ntopng Documentation

ntopng is a passive network monitoring tool focused on flows and statistics that can be obtained from the traffic captured by the server.

• What is ntopng
  • Installation
  • Licensing
    • Applying the License
• Basic Concepts
  • Network Interfaces
  • Hosts
    • Local Hosts
  • Host Pools
  • Alerts
    • Events
    • User-Configurable Thresholds
    • Events vs. Thresholds
    • User Activities
    • Severity
    • Entities
    • Type
    • Misbehaving Flows
    • Third-Party Endpoints
  • Timeseries
    • RRD Driver
    • InfluxDB Driver
    • Timeseries Configuration
  • Local Broadcast Domain
  • Disk Space Requirements
• How to Start ntopng
  • The ntopng Configuration File
  • Running ntopng as a Daemon
    • Daemon Configuration File
    • Automatic Daemon Startup on Boot
    • Daemon Control
    • Running Multiple Daemons
  • Running on Windows
    • Specify Monitored Interfaces
    • Execution as a Windows Service
• Command Line Options
• The ntopng Web GUI
  • 1. Home Menu
    • 1.1. About ntopng
    • 1.2. ntop Blog
    • 1.3. Report an Issue
    • 1.4. Dashboard
  • 2. Dashboard
    • 2.1. Dashboard in the Community Version
    • 2.2. Dashboard in the Professional Version
  • 3. Historical Charts
    • 3.1. Tabular View
  • 4. Report
    • 4.1. Activity Report
  • 5. Flows
    • 5.1. Application
    • 5.2. Layer-4 Protocol (L4 Proto)
    • 5.3. Client
    • 5.4. Server
    • 5.5. Duration
    • 5.6. Breakdown
    • 5.7. Actual Throughput
    • 5.8. Total Bytes
    • 5.9. Info
  • 6. Applications and Categories
    • 6.1. Category
    • 6.2. Custom Applications
    • 6.3. Custom Categories
    • 6.4. Adding a Rule from a Flow
  • 7. Hosts
    • 7.1. All Hosts
    • 7.2. Host Pools
    • 7.3. Networks
    • 7.4. Autonomous Systems
    • 7.5. Countries
    • 7.6. Operating Systems
    • 7.7. HTTP Servers (Local)
    • 7.8. Top Hosts (Local)
    • 7.9. Geo Map
    • 7.10. Tree Map
    • 7.11. Local Flow Matrix
  • 8. Host Details
    • 8.1. Home
    • 8.2. Traffic
    • 8.3. Packets
    • 8.4. Ports
    • 8.5. Peers
    • 8.6. Protocols
    • 8.7. DNS
    • 8.8. HTTP
    • 8.9. Sites
    • 8.10. Flows
    • 8.11. SMNP
    • 8.12. Talkers
    • 8.13. Geography
    • 8.14. Alerts Configuration
    • 8.15. Statistics
  • 9. Interfaces
    • 9.1. Home
    • 9.2. Packets
    • 9.3. Protocols
    • 9.4. ICMP
    • 9.5. ARP
    • 9.6. Statistics
    • 9.7. Traffic Profiles (Professional Version)
    • 9.8. Settings
    • 9.9. Host Pools
    • 9.10. DHCP Range
  • 10. ntopng Settings
    • 10.1. Manage Users
    • 10.2. Preferences
    • 10.3. Manage Stored Data
    • 10.4. Backup Configuration
    • 10.5. Restore Configuration
  • 11. Administration
  • 12. Alerts
    • 12.1. Alert Endopints
  • 13. Host Search
  • 14. Storage Monitor
• Using ntopng with nProbe
  • Exported Flow Fields
  • Collecting from Multiple Exporters
  • Using Behind a Firewall
  • Data Encryption
  • Quick Start
• Using ntopng with nProbe Agent
  • Use Cases
    • Trace-Back Users and Processes Behind Network Activities
    • Per-Container and Per-POD Network Activity and Performance Indicators
• Remote Assistance
  • Remote Assistance Status
  • Security Considerations
• Continuous Traffic Recording
  • Enabling Traffic Recording
    • External Traffic Recording Providers
  • Traffic Extraction
    • REST API
  • ZC/FPGA Support
• Historical Flows
  • Enabling Flow Dump
  • Browsing Flows
  • Exporting Flows
  • Retention Time
• Advanced Features
  • 1. User Authentication
    • 1.1. Local Authentication
    • 1.2. LDAP Authentication
    • 1.3. RADIUS Authentication
    • 1.4. HTTP Authentication
    • 1.5. Unable to Login
  • 2. SNMP
  • 3. Icinga2 Integration
    • 3.1. Plugin Installation and Configuration
    • 3.2. Example
  • 4. sFlow/NetFlow collection
  • 5. Physical Interfaces Aggregation: Interface Views
  • 6. Interfaces Disaggregation
    • 6.1. Dynamic Disaggregation
    • 6.2. Custom Disaggregation
  • 7. Traffic Profiles
    • 7.1. Realtime Profiles
    • 7.2. Historical Profiles Statistics
  • 8. Device Protocols
  • 9. Category Lists / Blacklists
  • 10. Bridging and Traffic Policing
  • 11. Flows Dump
    • 11.1. MySQL
    • 11.2. MySQL Performance
    • 11.3. ElasticSearch
    • 11.4. Logstash
  • 12. Live Pcap Download
  • 13. Suricata Integration
    • 13.1. Flows Export
    • 13.2. Syslog Configuration
    • 13.3. Run Suricata
    • 13.4. ntopng Configuration
  • 14. Additional ntopng Features
• Operating ntopng on large networks
  • Red Badges
  • Packet Drops
  • Additional Tuning
• FAQ
  • Cannot Login into the GUI
  • Too many failed authentication attempts
• Reset ntopng Preferences
  • How can I monitor the sites visited by an host?
  • How do I know who is using most of my bandwidth?
  • How can I associate an hostname to a certain category?
  • How can I estimate the disk space required by ntopng?
  • Cannot see data in Grafana
  • Permission denied errors
• Plugins
  • Overview
    • 1. Introduction
    • 2. Examples
  • Writing Plugins
    • 1. Structure
    • 2. Alert Definitions
    • 3. Flow Definitions
    • 4. User Scripts
    • 5. Localization
    • 6. Web UI
• API Documentation
  • RESTful API
    • 1. RESTful API Specification
    • 2. Examples
  • Lua C API
    • 1. ntop
    • 2. interface
    • 3. Flow API
  • Timeseries API
    • Basic Concepts
    • Exporting Data
    • Modify an existing Schema
    • Adding New Metrics
    • Accessing Metrics
    • Metrics
    • Querying Data
    • ts_utils API
    • Driver Implementation
  • User Scripts API
    • Types Definition
    • Scripts Structure
    • Flow Scripts
    • Traffic Element Scripts
    • Alert Scripts
    • Syslog Scripts
  • Alerts API
    • Engaged Alerts
  • Recording API
    • recording_utils API