Install ntop on Red Hat Enterprise Linux / CentOS Linux

by on July 28, 2008 · 38 comments· LAST UPDATED July 28, 2008

in , ,

Q. ntop is a network probe that shows network usage in a way similar to what top does for processes. How do I install latest version of ntop on RHEL 5.x systems?

A. ntop is a network and traffic analyzer that provides a wealth of information on various networking hosts and protocols. ntop is primarily accessed via a built-in web interface.

Following instructions are tested on 32/64 bit versions only:
a) RHEL Linux 5.x
b) CentOS Linux 5.x

Download latest ntop

Visit ntop project to grab latest version. You can use wget to grab the same, enter:
# cd /opt
# wget http://freshmeat.net/redir/ntop/7279/url_tgz/ntop-3.3.6.tar.gz

Untar tar ball, enter:
# tar -zxvf ntop-3.3.6.tar.gz

Configure and Compile ntop under RHEL

You must have RRDTool installed. You also need to install libpcap, enter:
# yum install libpcap-devel libpcap
Type the following commands to compile and install ntop:
# cd ntop
# ./autogen.sh

Just type make to compile ntop:
# make
Just type make install to install ntop:
# make install
# make install-data-as

Create ntop user

Type the following command to run ntop as ntop user, enter:
# useradd -M -s /sbin/nologin -r ntop

Setup directory permissions

Next, you need to setup directory permissions, enter:
# chown ntop:root /usr/local/var/ntop/
# chown ntop:ntop /usr/local/share/ntop/

Setup ntop user admin password

Type the following command to set ntop admin password, enter:
# ntop -A
Sample output:

Mon Jul 28 03:38:34 2008  NOTE: Interface merge enabled by default
Mon Jul 28 03:38:34 2008  Initializing gdbm databases
ntop startup - waiting for user response!
Please enter the password for the admin user:
Please enter the password again:
Mon Jul 28 03:38:42 2008  Admin user password has been set

Start ntop

Type the following command to start ntop:
# /usr/local/bin/ntop -d -L -u ntop -P /usr/local/var/ntop --skip-version-check --use-syslog=daemon
Sample output:

Mon Jul 28 03:42:19 2008  NOTE: Interface merge enabled by default
Mon Jul 28 03:42:19 2008  Initializing gdbm databases

If you have multiple interface (eth0, eth1 and so on), start ntop as follows:
# /usr/local/bin/ntop -i "eth0,eth1" -d -L -u ntop -P /usr/local/var/ntop --skip-version-check --use-syslog=daemon
Where,

  • -i "eth0,eth1" : Specifies the network interface or interfaces to be used by ntop for network monitoring. Here you are monitoring eth0 and eth1.
  • -d : Run ntop as a daemon.
  • -L : Send all log messages to the system log (/var/log/messages) instead of screen.
  • -u ntop : Start ntop as ntop user
  • -P /usr/local/var/ntop : Specify where ntop stores database files. You may need to backup database as part of your disaster recovery program.
  • --skip-version-check : By default, ntop accesses a remote file to periodically check if the most current version is running. This option disables that check.
  • --use-syslog=daemon : Use syslog daemon.

How do I view ntop stats?

By default ntop listen on 3000 port. You can view ntop stats by visiting following url:
http://localhost:3000/
OR
http://server-ip:3000/
ntop in action
(Fig.01: ntop Global TCP/UDP Protocol Distribution Graphs [click to enlarge])

(Fig.02: Network Load Statistics (click to enlarge])

Open port 3000 using iptables

Open /etc/sysconfig/iptables file, enter:
# vi /etc/sysconfig/iptables
Append following code before final REJECT line:
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 3000 -j ACCEPT
Save and close the file. Restart firewall:
# service iptables restart

How do I view ntop stats without opening port 3000?

Setup simple tunnel using ssh, enter the following on your local UNIX / Linux desktop system:
$ ssh -L 3000:localhost:3000 -N -f user@server.yourcorp.com
Now open browser and type the following command:
http://localhost:3000/

How do I start ntop on boot?

