≡ Menu

Install ntop on Red Hat Enterprise Linux / CentOS Linux

Q. ntop is a network probe that shows network usage in a way similar to what top does for processes. How do I install latest version of ntop on RHEL 5.x systems?

A. ntop is a network and traffic analyzer that provides a wealth of information on various networking hosts and protocols. ntop is primarily accessed via a built-in web interface.

Following instructions are tested on 32/64 bit versions only:
a) RHEL Linux 5.x
b) CentOS Linux 5.x

Download latest ntop

Visit ntop project to grab latest version. You can use wget to grab the same, enter:
# cd /opt
# wget http://freshmeat.net/redir/ntop/7279/url_tgz/ntop-3.3.6.tar.gz

Untar tar ball, enter:
# tar -zxvf ntop-3.3.6.tar.gz

Configure and Compile ntop under RHEL

You must have RRDTool installed. You also need to install libpcap, enter:
# yum install libpcap-devel libpcap
Type the following commands to compile and install ntop:
# cd ntop
# ./autogen.sh

Just type make to compile ntop:
# make
Just type make install to install ntop:
# make install
# make install-data-as

Create ntop user

Type the following command to run ntop as ntop user, enter:
# useradd -M -s /sbin/nologin -r ntop

Setup directory permissions

Next, you need to setup directory permissions, enter:
# chown ntop:root /usr/local/var/ntop/
# chown ntop:ntop /usr/local/share/ntop/

Setup ntop user admin password

Type the following command to set ntop admin password, enter:
# ntop -A
Sample output:

Mon Jul 28 03:38:34 2008  NOTE: Interface merge enabled by default
Mon Jul 28 03:38:34 2008  Initializing gdbm databases
ntop startup - waiting for user response!
Please enter the password for the admin user:
Please enter the password again:
Mon Jul 28 03:38:42 2008  Admin user password has been set

Start ntop

Type the following command to start ntop:
# /usr/local/bin/ntop -d -L -u ntop -P /usr/local/var/ntop --skip-version-check --use-syslog=daemon
Sample output:

Mon Jul 28 03:42:19 2008  NOTE: Interface merge enabled by default
Mon Jul 28 03:42:19 2008  Initializing gdbm databases

If you have multiple interface (eth0, eth1 and so on), start ntop as follows:
# /usr/local/bin/ntop -i "eth0,eth1" -d -L -u ntop -P /usr/local/var/ntop --skip-version-check --use-syslog=daemon
Where,

  • -i "eth0,eth1" : Specifies the network interface or interfaces to be used by ntop for network monitoring. Here you are monitoring eth0 and eth1.
  • -d : Run ntop as a daemon.
  • -L : Send all log messages to the system log (/var/log/messages) instead of screen.
  • -u ntop : Start ntop as ntop user
  • -P /usr/local/var/ntop : Specify where ntop stores database files. You may need to backup database as part of your disaster recovery program.
  • --skip-version-check : By default, ntop accesses a remote file to periodically check if the most current version is running. This option disables that check.
  • --use-syslog=daemon : Use syslog daemon.

How do I view ntop stats?

By default ntop listen on 3000 port. You can view ntop stats by visiting following url:
http://localhost:3000/
OR
http://server-ip:3000/
ntop in action
(Fig.01: ntop Global TCP/UDP Protocol Distribution Graphs [click to enlarge])

(Fig.02: Network Load Statistics (click to enlarge])

Open port 3000 using iptables

Open /etc/sysconfig/iptables file, enter:
# vi /etc/sysconfig/iptables
Append following code before final REJECT line:
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 3000 -j ACCEPT
Save and close the file. Restart firewall:
# service iptables restart

How do I view ntop stats without opening port 3000?

Setup simple tunnel using ssh, enter the following on your local UNIX / Linux desktop system:
$ ssh -L 3000:localhost:3000 -N -f user@server.yourcorp.com
Now open browser and type the following command:
http://localhost:3000/

How do I start ntop on boot?

