Q. ntop is a network probe that shows network usage in a way similar to what top does for processes. How do I install latest version of ntop on RHEL 5.x systems?
A. ntop is a network and traffic analyzer that provides a wealth of information on various networking hosts and protocols. ntop is primarily accessed via a built-in web interface.
Following instructions are tested on 32/64 bit versions only:
a) RHEL Linux 5.x
b) CentOS Linux 5.x
Download latest ntop
Visit ntop project to grab latest version. You can use wget to grab the same, enter:
# cd /opt
# wget http://freshmeat.net/redir/ntop/7279/url_tgz/ntop-3.3.6.tar.gz
Untar tar ball, enter:
# tar -zxvf ntop-3.3.6.tar.gz
Configure and Compile ntop under RHEL
You must have RRDTool installed. You also need to install libpcap, enter:
# yum install libpcap-devel libpcap
Type the following commands to compile and install ntop:
# cd ntop
# ./autogen.sh
Just type make to compile ntop:
# make
Just type make install to install ntop:
# make install
# make install-data-as
Create ntop user
Type the following command to run ntop as ntop user, enter:
# useradd -M -s /sbin/nologin -r ntop
Setup directory permissions
Next, you need to setup directory permissions, enter:
# chown ntop:root /usr/local/var/ntop/
# chown ntop:ntop /usr/local/share/ntop/
Setup ntop user admin password
Type the following command to set ntop admin password, enter:
# ntop -A
Sample output:
Mon Jul 28 03:38:34 2008 NOTE: Interface merge enabled by default Mon Jul 28 03:38:34 2008 Initializing gdbm databases ntop startup - waiting for user response! Please enter the password for the admin user: Please enter the password again: Mon Jul 28 03:38:42 2008 Admin user password has been set
Start ntop
Type the following command to start ntop:
# /usr/local/bin/ntop -d -L -u ntop -P /usr/local/var/ntop --skip-version-check --use-syslog=daemon
Sample output:
Mon Jul 28 03:42:19 2008 NOTE: Interface merge enabled by default Mon Jul 28 03:42:19 2008 Initializing gdbm databases
If you have multiple interface (eth0, eth1 and so on), start ntop as follows:
# /usr/local/bin/ntop -i "eth0,eth1" -d -L -u ntop -P /usr/local/var/ntop --skip-version-check --use-syslog=daemon
Where,
- -i “eth0,eth1” : Specifies the network interface or interfaces to be used by ntop for network monitoring. Here you are monitoring eth0 and eth1.
- -d : Run ntop as a daemon.
- -L : Send all log messages to the system log (/var/log/messages) instead of screen.
- -u ntop : Start ntop as ntop user
- -P /usr/local/var/ntop : Specify where ntop stores database files. You may need to backup database as part of your disaster recovery program.
- –skip-version-check : By default, ntop accesses a remote file to periodically check if the most current version is running. This option disables that check.
- –use-syslog=daemon : Use syslog daemon.
How do I view ntop stats?
By default ntop listen on 3000 port. You can view ntop stats by visiting following url:
http://localhost:3000/
OR
http://server-ip:3000/
(Fig.01: ntop Global TCP/UDP Protocol Distribution Graphs [click to enlarge])
(Fig.02: Network Load Statistics (click to enlarge])
Open port 3000 using iptables
Open /etc/sysconfig/iptables file, enter:
# vi /etc/sysconfig/iptables
Append following code before final REJECT line:
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 3000 -j ACCEPT
Save and close the file. Restart firewall:
# service iptables restart
How do I view ntop stats without opening port 3000?
Setup simple tunnel using ssh, enter the following on your local UNIX / Linux desktop system:
$ ssh -L 3000:localhost:3000 -N -f [email protected]
Now open browser and type the following command:
http://localhost:3000/
How do I start ntop on boot?
Open /etc/rc.local file, enter:
# vi /etc/rc.local
Append the following line:
/usr/local/bin/ntop -i "eth0,eth1" -d -L -u ntop -P /usr/local/var/ntop --skip-version-check --use-syslog=daemon
Save and close the file.
How do I stop ntop?
Use web interface to shutdown ntop, or use normal kill / killall command:
# killall ntop
Further readings:
- ntop man page
- ntop project
38 comment
Thanks for the wonderful post Vivek. I have tried this out and it works flawlessly.