Open /etc/rc.local file, enter:
# vi /etc/rc.local
Append the following line:
/usr/local/bin/ntop -i "eth0,eth1" -d -L -u ntop -P /usr/local/var/ntop --skip-version-check --use-syslog=daemon
Save and close the file.

How do I stop ntop?

Use web interface to shutdown ntop, or use normal kill / killall command:
# killall ntop

Further readings:

TwitterFacebookGoogle+PDF versionFound an error/typo on this page? Help us!

{ 38 comments… read them below or add one }

1 Gagan Brahmi July 29, 2008 at 11:58 am

Thanks for the wonderful post Vivek. I have tried this out and it works flawlessly.

Maybe you need to mention that the installation of gdbm-devel as by default, I could not find that on the server. The other requirements are libtool automake autoconf.

So maybe someone would require to use this command as well:-

# yum install libtool automake autoconf gdbm-devel

Reply

2 nixCraft July 29, 2008 at 12:28 pm

Gagan,

No problem. Yes, deps may vary from one installation to other.

I appropriate your post.

Reply

3 dot22 July 29, 2008 at 12:44 pm

Under the Centos5 you can install ntop natively by using rpmforge and epel repos.
I just enter the command:
“yum install ntop”
and voilà .) :

Resolving Dependencies
–> Running transaction check
—> Package ntop.i386 0:3.3.6-1.el5.rf set to be updated
–> Processing Dependency: librrd_th.so.2 for package: ntop
–> Running transaction check
—> Package rrdtool.i386 0:1.2.27-3.el5 set to be updated
–> Finished Dependency Resolution
===8<—–
Installed: ntop.i386 0:3.3.6-1.el5.rf
Dependency Installed: rrdtool.i386 0:1.2.27-3.el5
Complete!

Reply

4 nixCraft July 29, 2008 at 12:46 pm

dot22,

Thanks for pointing out rpmforge repos. I generally don’t mix 3rd party repos with RHEL (as I might break their TOS). But under CentOS I don’t mind using rpmforge.

Reply

5 Ruben November 5, 2008 at 1:06 pm

hi i have problems in the installation here is it:

[root@124 ~]# /usr/local/bin/ntop -i “eth0,eth1″ -d -L -u ntop -P /usr/local/var/ntop –skip-version-check –use-syslog=daemon
Wed Nov 5 09:27:49 2008 NOTE: Interface merge enabled by default
Wed Nov 5 09:27:49 2008 Initializing gdbm databases
Wed Nov 5 09:27:49 2008 **ERROR** ….open of /usr/local/var/ntop/prefsCache.db failed: Can’t be writer
Wed Nov 5 09:27:49 2008 Possible solution: please use ‘-P ‘
Wed Nov 5 09:27:49 2008 **FATAL_ERROR** GDBM open failed, ntop shutting down…
Wed Nov 5 09:27:49 2008 CLEANUP[t3086464704]: ntop caught signal 2 [state=2]
Wed Nov 5 09:27:49 2008 ntop is now quitting…

what would be the possible solution to this….

Reply

6 same July 30, 2010 at 6:07 am

same problem

Reply

7 Tommy December 16, 2008 at 11:51 am

Hi, How to install ntop v3.x + mySQL ?

Reply

8 LJ January 30, 2009 at 11:59 am

Thanks for this post, I was running into a lot of compilation errors, and no other website out there had as clear instructions as you did. Thanks again !

Reply

9 shrirang March 7, 2009 at 10:33 am

Hi Ruben,

Just do the following first before invoking above command & you will be able to start ntop :-)

$ killall ntop

Reply

10 irado April 8, 2009 at 1:10 pm

I follow your instructions (including on install rddtool), but autogen.sh is stuck with this error message:

configure: error: Unable to find RRD at /usr/local/rrdtool: please use –with-rrd-home=DIR

verifying:

[root@HPAllan:/usr/src/ntop-3.3.9#]: ls /usr/local/rrdtool
lrwxrwxrwx 1 root root 23 Abr 8 09:47 /usr/local/rrdtool -> /usr/src/rrdtool-1.3.6/

so, rrdtool IS there :(

any hint?

