≡ Menu

Install ntop on Red Hat Enterprise Linux / CentOS Linux

Q. ntop is a network probe that shows network usage in a way similar to what top does for processes. How do I install latest version of ntop on RHEL 5.x systems?

A. ntop is a network and traffic analyzer that provides a wealth of information on various networking hosts and protocols. ntop is primarily accessed via a built-in web interface.

Following instructions are tested on 32/64 bit versions only:
a) RHEL Linux 5.x
b) CentOS Linux 5.x

Download latest ntop

Visit ntop project to grab latest version. You can use wget to grab the same, enter:
# cd /opt
# wget http://freshmeat.net/redir/ntop/7279/url_tgz/ntop-3.3.6.tar.gz

Untar tar ball, enter:
# tar -zxvf ntop-3.3.6.tar.gz

Configure and Compile ntop under RHEL

You must have RRDTool installed. You also need to install libpcap, enter:
# yum install libpcap-devel libpcap
Type the following commands to compile and install ntop:
# cd ntop
# ./autogen.sh

Just type make to compile ntop:
# make
Just type make install to install ntop:
# make install
# make install-data-as

Create ntop user

Type the following command to run ntop as ntop user, enter:
# useradd -M -s /sbin/nologin -r ntop

Setup directory permissions

Next, you need to setup directory permissions, enter:
# chown ntop:root /usr/local/var/ntop/
# chown ntop:ntop /usr/local/share/ntop/

Setup ntop user admin password

Type the following command to set ntop admin password, enter:
# ntop -A
Sample output:

Mon Jul 28 03:38:34 2008  NOTE: Interface merge enabled by default
Mon Jul 28 03:38:34 2008  Initializing gdbm databases


ntop startup - waiting for user response!


Please enter the password for the admin user: 
Please enter the password again: 
Mon Jul 28 03:38:42 2008  Admin user password has been set

Start ntop

Type the following command to start ntop:
# /usr/local/bin/ntop -d -L -u ntop -P /usr/local/var/ntop --skip-version-check --use-syslog=daemon
Sample output:

Mon Jul 28 03:42:19 2008  NOTE: Interface merge enabled by default
Mon Jul 28 03:42:19 2008  Initializing gdbm databases

If you have multiple interface (eth0, eth1 and so on), start ntop as follows:
# /usr/local/bin/ntop -i "eth0,eth1" -d -L -u ntop -P /usr/local/var/ntop --skip-version-check --use-syslog=daemon
Where,

  • -i “eth0,eth1” : Specifies the network interface or interfaces to be used by ntop for network monitoring. Here you are monitoring eth0 and eth1.
  • -d : Run ntop as a daemon.
  • -L : Send all log messages to the system log (/var/log/messages) instead of screen.
  • -u ntop : Start ntop as ntop user
  • -P /usr/local/var/ntop : Specify where ntop stores database files. You may need to backup database as part of your disaster recovery program.
  • –skip-version-check : By default, ntop accesses a remote file to periodically check if the most current version is running. This option disables that check.
  • –use-syslog=daemon : Use syslog daemon.

How do I view ntop stats?

By default ntop listen on 3000 port. You can view ntop stats by visiting following url:
http://localhost:3000/
OR
http://server-ip:3000/
ntop in action
(Fig.01: ntop Global TCP/UDP Protocol Distribution Graphs [click to enlarge])

(Fig.02: Network Load Statistics (click to enlarge])

Open port 3000 using iptables

Open /etc/sysconfig/iptables file, enter:
# vi /etc/sysconfig/iptables
Append following code before final REJECT line:
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 3000 -j ACCEPT
Save and close the file. Restart firewall:
# service iptables restart

How do I view ntop stats without opening port 3000?

Setup simple tunnel using ssh, enter the following on your local UNIX / Linux desktop system:
$ ssh -L 3000:localhost:3000 -N -f user@server.yourcorp.com
Now open browser and type the following command:
http://localhost:3000/

How do I start ntop on boot?

