ntop

Hardware Traffic Duplication on Intel Adapters Using PF_RING
Those of you who are familiar with kernel-bypass drivers like PF_RING ZC know that it is not possible to run multiple applications on top of the same Network interface and capture the same traffic twice. This is the case of Intel and most FPGA adapters. In fact, since the application takes full control of the adapter and configures it to copy packets directly to the application’s memory in hardware, access to the device must be exclusive. This unless the adapter natively support multiple consumers: this is the case of Mellanox/NVIDIA  and …
ntop

The Brand New nBox UI is Out
As announced during the last ntop Webinar, the new nBox UI has been released! What is nBox UI? nBox UI is a web-based User Interface that simplifies the ntop’s software configurations (ntopng, nProbe, nProbe Cento, n2disk, …), assisting with complex things such as creating configuration files and managing the services and let you focus on playing with the applications. nBox UI also helps you manage the box, with the ability to configure the box connectivity, users, etc. nBox UI is in practice what we use to build our nBox Recorder …
ntopng

ntop Webinar: Introduction to ntopng 5.6 and the New nBox UI
This is to invite you to attend a webinar about ntopng 5.6. This webinar will walk you through the innovations introduced with ntopng 5.6 stable release that we introduced at the end of January. You can learn the new features and get acquainted with the changes that have been introduced in the web interface. Finally, we will introduce a completely new release of the nBox GUI that you can use to manage installations of ntop applications. Below you can find the video of the webinar.   Enjoy ! …
ntopng

Introducing ntopng 5.6: New Reports and Cybersecurity Indicators, Kafka, Lua/Python API, Flow Collection Clustering
This is to announce the availability of ntopng 5.6 stable release that brings several additions and improvements: We have started to introduce responsiveness in ntopng GUI by means of VueJS. All timeseries and historical pages are now rewritten to take advantage of modern web technologies. You can now compare timeseries across hosts, devices, or anything that is a timeseries created by ntopng. In addition to the traditional/efficient C++ alerting subsystems, we have introduced a Lua API for developing new checks in seconds. This is a simple way to quickly prototype …
ntop

Introducing PF_RING 8.4: Zero-Copy Promisc Capture on Virtual Functions
This is to announce a new PF_RING release 8.4 ! This stable release adds zero-copy support for a new range of (virtual) adapters from Intel: the iavf-zc driver can be used to capture traffic from i40e (X710/XL710) and ice (E810) Virtual Functions. This new driver paves the way for new packet capture architectures as it enables high-speed promiscuous capture on Virtual Functions by leveraging on the SR-IOV trust mode available on Intel X710/XL710 adapters. It is now possible for instance to capture all traffic hitting the physical interface from multiple …
nDPI

Welcome to nDPI 4.6: code fuzzing, new protocol and flow risks
This is to announce the release of nDPI 4.6 that introduces various improvements with respect to the previous release. Many things changed in this release in terms of number of protocols and robustness thanks to code fuzzing introduced in this release. nDPI now natively supports 332 protocols and 50 flow risks, this in addition to protocols that can be configured using the protocol file. Protocol metadata extraction has been improved in various protocols as well DGA detection in host names. Below you can find the complete changelog. Enjoy !   …
nProbe

nProbe 10.2 is Available: Redesigned Kafka Export, nTap and Google Cloud Support
Today we announce the availability of nProbe 10.2 that features native nTap support for generating flows from remote devices, and redesigned Kafka support for both flow export and communication with ntopng. With this respect, the new –ntopng <URL> command line option will replace in the future –zmq as it allows to both specify if ZMQ or Kafka is used to communicate with ntopng (i.e. “–ntopng zmq://192.168.1.10:1234” is the new syntax that replaces “–zmq tcp://192.168.1.10:1234”). In this release nProbe also supports exports to Google Pub/Sub for implementing a scalable datalake. Finally, …
ntopng

Using Multitenancy in ntopng
Not all ntop users know that ntopng natively implements multitenancy support. Namely you can use ntopng to collect and analyse traffic from multiple users, and show to each user its own traffic, hiding all the rest. All you need to do is very simple Start ntopng and configure it to receive monitored traffic. You can do it via flows or packets. Create ntopng users and for each user specify the traffic restrictions. ntopng will honour all this. Let’s now see this in detail.   Flow and Packet Collection ntopng allows …
ntopng

Rethinking Flow Visualisation in ntopng
For years ntopng has listed flows in a tabular view. Our users are used to it, and over time we have added new features and filtering capabilities. What we have not yet done, is rethink how flows are reported. Reworking the ntopng GUI is something we will tackle in the next major ntopng release, but for the time being we have started with tiny changes that should ease the process of understanding what is happening. For this reason the flow page has been extended with a new analysis menu entry. …
nProbe

Scaling Up: How To Collect, Analyse, and Store Flows at Scale (100 Gbit+)
Most ntop tools such as nProbe cento and n2disk have been designed to run at high speed (today we consider 100 Gbit a high-speed link). ntopng instead has to perform many activities including behavioral traffic analysis that makes it unable to process traffic well above 10 Gbit. In this case you can use nProbe Cento to send ntopng (preprocessed) flows and you can monitor 100 Gbit networks without dropping a single packet. In the above picture ntopng can handle 25k-50k flows/sec per interface (the exact figure depends on the hardware …
ntopng

Using Python (including Jupyter Notebook) with ntopng
Most programmers and network/security administrators are familiar with the Python language. As from time to time we receive requests from our users for creating custom reports, or extracting other type of data (e.g. alerts or timeseries) from ntopng, we have decided to create a Python API for ntopng. Such API allows developers to extract data from ntopng similar to what other Python APIs do (e.g. pyshark for Wireshark). Using this API you can Read host statistics Get the active flows list Query network interface stats Search historical flows Those familiar …

High-performance network traffic monitoring and analysis tools.

Explore
Newsletter
Subscribe