The promise of filtering packets in hardware is not new. Unfortunately filtering network adapters are pretty expensive, not to mention if they run at 10 Gbit. Furthermore many commercial FPGA-based NICs feature hardware packet filtering, but often require card reconfiguration whenever flow rules are added/removed and have a limited set of rules that can be […]
PF_RING/TNAPI-based 10 Gbit Network Monitoring on Multicore Systems
Over the past couple of years, PF_RING has been enhanced to exploit innovations in computer hardware. In particular the availability of multicore systems and efficient controllers such as those introduced by Intel with the i7 family (in particular Nehelem and Sandy Bridge) has allowed applications to spread their load across all available processors (24 cores […]
Twelve years of ntop
The Internet is pretty volatile. As new information become available, the old one disappears. Sometimes we have to look back and see what’s happened in the past years. Shall you be interested in seeing how ntop changed in the past twelve years, you can have a look at this URL, that has several snapshots of […]
ntop on Ubuntu
The ubuntu community has published a post that explains how to compile/use ntop on Ubuntu. This is the URL of the post.
Using Genetic Algorithms for Network Intrusion Detection and Integration into nProbe
Conference: OSCON 2010 Presentation Link: Ignite Track Presented by: Brian Lavender SNORT is popular Network Intrusion Detection System (NIDS) tool that currently uses a custom rule based system to identify attacks. This presentation emphasizes on writing the algorithm to write generate the rules through GA and the integration of them into nProbe, a similar network monitoring […]
Released ntop 4.0
After a few years of work, this is to announce the availability of ntop 4.0. Major changes include: Partially rewritten ntop processing engine to address reliability and performance Several bugs and stability issues fixed Added better support for IPFIX and NetFlow v9, as well as ntop PEN (Private Enterprise Number) Added support for Cisco ASA […]
Creating 3D Maps using ntop
Since some time ntop support geolocation. Now courtesy of Ronald W. Henderson it can also display mercator maps and natively integrate with tools such as Google Earth. These ntop extensions are part of the NST (Network Security Toolkit) toolkit. For more information please visit the NST Wiki page.
Modern Packet Capture and Analysis: Multi-Core, Multi-Gigabit, and Beyond
Sometimes people ask me a tutorial about PF_RING. Last year I have given a tutorial about it at the IM 2009 conference. I think that everyone interested in using PF_RING for going beyond packet capture acceleration should read this set of slides I used for the tutorial. Today the cost of packet capture is limited […]
Interview with Luca Deri
In this video Luca presents the ntop project and gives an outlook of future activities. It was presented during the OSS conference that took place last May in Bolzano. Finally this short interview gives an idea of how ntop can benefit when integrated with commercial applications and vendors such as Würth-Phoenix.
nProbe with FastBit database: an innovative flows storage solution
nProbe, acronym for NetFlow probe, is an open-source probe that supports both NetFlow and sFlow collection. It has been designed to keep up with Gigabit speeds on commodity hardware and it can be used for capturing packets and analyzing networks at full speed with no (or very moderate) packet loss using PF_RING. Each captured packet […]