Reply

11 irado April 8, 2009 at 1:22 pm

another question:
ntop is up and running BUT.. :
when asking for the graphical (network load or anyother) it show this:
“NOTE: this page is not operational when the RRD plugin is disabled, misconfigured or missing.”

in the configuration, the rrd plugin is ENABLED (shows ‘yes’).

now I am stuck :(

any advice, PLEASE?

Reply

12 Eugene Frakt September 7, 2010 at 9:00 pm

You have to change ownership of the ntop directory to ntop user by running something like this for a compiled version of ntop.
chown -R ntop /usr/local/var/ntop

For an rpm version of ntop, it would be this command.
chown -R ntop /var/ntop

Hope this helps.

Reply

13 Thanuwat May 18, 2009 at 10:47 am

I have a problem doing install in method make install

cp: cannot stat `GeoLiteCity.dat’: No such file or directory
make[2]: *** [install-data-local] Error 1
make[2]: Leaving directory `/usr/local/ntop-3.3.10-rc1′
make[1]: *** [install-am] Error 2
make[1]: Leaving directory `/usr/local/ntop-3.3.10-rc1′
make: *** [install-recursive] Error 1

how to solve it, Thank you.

Reply

14 Saeid May 24, 2009 at 12:22 am

mkdir -p — //usr/local/etc/ntop
cp: cannot stat `GeoLiteCity.dat’: No such file or directory
make[2]: *** [install-data-local] Error 1
make[2]: Leaving directory `/root/ntop-3.3.9′
make[1]: *** [install-am] Error 2
make[1]: Leaving directory `/root/ntop-3.3.9′
make: *** [install-recursive] Error 1
[root@localhost ntop-3.3.9]#

Reply

15 Mihir Joshi July 22, 2009 at 4:39 am

Hello Vivek,

I m not able to view graphs.
When i click on “Network Load”, gives below error
Error: NOTE: this page is not operational when the RRD plugin is disabled, misconfigured or missing. Please check the ntop log file.

Below are the permission.
root@scare [/usr/local/var/ntop/rrd]# ll
total 10
drwxr-xr-x 5 ntop ntop 2048 Jul 21 13:31 ./
drwxr-xr-x 3 ntop root 2048 Jul 22 14:31 ../
drwxrwxrwx 8 ntop ntop 2048 Jul 22 14:26 flows/
drwxrwxrwx 2 ntop ntop 2048 Jul 21 13:31 graphics/
drwxrwxrwx 3 ntop ntop 2048 Jul 21 13:31 interfaces/

Below is the log.
Wed Jul 22 14:31:29 2009 **ERROR** RRD: Disabled – unable to create directory (err 13, /usr/local/var/ntop/rrd/graphics)

Regards,
Mihirj

Reply

16 m++ August 9, 2009 at 5:37 am

I noticed rrd didn’t work for me if I started `ntop -d` as a daemon. If I started it without the the -d flag as `ntop &` the rrd graphs work fine. I’m using v.3.3.11-dev which warns of possible funny business. Overall, the tool built easily and is completely awesome for monitoring network traffic!

Reply

17 Casey March 10, 2011 at 1:46 pm

Thanks m++, that worked for me too..
I started Ntop without the daemon option..

But one thing I noticed, wen I ran ntop, it would load, but I cant have access to the web interface..
Sorted that out by running
#ntop -W 3001 (this runs as a daemon)
#stop Ntop
#/etc/init.d/ntop start -

That worked..

Reply

18 charles August 27, 2009 at 7:06 pm

cp: cannot stat `GeoLiteCity.dat’: No such file or directory
make[2]: *** [install-data-local] Error 1
make[2]: Leaving directory `/usr/local/ntop-3.3.10-rc1′
make[1]: *** [install-am] Error 2
make[1]: Leaving directory `/usr/local/ntop-3.3.10-rc1′
make: *** [install-recursive] Error 1

how to solve it, Thank you.