Maybe you need to mention that the installation of gdbm-devel as by default, I could not find that on the server. The other requirements are libtool automake autoconf.
So maybe someone would require to use this command as well:-
# yum install libtool automake autoconf gdbm-devel
Gagan,
No problem. Yes, deps may vary from one installation to other.
I appropriate your post.
Under the Centos5 you can install ntop natively by using rpmforge and epel repos.
I just enter the command:
“yum install ntop”
and voilà .) :
Resolving Dependencies
–> Running transaction check
—> Package ntop.i386 0:3.3.6-1.el5.rf set to be updated
–> Processing Dependency: librrd_th.so.2 for package: ntop
–> Running transaction check
—> Package rrdtool.i386 0:1.2.27-3.el5 set to be updated
–> Finished Dependency Resolution
===8<—–
Installed: ntop.i386 0:3.3.6-1.el5.rf
Dependency Installed: rrdtool.i386 0:1.2.27-3.el5
Complete!
dot22,
Thanks for pointing out rpmforge repos. I generally don’t mix 3rd party repos with RHEL (as I might break their TOS). But under CentOS I don’t mind using rpmforge.
hi i have problems in the installation here is it:
[[email protected] ~]# /usr/local/bin/ntop -i “eth0,eth1” -d -L -u ntop -P /usr/local/var/ntop –skip-version-check –use-syslog=daemon
Wed Nov 5 09:27:49 2008 NOTE: Interface merge enabled by default
Wed Nov 5 09:27:49 2008 Initializing gdbm databases
Wed Nov 5 09:27:49 2008 **ERROR** ….open of /usr/local/var/ntop/prefsCache.db failed: Can’t be writer
Wed Nov 5 09:27:49 2008 Possible solution: please use ‘-P ‘
Wed Nov 5 09:27:49 2008 **FATAL_ERROR** GDBM open failed, ntop shutting down…
Wed Nov 5 09:27:49 2008 CLEANUP[t3086464704]: ntop caught signal 2 [state=2]
Wed Nov 5 09:27:49 2008 ntop is now quitting…
what would be the possible solution to this….
same problem
Hi, How to install ntop v3.x + mySQL ?
Thanks for this post, I was running into a lot of compilation errors, and no other website out there had as clear instructions as you did. Thanks again !
Hi Ruben,
Just do the following first before invoking above command & you will be able to start ntop :-)
$ killall ntop
I follow your instructions (including on install rddtool), but autogen.sh is stuck with this error message:
configure: error: Unable to find RRD at /usr/local/rrdtool: please use –with-rrd-home=DIR
verifying:
[[email protected]:/usr/src/ntop-3.3.9#]: ls /usr/local/rrdtool
lrwxrwxrwx 1 root root 23 Abr 8 09:47 /usr/local/rrdtool -> /usr/src/rrdtool-1.3.6/
so, rrdtool IS there :(
any hint?
another question:
ntop is up and running BUT.. :
when asking for the graphical (network load or anyother) it show this:
“NOTE: this page is not operational when the RRD plugin is disabled, misconfigured or missing.”
in the configuration, the rrd plugin is ENABLED (shows ‘yes’).
now I am stuck :(
any advice, PLEASE?
You have to change ownership of the ntop directory to ntop user by running something like this for a compiled version of ntop.
chown -R ntop /usr/local/var/ntop
For an rpm version of ntop, it would be this command.
chown -R ntop /var/ntop
Hope this helps.
I have a problem doing install in method make install
cp: cannot stat `GeoLiteCity.dat’: No such file or directory
make[2]: *** [install-data-local] Error 1
make[2]: Leaving directory `/usr/local/ntop-3.3.10-rc1′
make[1]: *** [install-am] Error 2
make[1]: Leaving directory `/usr/local/ntop-3.3.10-rc1′
make: *** [install-recursive] Error 1
how to solve it, Thank you.
mkdir -p — //usr/local/etc/ntop
cp: cannot stat `GeoLiteCity.dat’: No such file or directory
make[2]: *** [install-data-local] Error 1
make[2]: Leaving directory `/root/ntop-3.3.9′
make[1]: *** [install-am] Error 2
make[1]: Leaving directory `/root/ntop-3.3.9′
make: *** [install-recursive] Error 1
[[email protected] ntop-3.3.9]#
Hello Vivek,
I m not able to view graphs.