Open /etc/rc.local file, enter:
# vi /etc/rc.local
Append the following line:
/usr/local/bin/ntop -i "eth0,eth1" -d -L -u ntop -P /usr/local/var/ntop --skip-version-check --use-syslog=daemon
Save and close the file.

How do I stop ntop?

Use web interface to shutdown ntop, or use normal kill / killall command:
# killall ntop

Further readings:

Share this tutorial on:

Your support makes a big difference:
I have a small favor to ask. More people are reading the nixCraft. Many of you block advertising which is your right, and advertising revenues are not sufficient to cover my operating costs. So you can see why I need to ask for your help. The nixCraft, takes a lot of my time and hard work to produce. If you use nixCraft, who likes it, helps me with donations:
Become a Supporter →    Make a contribution via Paypal/Bitcoin →   

Don't Miss Any Linux and Unix Tips

Get nixCraft in your inbox. It's free:



{ 38 comments… add one }
  • Gagan Brahmi July 29, 2008, 11:58 am

    Thanks for the wonderful post Vivek. I have tried this out and it works flawlessly.

    Maybe you need to mention that the installation of gdbm-devel as by default, I could not find that on the server. The other requirements are libtool automake autoconf.

    So maybe someone would require to use this command as well:-

    # yum install libtool automake autoconf gdbm-devel

  • nixCraft July 29, 2008, 12:28 pm

    Gagan,

    No problem. Yes, deps may vary from one installation to other.

    I appropriate your post.

  • dot22 July 29, 2008, 12:44 pm

    Under the Centos5 you can install ntop natively by using rpmforge and epel repos.
    I just enter the command:
    “yum install ntop”
    and voilà .) :

    Resolving Dependencies
    –> Running transaction check
    —> Package ntop.i386 0:3.3.6-1.el5.rf set to be updated
    –> Processing Dependency: librrd_th.so.2 for package: ntop
    –> Running transaction check
    —> Package rrdtool.i386 0:1.2.27-3.el5 set to be updated
    –> Finished Dependency Resolution
    ===8<—–
    Installed: ntop.i386 0:3.3.6-1.el5.rf
    Dependency Installed: rrdtool.i386 0:1.2.27-3.el5
    Complete!

  • nixCraft July 29, 2008, 12:46 pm

    dot22,

    Thanks for pointing out rpmforge repos. I generally don’t mix 3rd party repos with RHEL (as I might break their TOS). But under CentOS I don’t mind using rpmforge.

  • Ruben November 5, 2008, 1:06 pm

    hi i have problems in the installation here is it:

    [root@124 ~]# /usr/local/bin/ntop -i “eth0,eth1” -d -L -u ntop -P /usr/local/var/ntop –skip-version-check –use-syslog=daemon
    Wed Nov 5 09:27:49 2008 NOTE: Interface merge enabled by default
    Wed Nov 5 09:27:49 2008 Initializing gdbm databases
    Wed Nov 5 09:27:49 2008 **ERROR** ….open of /usr/local/var/ntop/prefsCache.db failed: Can’t be writer
    Wed Nov 5 09:27:49 2008 Possible solution: please use ‘-P ‘
    Wed Nov 5 09:27:49 2008 **FATAL_ERROR** GDBM open failed, ntop shutting down…
    Wed Nov 5 09:27:49 2008 CLEANUP[t3086464704]: ntop caught signal 2 [state=2]
    Wed Nov 5 09:27:49 2008 ntop is now quitting…

    what would be the possible solution to this….

    • same July 30, 2010, 6:07 am

      same problem

  • Tommy December 16, 2008, 11:51 am

    Hi, How to install ntop v3.x + mySQL ?

  • LJ January 30, 2009, 11:59 am

    Thanks for this post, I was running into a lot of compilation errors, and no other website out there had as clear instructions as you did. Thanks again !

