nDPI

Released nDPI 1.5
Today we have have released nDPI 1.5. The main changes include: Support of additional protocols such as Redis, ZeroMQ, Collectd, Megaco. Fixed bugs in existing protocol dissectors and refreshed protocols that changed since the previous release (e.g Skype that is a real moving target). Major improvements of the sample ndpiReader application: Added 10 Gbit DNA/ZC support when capturing live traffic. Added ability to produce JSON reports when reading pcap file traces. Added new protocol encapsulations such as MPLS, PPPoE. Added new protocol/packets statistics (e.g. Ethernet statistics). Fixed bugs when handling IPv6 packets. Introduced …
ntop

Mini-Tutorial: Fresh Install of ntopng on Centos 7
IMPORTANT: This post contains outdated information. See README.compilation for updated instructions. This is how to compile ntopng in a fresh centos 7 x64 installation For the impatient: # yum install -y subversion autoconf automake make gcc libpcap-devel libxml2-devel sqlite-devel libtool glib2-devel gcc-c++ $ svn co https://svn.ntop.org/svn/ntop/trunk/ntopng $ ./autogen.sh $ ./configure $ make $ ./ntopng --help ntopng x86_64 v.1.1.4 (r7865) - (C) 1998-14 ntop.org <snip> Step by step description Pull the source code from the ntop svn repository. To do this, you need first to install subversion using yum as follows $ …
Announce

Introducing ntop Video Tutorials
We have been asked many times to create some videos that introduce novice users to our tools and products. Although English is not our mother tongue, we have decided to take this request seriously and start uploading them on the ntop channel. This said we need your help and we hope that you will contribute by sharing your videos with the whole community. …
ntopng

Creating a hierarchical cluster of ntopng instances
As you know via ZMQ you can use ntopng as collector for nProbe instances. You can decide to merge all probes into one single ntopng interface (i.e. all the traffic will be merged and mixed) or to have an interface per probe. Example: Start the remote nProbe instances as follows [host1] nprobe --zmq "tcp://*:5556" -i ethX [host2] nprobe --zmq "tcp://*:5556" -i ethX [host3] nprobe --zmq "tcp://*:5556" -i ethX [host4] nprobe --zmq "tcp://*:5556" -i ethX If you want to merge all nProbe traffic into a single ntopng interface do: ntopng -i tcp://host1:5556,tcp://host2:5556,tcp://host3:5556,tcp://host4:5556 If you want to …
n2disk

Visualising n2disk Captured Traffic using CloudShark
Introduction ntop users are familiar with n2disk and the nBox web interface that ease its use. As you know, the nBox includes a small web-based tool that allows you to preview pcap contents.  This tool is good for having an idea of what a pcap contains but it not a fully fledged application. On the other hand CloudShark is the leading application for analysing traffic traces, and thus we have decided to leverage on it for offering the cheapest and most powerful solution for traffic-to-disk and pcap visualisation on the cloud. …
Announce

ntop at SHARKFEST’14
The ntop core team will be at the SHARKFEST in June, the annual 4-day conference, focused on sharing knowledge, experience and best practices among Wireshark developers and users. Luca Deri will be among the speakers talking about “Monitoring Mobile Network Traffic (3G/LTE)“. Join us June 16th through June 20th at the Dominican University of California in San Rafael, CA! …
n2disk

Introducing on-the-fly 10 Gbit pcap compression on n2disk
Compressing pcap produced by n2disk is a good idea for a few reasons: It allows disk space to be saved as compressed data takes less space on disk. It enables the creation of cheaper packet recorder appliances as with the same hardware you can save more data onto disk and thus in some problem domain you can double the capacity of your existing box. As n2disk leaves some space in CPU cycles (in particular when used on top of Napatech adapters) we have room to compress and index packets on-the-fly …
PF_RING

Not All Servers Are Alike (With PF_RING ZC/DNA) – Part 3
We have already discussed on the first and second part of this post some common issues that might be encountered while doing high-performance packet processing. Most of the problems are related to multi-CPU servers (NUMA) and memory configuration. We have spent a lot of time creating the nBox web-GUI that is not just a graphical interface, but it is a way to automatically configure ntop applications as well report common configuration issues. For those who want to live without it, we have some additional lessons learnt to share. Lesson 1: Make sure all …
PF_RING

Migrating from DNA/Libzero to PF_RING ZC
Since the introduction of PF_RING ZC (Zero Copy), we have received many inquiries about migrating from DNA/LibZero to ZC. Said that at the moment we do not plan to discontinue DNA/LibZero, we would like to summarise the differences and ease you the migration: In PF_RING 5.x (pre-ZC) there were two driver families: DNA-drivers and PF_RING-aware drivers. With the former you could operate at line-rate with DNA/LibZero, with the latter the speed was limited and you were not able to use the packets from LibZero. In ZC, there is one driver family …
PF_RING

Introducing PF_RING ZC (Zero Copy)
NOTE: The new PF_RING home is hereAfter almost 18 months of development, we are pleased to announce the release of PF_RING ZC (Zero Copy). Based on the lessons learnt with DNA and libzero, we have decided to redesign from scratch a new consistent zero-copy API that implements popular network patterns. The goal is to offer you a simple API, able to deliver line-rate performance (from 1 to multi-10 Gbit) to network application developers. We have hidden you all the internals and low-level details, in order to create a developer-centric API …
Announce

Accurate 10 Gbit Traffic Reply Using disk2n
n2disk is a software application that allows to dump traffic to disk at line rate (10 Gbit full duplex) with high-accurate timestamps. This both using networks cards featuring hardware timestamps and also with software timestamps. Most companies focus just on capture to disk, whereas we believe that it is also compulsory  to provide solutions for traffic replay by exploiting these high-accurate timestamps that have been saved on pcap files. This activity is quite challenging. Replying traffic with high-precision timestamps it is necessary for instance whenever we want to reproduce exactly the …

High-performance network traffic monitoring and analysis tools.

Explore
Newsletter
Subscribe