and travelling will be safe. Please stay tuned by monitoring our blog as we will organize new interactive seminars and tutorials so that our community can meet virtually. Thank you! This year the annual ntop conference will take […]
Effective TLS Fingerprinting Beyond JA3
JA3 is a popular method to fingerprint TLS connections used by many monitoring tools and IDSs. JA3 focuses on encryption options specified during TLS connection setup to fingerprint the encryption library used by the application. Image courtesy of Cisco So in essence the same JA3 fingerprint will match multiple applications, making JA3 unreliable (when used […]
Towards ntopng v4: New User Interface Featuring Dark Theme
This February we’ll introduce ntopng v4 and we’re starting to write some blog posts to preview the new features. Let’s start with the user interface. Since v1 the UI has always been the same. People however asked us some more flexible layout where it is possible for instance to switch across network interfaces in a […]