ntopng Documentation

ntopng can be used in combination with other ntop tools. Documentation to use ntopng with other tools is the object of this section.

User's Guide

• What is ntopng
  • Releases and Features
  • Basic Concepts & Use Cases
• Available Versions & Licensing
  • ntopng Community
  • ntopng Professional
  • ntopng Enterprise M
  • ntopng Enterprise L
  • ntopng Enterprise L Bundle
  • Licensing
  • Purchasing a License
  • Generating the License Key
  • Generating The Key
  • Installing The Key
  • Example
  • Using the License Manager
  • Licenses on a Container
  • Models Comparison Table
• Installation
  • Installing on Linux
  • Installing on MacOS
  • Installing on Windows
  • Installing on FreeBSD
  • Installing on OPNsense/pfSense
  • Installing on a Container
  • Updating the Software on Linux
• How to Start ntopng
  • The ntopng Configuration File
  • Running ntopng as a Daemon
  • Running on Windows
• Command Line Options
  • Command Line Options
  • Configuration File Example
• User Interface Guide
  • Network Interface
  • System Interface
• Using ntopng with ntop Tools
  • Using ntopng with nProbe
  • Using ntopng with nProbe (Collector Mode)
  • Using ntopng with nProbe IPS
  • Using ntopng with nProbe Agent
  • Using ntopng with n2disk
• Industrial Monitoring
  • 1. ModbusTCP
  • 2. IEC 60870-5-104
• Quality of Experience (QoE)
  • 1. TCP-based Protocols
  • 2. UDP-based Protocols (QUIC and RTP)
• Operating ntopng on large networks
  • Red Badges
  • Packet Drops
  • Additional Tuning
• Flows Dump
  • ClickHouse (Flow Dump)
  • Kafka
  • Syslog
• Advanced Features
  • 1. Bridging and Traffic Policing
  • 2. IDS Acceleration
  • 3. Interfaces
  • 4. Live Pcap Download
  • 5. OEM Customizations
  • 6. Snapshots
  • 7. Syslog Log Ingestion
• Third-Party Integrations
  • OPNsense
  • pfSense
  • Suricata Integration
  • Suricata Acceleration
  • Kibana
  • Grafana
• Performance and Hardware Sizing
  • Hardware Sizing
  • Flow Collection Performance
• FAQ
  • Licenses
  • What to Save: Timeseries, Flows, pcaps
  • Maximum Number of Interfaces
  • Cannot Login into the GUI
  • Too many failed authentication attempts
  • Reset ntopng Preferences
  • How Can I Troubleshoot SNMP ?
  • How can I monitor the sites visited by an host?
  • How do I know who is using most of my bandwidth?
  • How can I associate an hostname to a certain category?
  • How can I estimate the disk space required by ntopng?
  • Cannot see data in Grafana
  • Permission denied errors

Developer's Guide

• Developers
  • Overview
    • Introduction
    • Capabilities
      • Monitoring an Analysis
      • Alerts Generation
      • Custom Pages
      • Timeseries
    • What is a Script
    • Availability
  • Alerts
    • Other Alerts (Interface, MAC, Local Networks, SNMP, System, User)
      • Create the check
      • Handles the default conf and GUI part
      • Trigger the alert
      • Handle Custom Changes on Various Situations
      • Alert ID
      • Create the Alert Script
    • Flow/Host Alerts
      • Checks
        • Check Execution
        • Check Configuration
      • Alerts
        • Identifying Alerts
        • Alert Formatting
        • Creating Flow Alerts
        • Creating Host Alerts
    • Syslog Checks
      • Scripts Location
      • Script API
      • Script Example
  • Endpoints
    • How They Work
    • Endpoints Definition
      • Endpoint Script
      • Preferences Definition
    • Example
    • Alert Format
  • Localization
    • Scripts and Localization
    • Internal Handling
      • Parameters
      • Examples
  • Timeseries Schemas
    • Schemas Definition
    • Schemas Usage
• API Documentation
  • RESTful API
    • 1. RESTful API v2 Specification
      • 1.1. Authentication
      • 1.2. Request Format
      • 1.3. Response Format
      • 1.4. API
        • 1.4.1. Interfaces
        • 1.4.2. Hosts
        • 1.4.3. Alerts
        • 1.4.4. Flows
        • 1.4.5. PCAP
        • 1.4.6. Users
        • 1.4.7. Infrastructures
        • 1.4.8. Health
        • 1.4.9. Configurations
        • 1.4.10. Vulnerability Scan
        • 1.4.11. Host
        • 1.4.12. SNMP
        • 1.4.13. All
        • 1.4.14. Observation Point
        • 1.4.15. Pools
        • 1.4.16. Traffic
        • 1.4.17. Timeseries
        • 1.4.18. Peers
        • 1.4.19. Top
        • 1.4.20. System
        • 1.4.21. Sites
        • 1.4.22. Maps
        • 1.4.23. User
        • 1.4.24. Checks
        • 1.4.25. Notification Endpoints
        • 1.4.26. Notification Recipients
        • 1.4.27. L7 Application Categories
        • 1.4.28. Configuration
        • 1.4.29. Active Monitoring
        • 1.4.30. Notifications
        • 1.4.31.