Open /etc/rc.local file, enter:
# vi /etc/rc.local
Append the following line:
/usr/local/bin/ntop -i "eth0,eth1" -d -L -u ntop -P /usr/local/var/ntop --skip-version-check --use-syslog=daemon
Save and close the file.

How do I stop ntop?

Use web interface to shutdown ntop, or use normal kill / killall command:
# killall ntop

Further readings:

Tweet itFacebook itGoogle+ itPDF itFound an error/typo on this page?

{ 38 comments… add one }

  • Gagan Brahmi July 29, 2008, 11:58 am

    Thanks for the wonderful post Vivek. I have tried this out and it works flawlessly.

    Maybe you need to mention that the installation of gdbm-devel as by default, I could not find that on the server. The other requirements are libtool automake autoconf.

    So maybe someone would require to use this command as well:-

    # yum install libtool automake autoconf gdbm-devel

  • nixCraft July 29, 2008, 12:28 pm

    Gagan,

    No problem. Yes, deps may vary from one installation to other.

    I appropriate your post.

  • dot22 July 29, 2008, 12:44 pm

    Under the Centos5 you can install ntop natively by using rpmforge and epel repos.
    I just enter the command:
    “yum install ntop”
    and voilà .) :

    Resolving Dependencies
    –> Running transaction check
    —> Package ntop.i386 0:3.3.6-1.el5.rf set to be updated
    –> Processing Dependency: librrd_th.so.2 for package: ntop
    –> Running transaction check
    —> Package rrdtool.i386 0:1.2.27-3.el5 set to be updated
    –> Finished Dependency Resolution
    ===8<—–
    Installed: ntop.i386 0:3.3.6-1.el5.rf
    Dependency Installed: rrdtool.i386 0:1.2.27-3.el5
    Complete!

  • nixCraft July 29, 2008, 12:46 pm

    dot22,

    Thanks for pointing out rpmforge repos. I generally don’t mix 3rd party repos with RHEL (as I might break their TOS). But under CentOS I don’t mind using rpmforge.

  • Ruben November 5, 2008, 1:06 pm

    hi i have problems in the installation here is it:

    [root@124 ~]# /usr/local/bin/ntop -i “eth0,eth1″ -d -L -u ntop -P /usr/local/var/ntop –skip-version-check –use-syslog=daemon
    Wed Nov 5 09:27:49 2008 NOTE: Interface merge enabled by default
    Wed Nov 5 09:27:49 2008 Initializing gdbm databases
    Wed Nov 5 09:27:49 2008 **ERROR** ….open of /usr/local/var/ntop/prefsCache.db failed: Can’t be writer
    Wed Nov 5 09:27:49 2008 Possible solution: please use ‘-P ‘
    Wed Nov 5 09:27:49 2008 **FATAL_ERROR** GDBM open failed, ntop shutting down…
    Wed Nov 5 09:27:49 2008 CLEANUP[t3086464704]: ntop caught signal 2 [state=2]
    Wed Nov 5 09:27:49 2008 ntop is now quitting…

    what would be the possible solution to this….

    • same July 30, 2010, 6:07 am

      same problem

  • Tommy December 16, 2008, 11:51 am

    Hi, How to install ntop v3.x + mySQL ?

  • LJ January 30, 2009, 11:59 am

    Thanks for this post, I was running into a lot of compilation errors, and no other website out there had as clear instructions as you did. Thanks again !

  • shrirang March 7, 2009, 10:33 am

    Hi Ruben,

    Just do the following first before invoking above command & you will be able to start ntop :-)

    $ killall ntop

  • irado April 8, 2009, 1:10 pm

    I follow your instructions (including on install rddtool), but autogen.sh is stuck with this error message:

    configure: error: Unable to find RRD at /usr/local/rrdtool: please use –with-rrd-home=DIR

    verifying:

    [root@HPAllan:/usr/src/ntop-3.3.9#]: ls /usr/local/rrdtool
    lrwxrwxrwx 1 root root 23 Abr 8 09:47 /usr/local/rrdtool -> /usr/src/rrdtool-1.3.6/

    so, rrdtool IS there :(

    any hint?

