ntopng網絡流量實時監控

時間  2019-11-08
標籤 ntopng 網絡 流量 實時 監控 欄目 系統網絡 简体版
原文   原文鏈接

　　ntopng is the next generation version of the original ntop, a network traffic probe that monitors network usage. ntopng is based on libpcapand it has been written in a portable way in order to virtually run on every Unix platform, MacOSX and on Windows as well.html

　　ntopng – yes, it’s all lowercase – provides a intuitive, encrypted web user interface for the exploration of realtime and historical traffic information.mysql

Main Features

  • Sort network traffic according to many criteria including IP address, port, L7 protocol, throughput, Autonomous Systems (ASs)
  • Show realtime network traffic and active hosts
  • Produce long-term reports for several network metrics including throughput and application protocols
  • Top talkers (senders/receivers), top ASs, top L7 applications
  • Monitor and report live throughput, network and application latencies, Round Trip Time (RTT), TCP statistics (retransmissions, out of order packets, packet lost), and bytes and packets transmitted
  • Store on disk persistent traffic statistics to allow future explorations and post-mortem analyses
  • Geolocate and overlay hosts in a geographical map
  • Discover application protocols (Facebook, YouTube, BitTorrent, etc) by leveraging on nDPI, ntop Deep Packet Inspection (DPI) technology
  • Characterise HTTP traffic by leveraging on characterisation services provided by Google and HTTP Blacklist.
  • Analyse IP traffic and sort it according to the source/destination.
  • Report IP protocol usage sorted by protocol type
  • Produce HTML5/AJAX network traffic statistics.
  • Full support for IPv4 and IPv6
  • Full Layer-2 support (including ARP statistics)
  • GTP/GRE detunnelling
  • Support for MySQL, ElasticSearch and LogStash export of monitored data
  • Interactive historical exploration of monitored data exported to MySQL
  • Alerts engine to capture anomalous and suspicious hosts
  • SNMP v1/v2c support and continuous monitoring of SNMP devices

　　當你在本地網絡監控網絡流量，根據流量大小、監控平臺/接口、數據庫類型等等，能夠有許多不一樣的選擇。ntopng是一套開源（遵循GPLv3協議）網絡流量分析解決方案，提供基於web界面的實時網絡流量監控。支持跨平臺，包括Linux和MacOS X。ntopng相似於RMON遠端網絡監控代理，具備內置的Web服務能力，使用Redis鍵值服務按時間序列存儲統計信息。你能夠在任何指定的監控服務器上安裝ntopng，只需使用任一web瀏覽器，就能實時訪問服務器上的流量報告了。c++

技術分享

技術分享

技術分享

基於源碼編譯（內網環境）git

0一、編譯底層庫

yum install -y gcc gcc-c++github

yum install -y libpcap  libpcap-devel  web

yum install -y  libxml2 libxml2-develredis

yum install -y glib2 glib2-develsql

yum install -y mysql mysql-server數據庫

yum install -y git autoconf  automake gmakevim

yum install -y libcurl-devel

yum install sqlite sqlite-devel

yum install libtool 

0二、安裝redis

官網：https://redis.io/

rpm -ivh redis-2.4.10-1.el6.x86_64.rpm

配置：/etc/redis.conf  

service redis start

[root@100-lab nt]# ss -ln
State      Recv-Q Send-Q                Local Address:Port                  Peer Address:Port 
LISTEN     0      128                       127.0.0.1:6379                             *:*     
LISTEN     0      128                              :::22                              :::*     
LISTEN     0      128                               *:22                               *:*     
LISTEN     0      100                             ::1:25                              :::*     
LISTEN     0      100                       127.0.0.1:25                               *:*

0三、編譯ntopng

官網：http://www.ntop.org/products/traffic-analysis/ntop/

ntopng-2.2.tar.gz 

下載：http://pan.baidu.com/s/1dEJnzUD

解壓   tar zxf ntopng-2.2.tar.gz

./autogen.sh   #編譯git,生成configure

./configure     #

./gmake         #編譯

make install   #安裝 /usr/local/ntopng

 

0四、配置文件

vim /etc/ntopng.conf

#進程號
-G=/var/tmp/ntopng.gid

# 指定監聽本地的哪些網段
--local-networks=192.168.100.0/24,192.168.200.0/24
# 指定監聽哪張網卡
--interface=eth0
# 指定監聽哪一個http端口，用於web管理
--user=root
--http-port=3000   #http://ip:3000  認證用戶admin/admin

0五、啓動ntopng

/etc/rc.d/init.d/redis start
啓動redis
/usr/local/bin/ntopng /etc/ntopng/ntopng.conf &
啓動ntopng並在後臺運行
訪問http://192.168.100.166:3000/，輸入默認用戶名和密碼admin admin