    • 2. Examples v2
      • 2.1. Interfaces
        • 2.1.1. Get Interface Data
        • 2.1.2. Get interface IP addresses
        • 2.1.3. Get L7 statistics for an interface
        • 2.1.4. Get actively monitored interfaces
      • 2.2. Hosts
        • 2.2.1. Get active hosts
        • 2.2.2. Get host data
        • 2.2.3. Get host custom data
        • 2.2.4. Get L7 statistics for a host
        • 2.2.5. Get host interfaces
      • 2.3. Flows
        • 2.3.1. Get flow counters for L4 protocols
        • 2.3.2. Get flow counters for L7 protocols
        • 2.3.3. Get active flows
        • 2.3.4. Get historical flows
      • 2.4. Alerts
        • 2.4.1. Get alerts timeseries
        • 2.4.2. Get alerts data
        • 2.4.3. Get alert severity constants
        • 2.4.4. Get alert type constants
        • 2.4.5. Get counters per severity
        • 2.4.6. Get counters per type
      • 2.5. L7 Application Protocols
        • 2.5.1. Get L7 application protocol constants
      • 2.6. L7 Application Categories
        • 2.6.1. Get L7 application category constants
      • 2.7. L4 Protocols
        • 2.7.1. Get L4 protocol constants
      • 2.8. Pools
        • 2.8.1. Add an Host Pool
        • 2.8.2. Edit an Host Pool
        • 2.8.3. Delete an Host Pool
        • 2.8.4. Get an Host Pool
        • 2.8.5. Get Members of an Host Pool
        • 2.8.6. Get All Pools of Any type
      • 2.9. SNMP
        • 2.9.1. Add an SNMP Device
        • 2.9.2. Change the Status of an SNMP Device Interface
      • 2.10. Misc
        • 2.10.1. Create a Session Cookie
    • 3. RESTful API v1 Specification
      • 3.1. Authentication
      • 3.2. Request Format
      • 3.3. Response Format
      • 3.4. API
        • 3.4.1. Interfaces
        • 3.4.2. Hosts
        • 3.4.3. Alerts
        • 3.4.4. Flows
        • 3.4.5. PCAP
        • 3.4.6. Users
        • 3.4.7. Infrastructures
        • 3.4.8. L4 Protocols
        • 3.4.9. L7 Application Protocols
        • 3.4.10. L7 Application Categories
        • 3.4.11. SNMP
        • 3.4.12. Pools
        • 3.4.13. Notification Recipients
        • 3.4.14. Notification Endpoints
        • 3.4.15. All
        • 3.4.16. Active Monitoring
        • 3.4.17. Notifications
        • 3.4.18.
