ntopng Documentation

ntopng is a passive network monitoring tool focused on flows and statistics that can be obtained from the traffic captured by the server.

• What is ntopng
  • Installation
    • Installing on Linux
    • Installing on MacOS
    • Installing on Windows
  • Licensing
  • Geolocation
• Basic Concepts
  • Network Interfaces
  • System Interface
  • Hosts
    • Local Hosts
  • Host Pools
  • Alerts
    • Events
    • User-Configurable Thresholds
    • Events vs. Thresholds
    • User Activities
    • Severity
    • Entities
    • Type
    • Misbehaving Flows
    • Third-Party Endpoints
  • Timeseries
    • RRD Driver
    • InfluxDB Driver
    • Timeseries Configuration
  • Plugins and User Scripts
  • Local Broadcast Domain
  • Disk Space Requirements
• How to Start ntopng
  • The ntopng Configuration File
  • Running ntopng as a Daemon
    • Daemon Configuration File
    • Automatic Daemon Startup on Boot
    • Daemon Control
    • Running Multiple Daemons
  • Running on Windows
    • List Monitored Interfaces
    • Manipulating ntopng Windows Service Settings
    • Troubleshooting
• Command Line Options
• The ntopng Web GUI
  • Home Menu
    • About ntopng
    • ntop Blog
    • Report an Issue
    • Dashboard
  • Dashboard
    • Dashboard in the Community Version
    • Dashboard in the Professional Version
  • Historical Charts
    • Tabular View
  • Report
    • Activity Report
  • Flows
    • Application
    • Layer-4 Protocol (L4 Proto)
    • Client
    • Server
    • Duration
    • Breakdown
    • Actual Throughput
    • Total Bytes
    • TLS Information
    • SSH Signature
    • Info
  • User Scripts
    • Configurations
  • Applications and Categories
    • Category
    • Custom Applications
    • Custom Categories
    • Adding a Rule from a Flow
  • Hosts
    • All Hosts
    • Host Pools
    • Networks
    • Autonomous Systems
    • Countries
    • Operating Systems
    • HTTP Servers (Local)
    • Top Hosts (Local)
    • Geo Map
    • Tree Map
    • Local Flow Matrix
  • Host Details
    • Home
    • Traffic
    • Packets
    • Ports
    • Peers
    • Protocols
    • TLS
    • SSH
    • DNS
    • HTTP
    • Sites
    • Flows
    • SMNP
    • Talkers
    • Geography
    • Alerts Configuration
    • Statistics
  • Interfaces
    • Home
    • Packets
    • Protocols
    • ICMP
    • ARP
    • Statistics
    • Traffic Profiles (Professional Version)
    • Settings
    • Host Pools
    • DHCP Range
  • ntopng Settings
    • Manage Users
    • Preferences
    • Manage Data
    • Backup Configuration
    • Restore Configuration
  • Administration
  • Alerts
    • Alert Endopints
  • Host Search
  • Storage Monitor
• Active Monitoring
  • RTT Monitor
    • RTT Alerts
    • RTT Timeseries
  • SNMP
    • LLDP
• Self Monitoring
  • Internals
    • Hash Tables
    • Periodic Activities
    • User Scripts
  • Redis Monitor
  • InfluxDB Monitor
• Using ntopng with nProbe
  • Exported Flow Fields
  • Collecting from Multiple Exporters
  • Using Behind a Firewall
  • Data Encryption
  • Quick Start
• Using ntopng with nProbe Agent
  • Use Cases
    • Trace-Back Users and Processes Behind Network Activities
    • Per-Container and Per-POD Network Activity and Performance Indicators
• Remote Assistance
  • Remote Assistance Status
  • Security Considerations
• Continuous Traffic Recording
  • Enabling Traffic Recording
    • External Traffic Recording Providers
  • Traffic Extraction
    • REST API
  • ZC/FPGA Support
• Historical Flows
  • Enabling Flow Dump
  • Browsing Flows
  • Exporting Flows
  • Retention Time
• Advanced Features
  • 1. User Authentication
    • 1.1. Local Authentication
    • 1.2. LDAP Authentication
    • 1.3. RADIUS Authentication
    • 1.4. HTTP Authentication
    • 1.5. Unable to Login
  • 2. Icinga2 Integration
    • 2.1. Plugin Installation and Configuration
    • 2.2. Example
  • 3. sFlow/NetFlow collection
  • 4. Physical Interfaces Aggregation: Interface Views
  • 5. Interfaces Disaggregation
    • 5.1. Dynamic Disaggregation
    • 5.2. Custom Disaggregation
  • 6. Traffic Profiles
    • 6.1. Realtime Profiles
    • 6.2. Historical Profiles Statistics
  • 7. Device Protocols
  • 8. Category Lists / Blacklists
  • 9. Bridging and Traffic Policing
  • 10. Flows Dump
    • 10.1. MySQL
    • 10.2. MySQL Performance
    • 10.3. ElasticSearch
    • 10.4. Logstash
  • 11. Live Pcap Download
  • 12. Suricata Integration
    • 12.1. Flows Export
    • 12.2. Syslog Configuration
    • 12.3. Run Suricata
    • 12.4. ntopng Configuration
  • 13. Additional ntopng Features
• Operating ntopng on large networks
  • Red Badges
  • Packet Drops
  • Additional Tuning
• FAQ
  • Cannot Login into the GUI
  • Too many failed authentication attempts
• Reset ntopng Preferences
  • How can I monitor the sites visited by an host?
  • How do I know who is using most of my bandwidth?
  • How can I associate an hostname to a certain category?
  • How can I estimate the disk space required by ntopng?
  • Cannot see data in Grafana
  • Permission denied errors
• Developing Plugins
  • Overview
    • Introduction
    • Capabilities
    • What is a Plugin
    • Availability
  • Plugin Structure
  • Manifest
  • Alert Endpoints
    • How They Work
    • Endpoints Definition
    • Example
    • Alert Format
  • Alert Definitions
    • Alert Description
    • Examples
  • Flow Status Definitions
    • Flow Status Description
    • Example
  • User Scripts
    • Structure
    • Flow User Scripts
    • Other User Scripts
    • Syslog User Scripts
    • Triggering Alerts
  • User Script Hooks
    • Flow User Script Hooks
    • Other User Script Hooks
  • User Scripts GUI
    • Input Builders
    • Threshold Cross
    • Items List
  • Localization
    • Parameters
    • Examples
  • Custom Pages
    • Custom Pages Definition
    • Page Skeleton
  • Timeseries Schemas
    • Schemas Definition
    • Schemas Usage
  • Examples
    • Blacklisted Flows
    • Flow Flooders
    • Log Network Traffic
  • Tutorial
  • Distributing Plugins
    • Debian/Ubuntu
• API Documentation
  • RESTful API
    • 1. RESTful API Specification
    • 2. Examples
  • Lua C API
    • 1. ntop
    • 2. interface
    • 3. Flow API
  • Timeseries API
    • Basic Concepts
    • Exporting Data
    • Modify an existing Schema
    • Adding New Metrics
    • Accessing Metrics
    • Metrics
    • Querying Data
    • ts_utils API
    • Driver Implementation
  • Alerts API
    • Engaged Alerts
  • Recording API
    • recording_utils API