When i click on “Network Load”, gives below error
Error: NOTE: this page is not operational when the RRD plugin is disabled, misconfigured or missing. Please check the ntop log file.
Below are the permission.
[email protected] [/usr/local/var/ntop/rrd]# ll
total 10
drwxr-xr-x 5 ntop ntop 2048 Jul 21 13:31 ./
drwxr-xr-x 3 ntop root 2048 Jul 22 14:31 ../
drwxrwxrwx 8 ntop ntop 2048 Jul 22 14:26 flows/
drwxrwxrwx 2 ntop ntop 2048 Jul 21 13:31 graphics/
drwxrwxrwx 3 ntop ntop 2048 Jul 21 13:31 interfaces/
Below is the log.
Wed Jul 22 14:31:29 2009 **ERROR** RRD: Disabled – unable to create directory (err 13, /usr/local/var/ntop/rrd/graphics)
Regards,
Mihirj
I noticed rrd didn’t work for me if I started `ntop -d` as a daemon. If I started it without the the -d flag as `ntop &` the rrd graphs work fine. I’m using v.3.3.11-dev which warns of possible funny business. Overall, the tool built easily and is completely awesome for monitoring network traffic!
Thanks m++, that worked for me too..
I started Ntop without the daemon option..
But one thing I noticed, wen I ran ntop, it would load, but I cant have access to the web interface..
Sorted that out by running
#ntop -W 3001 (this runs as a daemon)
#stop Ntop
#/etc/init.d/ntop start –
That worked..
cp: cannot stat `GeoLiteCity.dat’: No such file or directory
make[2]: *** [install-data-local] Error 1
make[2]: Leaving directory `/usr/local/ntop-3.3.10-rc1′
make[1]: *** [install-am] Error 2
make[1]: Leaving directory `/usr/local/ntop-3.3.10-rc1′
make: *** [install-recursive] Error 1
how to solve it, Thank you.
i install ntop from rpm . when i start the ntop it starts well but after sometime it automatically stops
The provided link is not present. Please check.
wget http://freshmeat.net/redir/ntop/7279/url_tgz/ntop-3.3.6.tar.gz
I m getting error when i use make command
plzzz help me
ntop.h:417:19: error: evdns.h: No such file or directory
address.c: In function ‘dns_response_callback’:
address.c:123: error: ‘DNS_ERR_NONE’ undeclared (first use in this function)
address.c:123: error: (Each undeclared identifier is reported only once
address.c:123: error: for each function it appears in.)
address.c:129: error: ‘DNS_IPv6_AAAA’ undeclared (first use in this function)
address.c:142: warning: assignment discards qualifiers from pointer target type
address.c:150: error: ‘DNS_IPv4_A’ undeclared (first use in this function)
address.c:164: error: ‘DNS_PTR’ undeclared (first use in this function)
address.c: In function ‘queueAddress’:
address.c:243: warning: nested extern declaration of ‘evdns_resolve_reverse’
address.c:243: error: ‘DNS_ERR_NONE’ undeclared (first use in this function)
address.c:249: warning: nested extern declaration of ‘evdns_resolve_reverse_ipv6′
make[2]: *** [address.lo] Error 1
make[2]: Leaving directory `/opt/ntop-3.3.10′
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/opt/ntop-3.3.10’
make: *** [all] Error 2
Hi
I have tried installing ntop and installation is completed fine.
But the link http://serverip:3000 is now working
Mine is a vps. The /etc/sysconfig/iptables is an empty file.
I am a getting a page load error while accessing the link
http is up and running fine.
Do you have any idea why it is due to?
hi, i am having
ERROR: gdbm header or library routines are missing…
Any ideas? I have installed:
gdbm-1.8.0-26.2.1
Hi Ace, you need to install devel libraries try doing this
yum install libpcap-devel gdbm-deve
Cheers,
Pablo
I have geoip-1.4.6-1 installed but still I get:
Removing dups and misplaced entries from LIBS and INCS…
checking for GeoIP_record_by_ipnum in -lGeoIP… no
checking for GeoIP_name_by_ipnum_v6 in -lGeoIP… no
Please install GeoIP (http://www.maxmind.com/)
Is this an error or not?
@ ACE : install libgdbm via yum => yum install libgdm -y
@ Red : yum install GeoIP GeoIP-devel
I am getting error
configure: error: Unable to find RRD at /usr/local/rrdtool: please use –with-rrd-home=DIR
But i have rrd tool installed. Please help me to solve….
Thanks,
Nandakumar.D
yum install cairo-devel libxml2-devel pango-devel pango libpng-devel freetype freetype-devel libart_lgpl-devel libpcap libpcap*
then install RRDTool
you can download RRDTool from http://oss.oetiker.ch
Hi,
Getting the error below, I have added /usr/local/lib in ldconfig.conf and updated the cache but still showing the error.
/usr/local/bin/ntop: error while loading shared libraries: /usr/local/lib/libntopreport-4.0.1.so: cannot restore segment prot after reloc: Permission denied
Fixed it, seems selinux was the issue.
http://www.gossamer-threads.com/lists/ntop/users/20506
you can either disable SELinux (if you’re sure you can live without it)
/etc/sysconfig/selinux:
SELINUX=disabled
or change the SELinux security context of the library file
/usr/bin/chcon system_u:object_r:textrel_shlib_t
/usr/local/lib/libntop-3.3.3.so
This mean??? while I’m try to execute the startup of ntop
# /usr/local/bin/ntop -d -L -u ntop -P /usr/local/var/ntop –skip-version-check –use-syslog=daemon
**ERROR** ++++ DEMON MODE=1
Tue Dec 28 15:52:52 2010 NOTE: Interface merge enabled by default
Tue Dec 28 15:52:52 2010 Initializing gdbm databases
Tue Dec 28 15:52:52 2010 **ERROR** ++++ DEMON MODE=1
I cant get complied ,
Just type make to compile ntop:
# make
wht can be the major reason?
Hi. Thanks for putting this tutorial together. After 2 days of tryhing to install this app, it’s working. I do have a question about an error that was pointed out above, but not answered. See below.
Do this error message mean that it was started, but not running as a daemon at start up? I do get data and able to see graphs.
Thanks for your help. Vince
# /usr/local/bin/ntop -d -L -u ntop -P /usr/local/var/ntop –skip-version-check –use-syslog=daemon
**ERROR** ++++ DEMON MODE=1
Tue Dec 28 15:52:52 2010 NOTE: Interface merge enabled by default
Tue Dec 28 15:52:52 2010 Initializing gdbm databases
Tue Dec 28 15:52:52 2010 **ERROR** ++++ DEMON MODE=1
Great tutorial!
Thanks!
Great tutorial !
I got it to work, but how do I get it to run as a daemon : ie on centos to be able to use service ntop start/stop/status ?
thanks in advance
for who’s try to install ntop on Centos, RedHat or OracleLinux 6 like me :)
yum install cairo-devel libxml2-devel pango-devel pango libpng-devel -y
yum install freetype freetype-devel libart_lgpl-devel wget gcc make -y
yum install perl-ExtUtils-MakeMaker -y
yum install graphviz -y
before the ./autogen.sh
it will help you
this manual did not worked for me at Centos 5.x 64, ntop needed some “svn/subversion”, but i was not successfull installing it.
Could you please help me on this.
/usr/bin/ntop -i “eth0,eth1,eth2” -d -L -u ntop -P /var/ntop –skip-version-check –use-syslog=daemon
Thu Sep 19 13:18:34 2013 NOTE: Interface merge enabled by default
Thu Sep 19 13:18:34 2013 Initializing gdbm databases
Thu Sep 19 13:18:34 2013 **ERROR** ….open of /var/ntop/prefsCache.db failed: Can’t be writer
Thu Sep 19 13:18:34 2013 Possible solution: please use ‘-P ‘
Thu Sep 19 13:18:34 2013 **FATAL_ERROR** GDBM open failed, ntop shutting down…
Thu Sep 19 13:18:34 2013 CLEANUP[t3086771920]: ntop caught signal 2 [state=2]
Thu Sep 19 13:18:34 2013 ntop is now quitting…