    • 4. Examples v1
      • 4.1. Interfaces
        • 4.1.1. Get Interface Data
        • 4.1.2. Get interface IP addresses
        • 4.1.3. Get L7 statistics for an interface
        • 4.1.4. Get actively monitored interfaces
      • 4.2. Hosts
        • 4.2.1. Get active hosts
        • 4.2.2. Get host data
        • 4.2.3. Get host custom data
        • 4.2.4. Get L7 statistics for a host
        • 4.2.5. Get host interfaces
      • 4.3. Flows
        • 4.3.1. Get flow counters for L4 protocols
        • 4.3.2. Get flow counters for L7 protocols
        • 4.3.3. Get active flows
        • 4.3.4. Get historical flows
      • 4.4. Alerts
        • 4.4.1. Get alerts timeseries
        • 4.4.2. Get alerts data
        • 4.4.3. Get alert severity constants
        • 4.4.4. Get alert type constants
        • 4.4.5. Get counters per severity
        • 4.4.6. Get counters per type
      • 4.5. L7 Application Protocols
        • 4.5.1. Get L7 application protocol constants
      • 4.6. L7 Application Categories
        • 4.6.1. Get L7 application category constants
      • 4.7. L4 Protocols
        • 4.7.1. Get L4 protocol constants
      • 4.8. Pools
        • 4.8.1. Add an Host Pool
        • 4.8.2. Edit an Host Pool
        • 4.8.3. Delete an Host Pool
        • 4.8.4. Get an Host Pool
        • 4.8.5. Get Members of an Host Pool
        • 4.8.6. Get All Pools of Any type
      • 4.9. SNMP
        • 4.9.1. Add an SNMP Device
        • 4.9.2. Change the Status of an SNMP Device Interface
      • 4.10. Misc
        • 4.10.1. Create a Session Cookie
  • Lua API
    • 1. ntop Lua Object
      • 1.1. Cache API
        • getCache()
        • setCache()
        • delCache()
        • incrCache()
      • 1.2. Prefs API
        • setPref()
        • getPref()
        • getPrefs()
        • flushCache()
        • listIndexCache()
        • lpushCache()
        • rpushCache()
        • lpopCache()
        • rpopCache()
        • lremCache()
        • ltrimCache()
        • lrangeCache()
        • llenCache()
        • setMembersCache()
        • delMembersCache()
        • getMembersCache()
        • getHashCache()
        • setHashCache()
        • delHashCache()
        • getHashKeysCache()
        • getHashAllCache()
        • getKeysCache()
      • 1.3. Filesystem API
        • isdir()
        • mkdir()
        • notEmptyFile()
        • exists()
        • fileLastChange()
        • readdir()
        • rmdir()
        • dumpBinaryFile()
        • setDefaultFilePermissions()
        • deleteOldRRDs()
      • 1.4. Network API
        • httpGet()
        • httpPost()
        • postHTTPJsonData()
        • send_udp_data()
        • inet_ntoa()
        • networkPrefix()
        • httpRedirect()
        • httpPurifyParam()
        • getservbyport()
        • pingHost()
        • collectPingResults()
        • sendMail()
        • resolveHost()
        • snmpget()
        • snmpgetnext()
        • tcpProbe()
        • isIPv6()
      • 1.5. Users API
        • getUsers()
        • addUser()
        • deleteUser()
        • getAllowedNetworks()
        • resetUserPassword()
        • changeUserRole()
        • changeAllowedNets()
        • changeAllowedIfname()
        • changeUserLanguage()
        • changeUserHostPool()
        • isAllowedInterface()
        • isAllowedNetwork()
        • getNologinUser()
        • isAdministrator()
        • isLoginBlacklisted()
      • 1.6. Misc API
        • getDirs()
        • getInfo()
        • getUptime()
        • getHttpPrefix()
        • getRandomCSRFValue()
        • isShuttingDown()
        • getLocalNetworks()
        • addLocalNetwork()
        • setMacDeviceType()
        • reloadHostPools()
        • getNetworkNameById()
        • getNetworkIdByName()
        • getHostInformation()
        • systemHostStat()
        • syslog()
        • setLoggingLevel()
        • traceEvent()
        • verboseTrace()
        • gettimemsec()
        • getticks()
        • gettickspersec()
        • isLoginDisabled()
        • hasVLANs()
        • hasGeoIP()
        • isWindows()
        • msleep()
        • getMacManufacturer()
        • md5()
        • exec_sql_query()
        • resetStats()
