ntopng网络流量实时监控

　　High-Speed Web-based Traffic Analysis and Flow Collection

　　ntopng is the next generation version of the original ntop, a network traffic probe that monitors network usage. ntopng is based on libpcapand it has been written in a portable way in order to virtually run on every Unix platform, MacOSX and on Windows as well.

　　ntopng – yes, it’s all lowercase – provides a intuitive, encrypted web user interface for the exploration of realtime and historical traffic information.

Main Features

Sort network traffic according to many criteria including IP address, port, L7 protocol, throughput, Autonomous Systems (ASs)
Show realtime network traffic and active hosts
Produce long-term reports for several network metrics including throughput and application protocols
Top talkers (senders/receivers), top ASs, top L7 applications
Monitor and report live throughput, network and application latencies, Round Trip Time (RTT), TCP statistics (retransmissions, out of order packets, packet lost), and bytes and packets transmitted
Store on disk persistent traffic statistics to allow future explorations and post-mortem analyses
Geolocate and overlay hosts in a geographical map
Discover application protocols (Facebook, YouTube, BitTorrent, etc) by leveraging on nDPI, ntop Deep Packet Inspection (DPI) technology
Characterise HTTP traffic by leveraging on characterisation services provided by Google and HTTP Blacklist.
Analyse IP traffic and sort it according to the source/destination.
Report IP protocol usage sorted by protocol type
Produce HTML5/AJAX network traffic statistics.
Full support for IPv4 and IPv6
Full Layer-2 support (including ARP statistics)
GTP/GRE detunnelling
Support for MySQL, ElasticSearch and LogStash export of monitored data
Interactive historical exploration of monitored data exported to MySQL
Alerts engine to capture anomalous and suspicious hosts
SNMP v1/v2c support and continuous monitoring of SNMP devices

　　当你在本地网络监控网络流量，根据流量大小、监控平台/接口、数据库类型等等，可以有许多不同的选择。ntopng是一套开源（遵循GPLv3协议）网络流量分析解决方案，提供基于web界面的实时网络流量监控。支持跨平台，包括Linux和MacOS X。ntopng类似于RMON远端网络监控代理，具有内置的Web服务能力，使用Redis键值服务按时间序列存储统计信息。你可以在任何指定的监控服务器上安装ntopng，只需使用任一web浏览器，就能实时访问服务器上的流量报告了。

基于源码编译（内网环境）

01、编译底层库

yum install -y gcc gcc-c++

yum install -y libpcap libpcap-devel

yum install -y libxml2 libxml2-devel

yum install -y glib2 glib2-devel

yum install -y mysql mysql-server

yum install -y git autoconf automake gmake

yum install -y libcurl-devel

yum install sqlite sqlite-devel

yum install libtool

02、安装redis

官网：https://redis.io/

rpm -ivh redis-2.4.10-1.el6.x86_64.rpm

配置：/etc/redis.conf

service redis start

[root@100-lab nt]# ss -ln
State      Recv-Q Send-Q                Local Address:Port                  Peer Address:Port 
LISTEN     0      128                       127.0.0.1:6379                             *:*     
LISTEN     0      128                              :::22                              :::*     
LISTEN     0      128                               *:22                               *:*     
LISTEN     0      100                             ::1:25                              :::*     
LISTEN     0      100                       127.0.0.1:25                               *:*

03、编译ntopng

官网：http://www.ntop.org/products/traffic-analysis/ntop/

ntopng-2.2.tar.gz

下载：http://pan.baidu.com/s/1dEJnzUD

解压 tar zxf ntopng-2.2.tar.gz

./autogen.sh #编译git,生成configure

./configure #

./gmake #编译

make install #安装 /usr/local/ntopng

04、配置文件

vim /etc/ntopng.conf

#进程号
-G=/var/tmp/ntopng.gid

# 指定监听本地的哪些网段
--local-networks=192.168.100.0/24,192.168.200.0/24
# 指定监听哪张网卡
--interface=eth0
# 指定监听哪个http端口，用于web管理
--user=root
--http-port=3000 #http://ip:3000 认证用户admin/admin

05、启动ntopng

/etc/rc.d/init.d/redis start
启动redis
/usr/local/bin/ntopng /etc/ntopng/ntopng.conf &
启动ntopng并在后台运行
访问http://192.168.100.166:3000/，输入默认用户名和密码admin admin