  • irado April 8, 2009, 1:22 pm

    another question:
    ntop is up and running BUT.. :
    when asking for the graphical (network load or anyother) it show this:
    “NOTE: this page is not operational when the RRD plugin is disabled, misconfigured or missing.”

    in the configuration, the rrd plugin is ENABLED (shows ‘yes’).

    now I am stuck :(

    any advice, PLEASE?

    • Eugene Frakt September 7, 2010, 9:00 pm

      You have to change ownership of the ntop directory to ntop user by running something like this for a compiled version of ntop.
      chown -R ntop /usr/local/var/ntop

      For an rpm version of ntop, it would be this command.
      chown -R ntop /var/ntop

      Hope this helps.

  • Thanuwat May 18, 2009, 10:47 am

    I have a problem doing install in method make install

    cp: cannot stat `GeoLiteCity.dat': No such file or directory
    make[2]: *** [install-data-local] Error 1
    make[2]: Leaving directory `/usr/local/ntop-3.3.10-rc1′
    make[1]: *** [install-am] Error 2
    make[1]: Leaving directory `/usr/local/ntop-3.3.10-rc1′
    make: *** [install-recursive] Error 1

    how to solve it, Thank you.

  • Saeid May 24, 2009, 12:22 am

    mkdir -p — //usr/local/etc/ntop
    cp: cannot stat `GeoLiteCity.dat': No such file or directory
    make[2]: *** [install-data-local] Error 1
    make[2]: Leaving directory `/root/ntop-3.3.9′
    make[1]: *** [install-am] Error 2
    make[1]: Leaving directory `/root/ntop-3.3.9′
    make: *** [install-recursive] Error 1
    [root@localhost ntop-3.3.9]#

  • Mihir Joshi July 22, 2009, 4:39 am

    Hello Vivek,

    I m not able to view graphs.
    When i click on “Network Load”, gives below error
    Error: NOTE: this page is not operational when the RRD plugin is disabled, misconfigured or missing. Please check the ntop log file.

    Below are the permission.
    root@scare [/usr/local/var/ntop/rrd]# ll
    total 10
    drwxr-xr-x 5 ntop ntop 2048 Jul 21 13:31 ./
    drwxr-xr-x 3 ntop root 2048 Jul 22 14:31 ../
    drwxrwxrwx 8 ntop ntop 2048 Jul 22 14:26 flows/
    drwxrwxrwx 2 ntop ntop 2048 Jul 21 13:31 graphics/
    drwxrwxrwx 3 ntop ntop 2048 Jul 21 13:31 interfaces/

    Below is the log.
    Wed Jul 22 14:31:29 2009 **ERROR** RRD: Disabled – unable to create directory (err 13, /usr/local/var/ntop/rrd/graphics)

    Regards,
    Mihirj

  • m++ August 9, 2009, 5:37 am

    I noticed rrd didn’t work for me if I started `ntop -d` as a daemon. If I started it without the the -d flag as `ntop &` the rrd graphs work fine. I’m using v.3.3.11-dev which warns of possible funny business. Overall, the tool built easily and is completely awesome for monitoring network traffic!

    • Casey March 10, 2011, 1:46 pm

      Thanks m++, that worked for me too..
      I started Ntop without the daemon option..

      But one thing I noticed, wen I ran ntop, it would load, but I cant have access to the web interface..
      Sorted that out by running
      #ntop -W 3001 (this runs as a daemon)
      #stop Ntop
      #/etc/init.d/ntop start –

      That worked..

  • charles August 27, 2009, 7:06 pm

    cp: cannot stat `GeoLiteCity.dat’: No such file or directory
    make[2]: *** [install-data-local] Error 1
    make[2]: Leaving directory `/usr/local/ntop-3.3.10-rc1′
    make[1]: *** [install-am] Error 2
    make[1]: Leaving directory `/usr/local/ntop-3.3.10-rc1′
    make: *** [install-recursive] Error 1

    how to solve it, Thank you.