0六、錯誤解決

00：

[root@100-lab ntopng-2.2]# ./autogen.sh 
./autogen.sh: line 11: git: command not found
./autogen.sh: line 14: git: command not found
Wait please...
./autogen.sh: line 35: autoreconf: command not found
[root@100-lab ntopng-2.2]# ./autogen.sh
Wait please...
Can‘t exec "aclocal": No such file or directory at /usr/share/autoconf/Autom4te/FileUtils.pm lin
e 326.autoreconf: failed to run aclocal: No such file or directory
checking for sqlite3_open in -lsqlite3... no

#解決方案

yum install sqlite sqlite-devel

yum install -y git autoconf  automake gmake

 附上相關網站：

http://www.ntop.org/get-started/download/  #官網

https://github.com/ntop/ntopng                   #官方github

http://packages.ntop.org/                            #根據平臺打壓的包

http://rpmfind.net

redis-rpm

https://centos.pkgs.org/6/epel-x86_64/redis-2.4.10-1.el6.x86_64.rpm.html

 

0七、附上RPM安裝

[root@100-lab ~]# rpm -ivh ntopng-3.1.170607-2895.x86_64.rpm   #根據相關缺乏包，以此安裝
warning: ntopng-3.1.170607-2895.x86_64.rpm: Header V4 RSA/SHA1 Signature, key ID d1eb60be: NOKEY
error: Failed dependencies:
pfring = 6.7.0-1255 is needed by ntopng-3.1.170607-2895.x86_64
redis >= 2.4.0 is needed by ntopng-3.1.170607-2895.x86_64
GeoIP >= 1.4.8 is needed by ntopng-3.1.170607-2895.x86_64
rrdtool >= 1.3.8 is needed by ntopng-3.1.170607-2895.x86_64
numactl is needed by ntopng-3.1.170607-2895.x86_64
ntopng-data is needed by ntopng-3.1.170607-2895.x86_64
zeromq >= 4.0.0 is needed by ntopng-3.1.170607-2895.x86_64
hiredis is needed by ntopng-3.1.170607-2895.x86_64
mysql is needed by ntopng-3.1.170607-2895.x86_64
libnetfilter_queue is needed by ntopng-3.1.170607-2895.x86_64
bridge-utils is needed by ntopng-3.1.170607-2895.x86_64

 

#借鑑別人的，嘻嘻

##############################
wget http://download.fedoraproject.org/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm
rpm -ivh epel-release-5-4.noarch.rpm

##############################
yum install -y GeoIP-devel
yum install -y libpcap-devel glib2-devel libxml2-devel libxml2-devel
yum install -y autoconf automake libtool libtoolize autoreconf
yum install -y sqlite-devel
yum install  -y libcurl*
yum -y install mysql++-devel.x86_64 mysql-devel.x86_64  mysql-embedded-devel.x86_64  mysql-proxy-devel.x86_64    soci-mysql-devel.x86_64  libodb-mysql-devel.x86_64 

##############################
yum install redis
service redis start

###########################
#github上的版本爲ntopng社區版#
###########################
yum install git
git clone https://github.com/ntop/nDPI.git
cd  nDPI/
./autogen.sh 
make
cd ..
git clone https://github.com/ntop/ntopng.git
./autogen.sh
./configure 
make geoip
make
make install

##############################
cd /etc/
mkdir ntopng
vim ntopng.configure
-G=/var/tmp/ntopng.gid
--local-networks=192.168.10.0/24
--interface=em1
--user=nobody
--http-port=3000

##############################
nohup /usr/local/bin/ntopng /etc/ntopng/ntopng.conf &

web界面登陸方式http://ip:port 默認密碼爲admin,admin

##############################
登陸密碼修改
redis cli模式下修改ntopng.user.admin.password
而後重啓ntopng

 

在centos6.x系統下安裝最新版本的ntopng服務的步驟:

#注意：修改配置文件，而後啓動redis，再啓動ntopng。訪問：http://ip:3000，默認用戶名密碼：admin/admin

 

相關軟件：

http://pan.baidu.com/s/1o7Sy7rk 密碼: fkua

 

參考：

http://www.centoscn.com/image-text/install/2015/1008/6269.html

https://my.oschina.net/0eb1/blog/856998  #rpm快速安裝

ntopng網絡流量實時監控

標籤：queue   cte   elastics   spi   ...   dpi   內網   soc   sed   

原文：http://www.cnblogs.com/xiaochina/p/6958113.html

相關文章
相關標籤/搜索
每日一句
    每一个你不满意的现在，都有一个你没有努力的曾经。
本站公眾號
   歡迎關注本站公眾號,獲取更多信息
聯繫我們 最近搜索 最新文章 沪ICP备13005482号-10 MyBatis教程 SQL 教程 MySQL教程 Java 教程 Thymeleaf 教程 Hibernate教程 Spring教程 Redis教程