Interface Behavioural Checks¶
These checks are performed per network interface monitored by ntopng.
Alerts Drops¶
Checks for dropped alerts.
The alerts could be dropped when too many are queued/generated.
The alert is sent when the system drops the alert.
Category: Internals
Enabled by Default
DHCP Storm¶
Checks for DHCP flooding.
DHCP storm occurs when DHCP router gets too many packets requests in a minute - by blocking totally the router functioning.
The alert is triggered when DHCP storm is detected.
Category: Cybersecurity
Enabled by Default
Ghost Networks¶
Checks for ghost networks.
There are many reasons why the ghost network may appear - starting from misconfiguration and ending with malicious users who put devices on the network believing not to be discovered.
The alert is sent when the unknown network is discovered.
Category: Cybersecurity
Enabled by Default
Idle Hash Table Entries¶
Checks for Idle Entries.
Trigger an alert when the percentage of idle entries in the hash table over the total number of entries exceeds the threshold.
Category: Internals
Enabled by Default
No Traffic Activity¶
Checks for activities on the interface.
There could be no traffic because of misconfigurations or because of the mirror network link that has gone down.
The alert is sent when no activity on the interface is noticed.
Category: Internals
Enabled by Default
Packet Drops¶
Checks for dropped packets.
The packets could be dropped when too many are analyzed.
The alert is sent when the system drops packets.
Category: Internals
Enabled by Default
Periodic Activity Not Executed¶
Checks for periodic activity.
Periodic activity is not executed since all the worker threads are busy will be buffered until a worker threads are available once again
Alert is sent when the periodic activity hasn’t been executed.
Category: Internals
Enabled by Default
Slow Periodic Activity¶
Checks for slow execution of periodic activity.
A bug is causing a periodic activity to take more than its max duration to complete.
Alert is sent when periodic activity is taking too long to execute.
Category: Internals
Enabled by Default
Throughput Exceeded¶
Checks for throughput rate.
When the system throughput (https://en.wikipedia.org/wiki/Network_throughput) rate exceeds a pre-configured threshold of the maximum allowed throughput rate.
The alert is sent when the throughput exceeds threshhold.
Category: Network
*Enabled by Default
Unexpected Application Behaviour¶
Checks for unexpected app behaviour.
Unexpected behaviour in applications could be an indicator of bugs in the code that causes an unusual attitude or incorrect functioning of an app.
Alert is sent when unusual app behaviour is detected.
Category: Network
Enabled by Default
Unexpected ASN Behaviour¶
Checks for ASN Behaviour.
Unexpected behavior is identified in traffic coming from one of the subnets of the ASN = Autonomous System Number (https://en.wikipedia.org/wiki/Autonomous_system_(Internet))
The alert is sent when unexpected behaviour is seen in ASN.
Category: Cybersecurity
Not Enabled by Default
Unexpected Device Connected/Disconnected¶
Check for MAC addresses.
An alert is triggered whenever an unexpected MAC address connects or disconnects form an Interface. After enabling the alert, a new page, called Devices Exclusion (more info can be found here) is going to be available in the Settings menu.
By jumping there, users are able to configure denied/allowed MAC addresses (unexpected/expected MAC addresses). When a denied or non accounted MAC address connects to the Interface a new Engaged alert is going to be triggered, that is going to be released when the unexpected MAC address is going to disconnect from the Interface or when allowed.
Category: Network
License: Pro
Disabled by Default
Unexpected Network Behaviour¶
Checks for Unexpected Behaviour.
Network behavior anomaly detection is focused on networks for abnormal behavior in order to detect threats or flaws.
Alert is triggered when unexpected behaviour comes from the specific network.
Category: Cybersecurity
Not Enabled by Default
Unexpected Score Behaviour¶
Checks for Unexpected Behaviour.
Score behavior anomaly detection is focused on score for abnormal behavior in order to detect threats or flaws.
Alert is triggered when unexpected behaviour comes from the interface.
Category: Cybersecurity
Not Enabled by Default
Unexpected Traffic Behaviour¶
Checks for Unexpected Behaviour.
Traffic behavior anomaly detection is focused on the interface for abnormal behavior in order to detect threats or flaws.
Alert is triggered when unexpected behaviour comes from the interface.
Category: Cybersecurity
Not Enabled by Default