All Blog Posts

ntopng

How ntop built a web-based traffic analysis and flow collection with InfluxDB
A couple of days ago InfluxData hosted a ntop webinar about how we have integrated InfluxDB into ntopng. Those who have not attended it can give a look at the presentation slides as well watch the webinar. In essence: ntopng is based on RRD for timeseries As networks grow, ntopng needs to store more time series more granular. RRD is file based, that is a good things as configuration is minimal, but it does not scale on mid/large networks. We need an alternative, and found InfluxDB to be the best option …
ntopng

How to use ntopng in compliance with GDPR
Today the General Data Protection Regulation (GDPR) (EU) 2016/679 is effective in the European Union. GDPR is designed to protect personal data and thus preserve privacy in particular as specified in articles 13 to 22, and 34. As we manufacture tools for traffic monitoring, we’ve to make sure that our tools can be used in compliancy with GDPR. In particular we’ve implemented a couple of features that can be useful: If you go select “Preferences” from the ntopng menu, and click on the “Misc” pane you can access the preference for …
ntop

Webinar Invitation: ntop traffic analysis and flow collection with InfluxDB
Hi all, this is to invite all of your to the How ntop built their high-speed Web-based traffic analysis and flow collection with the use of InfluxDB webinar, organised by our friends at InfluxData. The event will take place May 29th at 8AM PST (5PM CET). I will be talking about traffic monitoring and timeseries, why we used RRD, and how we have integrated InfluxDB (including ongoing developments). …
PF_RING

Introducing nBroker: Traffic Steering and Filtering on Intel RRC (FM10K)
Exactly two years ago we introduced Intel FM10K (FM10000) support in PF_RING ZC. The Intel FM10K ethernet controller family supports 10/25/40/100 Gbit on the same NIC, at a convenient price (sub 1000$ range) and it powers NIC various models manufactured by Silicom Inc. The most interesting aspect of the FM10K is the programmability that this adapter provides. In fact this adapter integrates an internal switch attached to the external ports (those that are physically connected to the cables) and to the internal ports (towards the CPU, those seen by the host OS) …
ntop

Introducing PF_RING FT: nDPI-based Flow Classification and Filtering for PF_RING and DPDK
Motivation Most network monitoring and security applications are based on flow processing, which is in practice the activity of grouping packets based on common attributes (e.g. source and destination IP, source and destination port, protocol, etc.) and do some analysis based on the collected information. What happens behind the scenes can be divided in a few major tasks: capturing raw packets decoding packet headers to extract flow attributes classify the packets based on flow attributes (optional) extracting also L7 protocol information. Introducing PF_RING FT With PF_RING, and later on with PF_RING ZC (Zero …
ntopng

ntopng goes Elastic: Introducing ElasticSearch 6 Support
As you ntopng users know, out of the Elastic toolset ntopng supports both ElasticSearch and LogStash. You can use them using the -F flag: --dump-flows|-F] <mode> | Dump expired flows. Mode: | es Dump in ElasticSearch database | Format: | es;<mapping type>;<idx name>;<es URL>;<http auth> | Example: | es;ntopng;ntopng-%Y.%m.%d;http://localhost:9200/_bulk; | Notes: | The <idx name> accepts the strftime() format. | <mapping type>s have been removed starting at | ElasticSearch version 6. <mapping type> | values whill therefore be ignored when using | versions greater than or equal to 6. | …
nProbe

Using nProbe for Collecting Palo Alto Flows
NOTE: This article is outdated. Please see “Collecting Proprietary Flows with nProbe” for learning  how to collect proprietary Palo Alto flows. nProbe is both a probe and a NetFlow/sFlow collector. As you all know, we have recently added the ability to collect flows with proprietary information elements. However we natively support in nProbe popular flow exporter devices such as Cisco NBAR and Palo Alto security devices. In this article we show you how to collect the latter flows in nProbe. A typical Palo Alto flow is depicted below. As explained …
ntopng

Welcome to ntopng 3.4: Improved Alerts/SNMP/Asset Discovery, InfluxDB/Prometheus Support
We’re happy to announce the release of ntopng 3.4 that introduces several enhancements and new features, some of which will be finalised in 3.6 due later this year. This version consolidates several months of work and paves the way to more radical changes planned for the next release. In particular beta features present in this version include support for InfluxDB and Prometheus so that you can use ntopng for exporting traffic data towards time-series databases (you can read about influx and prometheus). We have also revamped the alert implementation and introduced initial …
Announce

Introducing nProbe 8.4: New Metrics and Extensions, Improved Kafka Support
This is to announce the release of nProbe 8.4 that introduces enhanced Kafka support and adds various extensions and stability fixes. We encourage all our users to move to this version. Below you can find the complete application changelog. Enjoy ! Main New Features Implements Kafka batching, options parsing, and variable number of producers Adds Kafka messages transmission statistics New Options --plugin-dir to load plugins from the specified directory --adj-from-as-path to get previous/next adjacent ASNs from BGP AS-path --disable-sflow-upscale to disable sFlow upscaling Extensions Implemented ICMP network latency Added ICMP …
Announce

Released nDPI 2.2.2: 7 New Protocols, Many Improvements
This is to announce a minor nDPI release update that adds a few fixes and introduces support for popular cloud protocols such as Google and Apple push service. Below you can find the complete changelog. Enjoy! Main New Features Initial experimental Hyperscan support ndpi_get_api_version API call to be used in applications that are dynamically linking with nDPI –enable-debug-messages to enable debug information output Increased number of protocols to 512 New Supported Protocols and Services GoogleDocs GoogleServices AmazonVideo ApplePush Diameter GooglePlus WhatsApp file exchage Improvements WhatsApp detection Amazon detection Improved Google …
nScrub

Protecting a Web Server from DDoS Attacks Using nScrub
nScrub is a software-based DDoS mitigation system based on PF_RING ZC, able to operate at 10 Gbit full-rate (or multi 10 Gbit distributing the load across multiple modules) using commodity hardware, making it affordable in terms of price and deployment. nScrub is easy to configure even for beginners and companies with no experience with DDoS mitigation, it can be implemented as bump in the wire (i.e. no BGP or traffic tunneling necessary) or as router for on-demand traffic diversion. In this post we will go through the installation steps for …
nProbe

Improved nProbe Kafka Export Support: Theory and Practice
Kafka is a distributed messaging system widely used in the industry. Kafka can be deployed on just a small server but it can also scale up to span multiple datacenters. Given the scale and variety of possible Kafka deployments, it is desirable to have flexible, configurable producer applications able to adapt to and robustly feed any Kafka real-world deployment. nProbe, thanks to its export plugin, can be configured as a Kafka producer for the streaming of monitored/collected flows to categories called known as topics. The latest nProbe 8.3.x has been extended …

High-performance network traffic monitoring and analysis tools.

Explore
Newsletter
Subscribe