  • praveen September 24, 2009, 5:39 am

    i install ntop from rpm . when i start the ntop it starts well but after sometime it automatically stops

  • Nishth Vyas December 7, 2009, 7:56 am

    The provided link is not present. Please check.
    wget http://freshmeat.net/redir/ntop/7279/url_tgz/ntop-3.3.6.tar.gz

  • Sachin Gholap January 14, 2010, 7:51 am

    I m getting error when i use make command
    plzzz help me
    ntop.h:417:19: error: evdns.h: No such file or directory
    address.c: In function ‘dns_response_callback':
    address.c:123: error: ‘DNS_ERR_NONE’ undeclared (first use in this function)
    address.c:123: error: (Each undeclared identifier is reported only once
    address.c:123: error: for each function it appears in.)
    address.c:129: error: ‘DNS_IPv6_AAAA’ undeclared (first use in this function)
    address.c:142: warning: assignment discards qualifiers from pointer target type
    address.c:150: error: ‘DNS_IPv4_A’ undeclared (first use in this function)
    address.c:164: error: ‘DNS_PTR’ undeclared (first use in this function)
    address.c: In function ‘queueAddress':
    address.c:243: warning: nested extern declaration of ‘evdns_resolve_reverse’
    address.c:243: error: ‘DNS_ERR_NONE’ undeclared (first use in this function)
    address.c:249: warning: nested extern declaration of ‘evdns_resolve_reverse_ipv6′
    make[2]: *** [address.lo] Error 1
    make[2]: Leaving directory `/opt/ntop-3.3.10′
    make[1]: *** [all-recursive] Error 1
    make[1]: Leaving directory `/opt/ntop-3.3.10′
    make: *** [all] Error 2

  • Nice Thomas June 26, 2010, 4:31 am

    Hi

    I have tried installing ntop and installation is completed fine.
    But the link http://serverip:3000 is now working
    Mine is a vps. The /etc/sysconfig/iptables is an empty file.
    I am a getting a page load error while accessing the link
    http is up and running fine.
    Do you have any idea why it is due to?

  • Ace July 30, 2010, 3:40 am

    hi, i am having

    ERROR: gdbm header or library routines are missing…

    Any ideas? I have installed:

    gdbm-1.8.0-26.2.1

    • Pablo May 10, 2011, 7:42 pm

      Hi Ace, you need to install devel libraries try doing this
      yum install libpcap-devel gdbm-deve
      Cheers,
      Pablo

  • Red July 30, 2010, 4:20 am

    I have geoip-1.4.6-1 installed but still I get:

    Removing dups and misplaced entries from LIBS and INCS…
    checking for GeoIP_record_by_ipnum in -lGeoIP… no
    checking for GeoIP_name_by_ipnum_v6 in -lGeoIP… no
    Please install GeoIP (http://www.maxmind.com/)

    Is this an error or not?

  • chpego August 6, 2010, 3:30 am

    @ ACE : install libgdbm via yum => yum install libgdm -y
    @ Red : yum install GeoIP GeoIP-devel

  • Nandakumar August 27, 2010, 7:09 am

    I am getting error

    configure: error: Unable to find RRD at /usr/local/rrdtool: please use –with-rrd-home=DIR

    But i have rrd tool installed. Please help me to solve….

    Thanks,
    Nandakumar.D

    • xut September 7, 2010, 4:38 am

      yum install cairo-devel libxml2-devel pango-devel pango libpng-devel freetype freetype-devel libart_lgpl-devel libpcap libpcap*
      then install RRDTool
      you can download RRDTool from http://oss.oetiker.ch

  • Christo September 17, 2010, 2:36 am

    Hi,

    Getting the error below, I have added /usr/local/lib in ldconfig.conf and updated the cache but still showing the error.