06、错误解决

00：

[root@100-lab ntopng-2.2]# ./autogen.sh 
./autogen.sh: line 11: git: command not found
./autogen.sh: line 14: git: command not found
Wait please...
./autogen.sh: line 35: autoreconf: command not found

[root@100-lab ntopng-2.2]# ./autogen.sh
Wait please...
Can't exec "aclocal": No such file or directory at /usr/share/autoconf/Autom4te/FileUtils.pm lin
e 326.autoreconf: failed to run aclocal: No such file or directory

checking for sqlite3_open in -lsqlite3... no

#解决方案

yum install sqlite sqlite-devel

yum install -y git autoconf automake gmake

附上相关网站：

http://www.ntop.org/get-started/download/ #官网

https://github.com/ntop/ntopng #官方github

http://packages.ntop.org/ #根据平台打压的包

http://rpmfind.net

redis-rpm

https://centos.pkgs.org/6/epel-x86_64/redis-2.4.10-1.el6.x86_64.rpm.html

07、附上RPM安装

[root@100-lab ~]# rpm -ivh ntopng-3.1.170607-2895.x86_64.rpm #根据相关缺少包，以此安装
warning: ntopng-3.1.170607-2895.x86_64.rpm: Header V4 RSA/SHA1 Signature, key ID d1eb60be: NOKEY
error: Failed dependencies:
pfring = 6.7.0-1255 is needed by ntopng-3.1.170607-2895.x86_64
redis >= 2.4.0 is needed by ntopng-3.1.170607-2895.x86_64
GeoIP >= 1.4.8 is needed by ntopng-3.1.170607-2895.x86_64
rrdtool >= 1.3.8 is needed by ntopng-3.1.170607-2895.x86_64
numactl is needed by ntopng-3.1.170607-2895.x86_64
ntopng-data is needed by ntopng-3.1.170607-2895.x86_64
zeromq >= 4.0.0 is needed by ntopng-3.1.170607-2895.x86_64
hiredis is needed by ntopng-3.1.170607-2895.x86_64
mysql is needed by ntopng-3.1.170607-2895.x86_64
libnetfilter_queue is needed by ntopng-3.1.170607-2895.x86_64
bridge-utils is needed by ntopng-3.1.170607-2895.x86_64

#借鉴别人的，嘻嘻

##############################
wget http://download.fedoraproject.org/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm
rpm -ivh epel-release-5-4.noarch.rpm

##############################
yum install -y GeoIP-devel
yum install -y libpcap-devel glib2-devel libxml2-devel libxml2-devel
yum install -y autoconf automake libtool libtoolize autoreconf
yum install -y sqlite-devel
yum install  -y libcurl*
yum -y install mysql++-devel.x86_64 mysql-devel.x86_64  mysql-embedded-devel.x86_64  mysql-proxy-devel.x86_64    soci-mysql-devel.x86_64  libodb-mysql-devel.x86_64 

##############################
yum install redis
service redis start

###########################
#github上的版本为ntopng社区版#
###########################
yum install git
git clone https://github.com/ntop/nDPI.git
cd  nDPI/
./autogen.sh 
make
cd ..
git clone https://github.com/ntop/ntopng.git
./autogen.sh
./configure 
make geoip
make
make install

##############################
cd /etc/
mkdir ntopng
vim ntopng.configure
-G=/var/tmp/ntopng.gid
--local-networks=192.168.10.0/24
--interface=em1
--user=nobody
--http-port=3000

##############################
nohup /usr/local/bin/ntopng /etc/ntopng/ntopng.conf &

web界面登录方式http://ip:port 默认密码为admin,admin

##############################
登录密码修改
redis cli模式下修改ntopng.user.admin.password
然后重启ntopng

在centos6.x系统下安装最新版本的ntopng服务的步骤:

```
cd /etc/yum.repos.d/
```

wget http://packages.ntop.org/centos/ntop.repo -O ntop.repo

wget http://packages.ntop.org/centos/epel-6.repo -O epel.repo

wget https://copr.fedoraproject.org/coprs/saltstack/zeromq4/repo/epel-6/saltstack-zeromq4-epel-6.repo

```
yum erase zeromq3
```
```
yum clean all
```
```
yum update
```

yum install pfring n2disk nprobe ntopng ntopng-data cento nbox

```
yum install pfring-drivers-zc-dkms
```

#注意：修改配置文件，然后启动redis，再启动ntopng。访问：http://ip:3000，默认用户名密码：admin/admin

mvpbang