Reply

19 praveen September 24, 2009 at 5:39 am

i install ntop from rpm . when i start the ntop it starts well but after sometime it automatically stops

Reply

20 Nishth Vyas December 7, 2009 at 7:56 am

The provided link is not present. Please check.
wget http://freshmeat.net/redir/ntop/7279/url_tgz/ntop-3.3.6.tar.gz

Reply

21 Sachin Gholap January 14, 2010 at 7:51 am

I m getting error when i use make command
plzzz help me
ntop.h:417:19: error: evdns.h: No such file or directory
address.c: In function ‘dns_response_callback’:
address.c:123: error: ‘DNS_ERR_NONE’ undeclared (first use in this function)
address.c:123: error: (Each undeclared identifier is reported only once
address.c:123: error: for each function it appears in.)
address.c:129: error: ‘DNS_IPv6_AAAA’ undeclared (first use in this function)
address.c:142: warning: assignment discards qualifiers from pointer target type
address.c:150: error: ‘DNS_IPv4_A’ undeclared (first use in this function)
address.c:164: error: ‘DNS_PTR’ undeclared (first use in this function)
address.c: In function ‘queueAddress’:
address.c:243: warning: nested extern declaration of ‘evdns_resolve_reverse’
address.c:243: error: ‘DNS_ERR_NONE’ undeclared (first use in this function)
address.c:249: warning: nested extern declaration of ‘evdns_resolve_reverse_ipv6′
make[2]: *** [address.lo] Error 1
make[2]: Leaving directory `/opt/ntop-3.3.10′
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/opt/ntop-3.3.10′
make: *** [all] Error 2

Reply

22 Nice Thomas June 26, 2010 at 4:31 am

Hi

I have tried installing ntop and installation is completed fine.
But the link http://serverip:3000 is now working
Mine is a vps. The /etc/sysconfig/iptables is an empty file.
I am a getting a page load error while accessing the link
http is up and running fine.
Do you have any idea why it is due to?

Reply

23 Ace July 30, 2010 at 3:40 am

hi, i am having

ERROR: gdbm header or library routines are missing…

Any ideas? I have installed:

gdbm-1.8.0-26.2.1

Reply

24 Pablo May 10, 2011 at 7:42 pm

Hi Ace, you need to install devel libraries try doing this
yum install libpcap-devel gdbm-deve
Cheers,
Pablo

Reply

25 Red July 30, 2010 at 4:20 am

I have geoip-1.4.6-1 installed but still I get:

Removing dups and misplaced entries from LIBS and INCS…
checking for GeoIP_record_by_ipnum in -lGeoIP… no
checking for GeoIP_name_by_ipnum_v6 in -lGeoIP… no
Please install GeoIP (http://www.maxmind.com/)

Is this an error or not?

Reply

26 chpego August 6, 2010 at 3:30 am

@ ACE : install libgdbm via yum => yum install libgdm -y
@ Red : yum install GeoIP GeoIP-devel

Reply

27 Nandakumar August 27, 2010 at 7:09 am

I am getting error

configure: error: Unable to find RRD at /usr/local/rrdtool: please use –with-rrd-home=DIR

But i have rrd tool installed. Please help me to solve….

Thanks,
Nandakumar.D

Reply

28 xut September 7, 2010 at 4:38 am

yum install cairo-devel libxml2-devel pango-devel pango libpng-devel freetype freetype-devel libart_lgpl-devel libpcap libpcap*
then install RRDTool
you can download RRDTool from http://oss.oetiker.ch

Reply

29 Christo September 17, 2010 at 2:36 am

Hi,

Getting the error below, I have added /usr/local/lib in ldconfig.conf and updated the cache but still showing the error.