    /usr/local/bin/ntop: error while loading shared libraries: /usr/local/lib/libntopreport-4.0.1.so: cannot restore segment prot after reloc: Permission denied

    • Christo September 17, 2010, 3:20 am

      Fixed it, seems selinux was the issue.

      http://www.gossamer-threads.com/lists/ntop/users/20506

      you can either disable SELinux (if you’re sure you can live without it)

      /etc/sysconfig/selinux:
      SELINUX=disabled

      or change the SELinux security context of the library file

      /usr/bin/chcon system_u:object_r:textrel_shlib_t
      /usr/local/lib/libntop-3.3.3.so

  • charlie December 28, 2010, 7:54 am

    This mean??? while I’m try to execute the startup of ntop

    # /usr/local/bin/ntop -d -L -u ntop -P /usr/local/var/ntop –skip-version-check –use-syslog=daemon

    **ERROR** ++++ DEMON MODE=1

    Tue Dec 28 15:52:52 2010 NOTE: Interface merge enabled by default
    Tue Dec 28 15:52:52 2010 Initializing gdbm databases
    Tue Dec 28 15:52:52 2010 **ERROR** ++++ DEMON MODE=1

  • Sudheera March 28, 2011, 6:24 am

    I cant get complied ,

    Just type make to compile ntop:
    # make

    wht can be the major reason?

  • Vince August 8, 2011, 2:39 pm

    Hi. Thanks for putting this tutorial together. After 2 days of tryhing to install this app, it’s working. I do have a question about an error that was pointed out above, but not answered. See below.

    Do this error message mean that it was started, but not running as a daemon at start up? I do get data and able to see graphs.

    Thanks for your help. Vince

    # /usr/local/bin/ntop -d -L -u ntop -P /usr/local/var/ntop –skip-version-check –use-syslog=daemon

    **ERROR** ++++ DEMON MODE=1

    Tue Dec 28 15:52:52 2010 NOTE: Interface merge enabled by default
    Tue Dec 28 15:52:52 2010 Initializing gdbm databases
    Tue Dec 28 15:52:52 2010 **ERROR** ++++ DEMON MODE=1

  • niro March 14, 2012, 1:38 pm

    Great tutorial!

    Thanks!

  • Nabyl July 24, 2012, 1:12 pm

    Great tutorial !
    I got it to work, but how do I get it to run as a daemon : ie on centos to be able to use service ntop start/stop/status ?
    thanks in advance

  • EnthY October 3, 2012, 8:29 pm

    for who’s try to install ntop on Centos, RedHat or OracleLinux 6 like me :)
    yum install cairo-devel libxml2-devel pango-devel pango libpng-devel -y
    yum install freetype freetype-devel libart_lgpl-devel wget gcc make -y
    yum install perl-ExtUtils-MakeMaker -y
    yum install graphviz -y

    before the ./autogen.sh

    it will help you

  • Vit July 1, 2013, 9:26 am

    this manual did not worked for me at Centos 5.x 64, ntop needed some “svn/subversion”, but i was not successfull installing it.

  • Max September 19, 2013, 7:49 am

    Could you please help me on this.

    /usr/bin/ntop -i “eth0,eth1,eth2″ -d -L -u ntop -P /var/ntop –skip-version-check –use-syslog=daemon
    Thu Sep 19 13:18:34 2013 NOTE: Interface merge enabled by default
    Thu Sep 19 13:18:34 2013 Initializing gdbm databases
    Thu Sep 19 13:18:34 2013 **ERROR** ….open of /var/ntop/prefsCache.db failed: Can’t be writer
    Thu Sep 19 13:18:34 2013 Possible solution: please use ‘-P ‘
    Thu Sep 19 13:18:34 2013 **FATAL_ERROR** GDBM open failed, ntop shutting down…
    Thu Sep 19 13:18:34 2013 CLEANUP[t3086771920]: ntop caught signal 2 [state=2]
    Thu Sep 19 13:18:34 2013 ntop is now quitting…

Leave a Comment