ntopng

Traditionally flow-based tools are based on the 5-tuple attributes (source and destination IP, source and destination port and the protocol field). Often they are complemented with additional attributes such as VLAN or Tunnel Id in order to avoid mixing in the same flow packets that belong to different communications.  The above picture shows the 5-tuple key in the live flows window. Looking at flows using the 5-tuple makes sense if we want to understand what it is happening at the individual flow level, but it makes difficult to understand the …

ntop tools range from packet capture, traffic analysis and processing, and sometimes it is not easy to keep up on product updates as well master all the tools. This has been the driving force for organising ntop professional training: . This is to announce that in May we have scheduled the next ntop Professional Training session. It will take place online (Microsoft Teams) on 2nd, 4th, 9th, 11th 16th, 23rd of May, 2023 at 3.00 PM CET (9.00 AM EDT). Training will be held in English language and each session …

Almost 3 years ago we introduced Active Monitoring support in ntopng. This allows you to monitor the infrastructure and make sure that all systems are operational. In fact ntopng can continuously monitor hosts in your network by periodically running different active measurements including: ICMP, which measures the RTT (Round Trip Time). Continuous ICMP, which evaluates network reachability and service availability. Speedtest, which estimates the Internet bandwidth and latency contacting a speedtest server. HTTP(S), which checks the HTTP/HTTPS availability of web servers. Throughout, which tests the throughput contacting an HTTP server. As a …

This is to invite you to attend a webinar about ntopng 5.6. This webinar will walk you through the innovations introduced with ntopng 5.6 stable release that we introduced at the end of January. You can learn the new features and get acquainted with the changes that have been introduced in the web interface. Finally, we will introduce a completely new release of the nBox GUI that you can use to manage installations of ntop applications. Below you can find the video of the webinar.   Enjoy ! …

Yesterday we have presented at FOSDEM in the network devroom we headed, a talk about ntopng. Below you can find the video of the presentation and the presentation slides. Enjoy ! …

This is to announce the availability of ntopng 5.6 stable release that brings several additions and improvements: We have started to introduce responsiveness in ntopng GUI by means of VueJS. All timeseries and historical pages are now rewritten to take advantage of modern web technologies. You can now compare timeseries across hosts, devices, or anything that is a timeseries created by ntopng. In addition to the traditional/efficient C++ alerting subsystems, we have introduced a Lua API for developing new checks in seconds. This is a simple way to quickly prototype …

Not all ntop users know that ntopng natively implements multitenancy support. Namely you can use ntopng to collect and analyse traffic from multiple users, and show to each user its own traffic, hiding all the rest. All you need to do is very simple Start ntopng and configure it to receive monitored traffic. You can do it via flows or packets. Create ntopng users and for each user specify the traffic restrictions. ntopng will honour all this. Let’s now see this in detail.   Flow and Packet Collection ntopng allows …

For years ntopng has listed flows in a tabular view. Our users are used to it, and over time we have added new features and filtering capabilities. What we have not yet done, is rethink how flows are reported. Reworking the ntopng GUI is something we will tackle in the next major ntopng release, but for the time being we have started with tiny changes that should ease the process of understanding what is happening. For this reason the flow page has been extended with a new analysis menu entry. …

Most programmers and network/security administrators are familiar with the Python language. As from time to time we receive requests from our users for creating custom reports, or extracting other type of data (e.g. alerts or timeseries) from ntopng, we have decided to create a Python API for ntopng. Such API allows developers to extract data from ntopng similar to what other Python APIs do (e.g. pyshark for Wireshark). Using this API you can Read host statistics Get the active flows list Query network interface stats Search historical flows Those familiar …