/usr/local/bin/ntop: error while loading shared libraries: /usr/local/lib/libntopreport-4.0.1.so: cannot restore segment prot after reloc: Permission denied

Reply

30 Christo September 17, 2010 at 3:20 am

Fixed it, seems selinux was the issue.

http://www.gossamer-threads.com/lists/ntop/users/20506

you can either disable SELinux (if you’re sure you can live without it)

/etc/sysconfig/selinux:
SELINUX=disabled

or change the SELinux security context of the library file

/usr/bin/chcon system_u:object_r:textrel_shlib_t
/usr/local/lib/libntop-3.3.3.so

Reply

31 charlie December 28, 2010 at 7:54 am

This mean??? while I’m try to execute the startup of ntop

# /usr/local/bin/ntop -d -L -u ntop -P /usr/local/var/ntop –skip-version-check –use-syslog=daemon

**ERROR** ++++ DEMON MODE=1

Tue Dec 28 15:52:52 2010 NOTE: Interface merge enabled by default
Tue Dec 28 15:52:52 2010 Initializing gdbm databases
Tue Dec 28 15:52:52 2010 **ERROR** ++++ DEMON MODE=1

Reply

32 Sudheera March 28, 2011 at 6:24 am

I cant get complied ,

Just type make to compile ntop:
# make

wht can be the major reason?

Reply

33 Vince August 8, 2011 at 2:39 pm

Hi. Thanks for putting this tutorial together. After 2 days of tryhing to install this app, it’s working. I do have a question about an error that was pointed out above, but not answered. See below.

Do this error message mean that it was started, but not running as a daemon at start up? I do get data and able to see graphs.

Thanks for your help. Vince

# /usr/local/bin/ntop -d -L -u ntop -P /usr/local/var/ntop –skip-version-check –use-syslog=daemon

**ERROR** ++++ DEMON MODE=1

Tue Dec 28 15:52:52 2010 NOTE: Interface merge enabled by default
Tue Dec 28 15:52:52 2010 Initializing gdbm databases
Tue Dec 28 15:52:52 2010 **ERROR** ++++ DEMON MODE=1

Reply

34 niro March 14, 2012 at 1:38 pm

Great tutorial!

Thanks!

Reply

35 Nabyl July 24, 2012 at 1:12 pm

Great tutorial !
I got it to work, but how do I get it to run as a daemon : ie on centos to be able to use service ntop start/stop/status ?
thanks in advance

Reply

36 EnthY October 3, 2012 at 8:29 pm

for who’s try to install ntop on Centos, RedHat or OracleLinux 6 like me :)
yum install cairo-devel libxml2-devel pango-devel pango libpng-devel -y
yum install freetype freetype-devel libart_lgpl-devel wget gcc make -y
yum install perl-ExtUtils-MakeMaker -y
yum install graphviz -y

before the ./autogen.sh

it will help you

Reply

37 Vit July 1, 2013 at 9:26 am

this manual did not worked for me at Centos 5.x 64, ntop needed some “svn/subversion”, but i was not successfull installing it.

Reply

38 Max September 19, 2013 at 7:49 am

Could you please help me on this.

/usr/bin/ntop -i “eth0,eth1,eth2″ -d -L -u ntop -P /var/ntop –skip-version-check –use-syslog=daemon
Thu Sep 19 13:18:34 2013 NOTE: Interface merge enabled by default
Thu Sep 19 13:18:34 2013 Initializing gdbm databases
Thu Sep 19 13:18:34 2013 **ERROR** ….open of /var/ntop/prefsCache.db failed: Can’t be writer
Thu Sep 19 13:18:34 2013 Possible solution: please use ‘-P ‘
Thu Sep 19 13:18:34 2013 **FATAL_ERROR** GDBM open failed, ntop shutting down…
Thu Sep 19 13:18:34 2013 CLEANUP[t3086771920]: ntop caught signal 2 [state=2]
Thu Sep 19 13:18:34 2013 ntop is now quitting…

Reply

Leave a Comment

Tagged as: , , , , , , , , , , , , , ,

Previous Faq:

Next Faq: