ntop June 2023 Webinar Recording
Those who missed our June 2023 webinar can watch the webinar recording as well glance through the presentation slides. …
Monitoring Microsoft Teams Performance and Video/Call Quality
Months ago we have talked how ntopng identifies ad monitors Zoom calls quality. Today we show how call monitoring has been now seamlessly extended to Microsoft Teams. Thanks to nDPI, ntopng is now able to detect Teams calls and to label them according to the stream type: Video Audio Screen Sharing. For each call it is possible to visualise the stream type as well as the flow statistics. If ntopng collects RTP flows from nProbe it also reports the call quality as exported by nProbe. Both Zoom and Microsoft Teams …
Register for ntop June 2023 Webinar: June 20th 3PM CET / 9 AM EST
This is to invite you to the latest ntop webinar before the summer break. The major webinar topic will include n2disk smart packet recorder Latest OT/SCADA Developments; IEC 104 and ModbusTCP Suricata/Zeek IDS Acceleration at 40/100 Gbit New ntopng charts and tables Traffic Rules Inactive Host Monitoring and ,,,, You can register for the webinar at this page: the registration link will be include the instructions for joining the webinar. Hope to see you online ! …
Scaling Up ntopng Flow and Packet Processing
As traffic rate increases, it is important to tune packet processing in order to avoid drops and thus educe visibility. This post will show you a few tricks for improving the overall performance and better exploit modern multicore systems. The Problem ntopng packet processing performance depends on the number of ingress pps (packets per second) as well the number of flows/hosts being monitored and number of enabled behavioural checks. With ntopng you can expect to process (your mileage varies according to the CPU/system you are using) a few (< 5) …
Introducing Modbus Traffic Monitoring in ntopng
Modbus is an industrial protocol used to communicate with automation devices. The initial protocol version was implemented over a serial layer, whereas the current version named ModbusTCP is a variant of the original protocol running over TCP/IP. This blog post describes how ntopng monitors ModbusTCP traffic: it detects Modbus flows via nDPI and dissects them building an internal flow representation. For each flow, ntopng keeps track of the function codes uses, exceptions and registers accessed. It also reports the transitions between function Ids and depicts them graphically: the more transitions …
Enabling Zeek and Suricata On-Demand at 40/100 Gbit using PF_RING
Overview Those of you who have some experience with IDS or IPS systems, like Zeek and Suricata, are probably aware of how CPU intensive and memory consuming those applications are due to the nature of the activities they carry on (e.g. signatures matching). This leads to high system load and packet loss when the packet rate becomes high (10+ Gbi+) making these IDSs unlikely to be to deployed on high-speed networks. As nProbe Cento can analyse networks up to 100 Gbit while using nDPI for ETA (Encrypted Traffic Analysis), ntopng …
OpenAPI: ntopng REST API for Software Developers
Maybe not all of you know that ntopng powers in some popular monitoring systems such as CheckMK and Centreon. The integration is made possible through the ntopng REST API (REST stands for REpresentational State Transfer) that allows developers to manipulate ntopng configuration and query monitored information including hosts, flows, alerts and historical data. Recently we have integrated the ntopng API specified according to OpenAPI into ntopng by using the swagger open-source tool. All you need to do is to update your ntopng (dev) copy and access the embedded REST API …
OT, ICS, SCADA: IEC 60870-5-104 in ntopng
What is OT, ICS, SCADA ? Operational Technology (OT) refers to computing systems that are used to manage industrial operations or process operations, like water treatment, electrical power distribution or wrapping a chocolate in foil. ntopng supports some Industrial control systems (ICS) protocol often managed via a Supervisory Control and Data Acquisition (SCADA) systems. Via nDPI it can detect protocols such as Modbus, IEC 60780 or BACnet. In addition to this, ntopng has extensive detection and monitor capabilitiesfor some protocols OT protocols/ ntopng “Generic” Monitoring ntopng is a monitoring tool …
How to Enable Smart Recording in ntopng (and n2disk)
Recently, we have introduced Smart Recording in n2disk to combine Cybersecurity with Packet-to-Disk. In this previous post (and in the documentation) we described the idea behind it and described how to enable it in a few simple steps. For those of you who prefer a video resource, and want to learn more about the technology and how to get the most out of it, here’s the step-by-step video tutorial. Enjoy! …
ntopConf’ 23 Call for Talks is now Open
This year ntop will turn 25. Our call for speakers for the ntop conference 2023 (Pisa, Sept 21-22) is now open. Deadline is June 30th. We want to hear you voice, experience, projects based on ntop tools and anything that can be of interest to our community. Pisa is the conference location that we have selected. It is the ntop hometown, and it can be easily reached with low-cost flights from many international locations. No excuse for not submitting a talk proposal. Read more and submit your talk at this …
Using nDPI to Monitor Streaming, Messaging and Social Network Traffic
We have created nDPI to label network traffic and extract metadata such as the URL or TLS certificate information. nDPI is the layer on top of which ntop applications are sitting. This time we do not want to talk about nDPI internals but rather use it to monitor Internet traffic. For this reason we have taken traffic from an Italian broadband (no mobile) ISP, and used ntopng + nDPI to monitor the Internet traffic produced by residential and business users. Below you can find the results for social networks and …
Introducing Smart Recording in n2disk: Combining Cybersecurity with Packet-to-Disk
In short Continuous network traffic recorders are applications (or appliances) that write network traffic on disk. In case of issues (e.g. security breach or network outage) they enable network and security analysts to go back in time and see how a problem originated. The main limitation of this practice is that a lot of data it is written to disk even when there is nothing special happening on the network. Similar to the evolution of surveillance cameras that implemented “motion detection” to trigger recording when some meaningful even happen, this …