        • isPro()
        • isEnterpriseM()
        • isEnterpriseL()
        • isPackage()
        • getStartupEpoch()
        • serviceRestart()
        • matchCustomCategory()
        • getTLSVersionName()
        • bitmapIsSet()
        • bitmapSet()
        • bitmapClear()
        • setnDPIProtoCategory()
        • getnDPIProtoCategory()
        • ptreeClear()
        • ptreeInsert()
        • ptreeMatch()
        • isDeadlineApproaching()
        • getDeadline()
        • speedtest()
    • 2. interface Lua Object
      • 2.1. Hosts API
        • getHostsInfo()
        • getLocalHostsInfo()
        • getRemoteHostsInfo()
        • getBroadcastDomainHostsInfo()
        • getGroupedHosts()
        • getHostInfo()
        • getHostCountry()
        • findHost()
        • findHostByMac()
        • resetHostStats()
        • deleteHostData()
        • setHostOperatingSystem()
        • getNumLocalHosts()
        • listHTTPhosts()
        • mdnsResolveName()
      • 2.2. Flows API
        • getFlowsInfo()
        • getFlowsStatus()
        • getGroupedFlows()
        • getFlowsStats()
        • getnDPIFlowsCount()
        • getFlowKey()
        • findFlowByTuple()
        • findFlowByKeyAndHashId()
        • dropFlowTraffic()
      • 2.3. Misc API
        • getIfNames()
        • getFirstInterfaceId()
        • getId()
        • select()
        • hasVLANs()
        • hasEBPF()
        • getActiveFlowsStats()
        • getMaxIfSpeed()
        • resetCounters()
        • resetStats()
        • getEndpoint()
        • isPacketInterface()
        • isDiscoverableInterface()
        • isBridgeInterface()
        • isPcapDumpInterface()
        • isView()
        • isViewed()
        • viewedBy()
        • isLoopback()
        • isRunning()
        • isIdle()
        • setInterfaceIdleState()
        • getStats()
        • getNetworksStats()
        • getNetworkStats()
        • getASesInfo()
        • getASInfo()
        • getCountriesInfo()
        • getVLANsList()
        • getVLANInfo()
        • getHostPoolsInfo()
        • resetPoolsQuotas()
        • getSFlowDevices()
        • getSFlowDeviceInfo()
        • captureToPcap()
        • isCaptureRunning()
        • stopRunningCapture()
        • getPodsStats()
        • getContainersStats()
      • 2.4. MACs API
        • getMacsInfo()
        • getMacInfo()
        • getMacHosts()
        • getMacManufacturers()
        • setMacOperatingSystem()
        • getMacDeviceTypes()
        • findMacPool()
        • resetMacStats()
        • deleteMacData()
      • 2.5. nDPI API
        • getnDPIProtoName()
        • getnDPIProtoId()
        • getnDPICategoryId()
        • getnDPICategoryName()
        • getnDPIProtoBreed()
        • getnDPIProtocols()
        • getnDPICategories()
      • 2.6. Dump API
        • liveCapture()
        • dumpLiveCaptures()
    • 3. Host Checks
      • 3.1. Operational Mode
      • 3.2. Script Example
      • 3.3. Host Object Methods
    • 4. Flow Checks
      • 4.1. Operational Mode
      • 4.2. Script Example
      • 4.3. Flow Object Methods
    • 5. Interface Checks
    • 6. Network Checks
      • getNetworkStats()
  • Python API
    • Prerequisites
    • Installation
    • Examples
    • API
      • Ntopng
      • Ntopng
        • Ntopng.get_alert_severities()
        • Ntopng.get_alert_types()
        • Ntopng.get_historical_interface()
        • Ntopng.get_host_interfaces_list()
        • Ntopng.get_interface()
        • Ntopng.get_interfaces_list()
      • Interface
      • Interface
        • Interface.get_active_flows_paginated()
        • Interface.get_active_hosts()
        • Interface.get_active_l4_proto_flow_counters()
        • Interface.get_active_l7_proto_flow_counters()
        • Interface.get_address()
        • Interface.get_alert_severities_enum()
        • Interface.get_alert_types_enum()
        • Interface.get_alerts_counter_per_severity()
        • Interface.get_alerts_counter_per_type()
        • Interface.get_all_alerts()
        • Interface.get_broadcast_domains()
        • Interface.get_data()
        • Interface.get_dscp_stats()
        • Interface.get_historical()
        • Interface.get_host()
        • Interface.get_host_data()
        • Interface.get_l4_protocols_enum()
        • Interface.get_l7_application_category_enum()
        • Interface.get_l7_application_proto_enum()
        • Interface.get_l7_stats()
        • Interface.get_top_local_talkers()
        • Interface.get_top_remote_talkers()
      • Host
      • Host
        • Host.get_active_flows_paginated()
        • Host.get_dscp_stats()
        • Host.get_host_data()
        • Host.get_l7_stats()
      • Historical
      • Historical
        • Historical.get_active_monitoring_alerts()
        • Historical.get_alert_severity_counters()
        • Historical.get_alert_type_counters()
        • Historical.get_alerts()
        • Historical.get_alerts_stats()
        • Historical.get_flow_alerts()
        • Historical.get_flow_alerts_stats()
        • Historical.get_flows()
        • Historical.get_host_alerts()
        • Historical.get_host_timeseries()
        • Historical.get_host_timeseries_stats()
        • Historical.get_host_top_protocols()
        • Historical.get_interface_alerts()
        • Historical.get_interface_timeseries()
        • Historical.get_interface_timeseries_stats()
        • Historical.get_mac_alerts()
        • Historical.get_network_alerts()
        • Historical.get_snmp_alerts()
        • Historical.get_system_alerts()
        • Historical.get_timeseries()
        • Historical.get_timeseries_metadata()
        • Historical.get_timeseries_stats()
        • Historical.get_top_conversations()
        • Historical.get_topk_flows()
        • Historical.get_user_alerts()
  • Timeseries API
    • Basic Concepts
      • Schema
      • Schema Name
      • Metric Types
      • Driver
    • Exporting Data
    • Modify an existing Schema
    • Adding New Metrics
      • General Overview
        • Case 1: Adding metrics via the ::lua method
        • Case 2: Adding metrics inside a TimeseriesPoint
        • Case 3: Adding metrics for Lua only objects
      • Custom Timeseries Scripts
        • Structure of Custom Timeseries Scripts
        • Example
      • Charting New Metrics
    • Accessing Metrics
      • Interface Metrics
      • Host Metrics
    • Metrics
      • Interface Metrics
      • Device Metrics
      • Host Metrics
      • Subnet Metrics
      • VLAN Metrics
      • SNMP Interface Metrics
      • Traffic Profile Metrics
      • Host Pool Metrics
      • ASN Metrics
      • Country Metrics
      • Flow Device Metrics
      • Event Exporter Metrics
      • Container Metrics
      • POD Metrics
      • Process Metrics
      • System Metrics
    • Querying Data
      • Number Of Hosts In The Last Minute
      • Traffic On An Interface In The Last Minute
      • Traffic On An Interface In The Last Hour, Per Minute
      • Traffic On An Interface In The Last Hour
    • ts_utils API
    • Driver Implementation
      • append()
      • query()
      • queryTotal()
      • listSeries()
      • topk()
      • getLatestTimestamp()
      • deleteOldData()
      • setup()
  • Alerts API
    • Engaged Alerts
      • alert_api API
        • Trigger alert
        • Metadata
  • Recording API
    • recording_utils API
      • isSupportedZMQInterface()
      • getZMQProbeAddr()
      • isSupportedInterface()
      • isExternalProvidersReminderDismissed()
      • dismissExternalProvidersReminder()
      • isExtractionAvailable()
      • getN2diskInfo()
      • setLicense()
      • getExtInterfaces()
      • getPcapPath()
      • volumeInfo()
      • storageInfo()
      • createConfig()
      • isEnabled()
      • isExtractionEnabled()
      • isActive()
      • isExtractionActive()
      • parse_proc_stats()
      • stats()
      • smartStats()
      • getCurrentTrafficRecordingProviderTimelinePath()
      • getTimelineByInterval()
      • checkExtraction()
      • restart()
      • stop()
      • log()
      • isDataAvailable()
      • getJobFiles()
      • deleteJob()
      • deleteAndStopAllJobs()
      • extractionJobsInfo()
      • getExtractionJobs()
      • stopJob()
      • scheduleExtraction()

Other Products

• nProbe
• nProbe Cento
• n2disk
• nDPI
• PF_RING
• nEdge
• nScrub
• nBox
• nTap
• License Manager