  • shrirang March 7, 2009, 10:33 am

    Hi Ruben,

    Just do the following first before invoking above command & you will be able to start ntop :-)

    $ killall ntop

  • irado April 8, 2009, 1:10 pm

    I follow your instructions (including on install rddtool), but autogen.sh is stuck with this error message:

    configure: error: Unable to find RRD at /usr/local/rrdtool: please use –with-rrd-home=DIR

    verifying:

    [root@HPAllan:/usr/src/ntop-3.3.9#]: ls /usr/local/rrdtool
    lrwxrwxrwx 1 root root 23 Abr 8 09:47 /usr/local/rrdtool -> /usr/src/rrdtool-1.3.6/

    so, rrdtool IS there :(

    any hint?

  • irado April 8, 2009, 1:22 pm

    another question:
    ntop is up and running BUT.. :
    when asking for the graphical (network load or anyother) it show this:
    “NOTE: this page is not operational when the RRD plugin is disabled, misconfigured or missing.”

    in the configuration, the rrd plugin is ENABLED (shows ‘yes’).

    now I am stuck :(

    any advice, PLEASE?

    • Eugene Frakt September 7, 2010, 9:00 pm

      You have to change ownership of the ntop directory to ntop user by running something like this for a compiled version of ntop.
      chown -R ntop /usr/local/var/ntop

      For an rpm version of ntop, it would be this command.
      chown -R ntop /var/ntop

      Hope this helps.

  • Thanuwat May 18, 2009, 10:47 am

    I have a problem doing install in method make install

    cp: cannot stat `GeoLiteCity.dat’: No such file or directory
    make[2]: *** [install-data-local] Error 1
    make[2]: Leaving directory `/usr/local/ntop-3.3.10-rc1′
    make[1]: *** [install-am] Error 2
    make[1]: Leaving directory `/usr/local/ntop-3.3.10-rc1′
    make: *** [install-recursive] Error 1

    how to solve it, Thank you.

  • Saeid May 24, 2009, 12:22 am

    mkdir -p — //usr/local/etc/ntop
    cp: cannot stat `GeoLiteCity.dat’: No such file or directory
    make[2]: *** [install-data-local] Error 1
    make[2]: Leaving directory `/root/ntop-3.3.9′
    make[1]: *** [install-am] Error 2
    make[1]: Leaving directory `/root/ntop-3.3.9′
    make: *** [install-recursive] Error 1
    [root@localhost ntop-3.3.9]#

  • Mihir Joshi July 22, 2009, 4:39 am

    Hello Vivek,

    I m not able to view graphs.
    When i click on “Network Load”, gives below error
    Error: NOTE: this page is not operational when the RRD plugin is disabled, misconfigured or missing. Please check the ntop log file.

    Below are the permission.
    root@scare [/usr/local/var/ntop/rrd]# ll
    total 10
    drwxr-xr-x 5 ntop ntop 2048 Jul 21 13:31 ./
    drwxr-xr-x 3 ntop root 2048 Jul 22 14:31 ../
    drwxrwxrwx 8 ntop ntop 2048 Jul 22 14:26 flows/
    drwxrwxrwx 2 ntop ntop 2048 Jul 21 13:31 graphics/
    drwxrwxrwx 3 ntop ntop 2048 Jul 21 13:31 interfaces/

    Below is the log.
    Wed Jul 22 14:31:29 2009 **ERROR** RRD: Disabled – unable to create directory (err 13, /usr/local/var/ntop/rrd/graphics)

    Regards,
    Mihirj

  • m++ August 9, 2009, 5:37 am

    I noticed rrd didn’t work for me if I started `ntop -d` as a daemon. If I started it without the the -d flag as `ntop &` the rrd graphs work fine. I’m using v.3.3.11-dev which warns of possible funny business. Overall, the tool built easily and is completely awesome for monitoring network traffic!

    • Casey March 10, 2011, 1:46 pm

      Thanks m++, that worked for me too..
      I started Ntop without the daemon option..

      But one thing I noticed, wen I ran ntop, it would load, but I cant have access to the web interface..
      Sorted that out by running
      #ntop -W 3001 (this runs as a daemon)
      #stop Ntop
      #/etc/init.d/ntop start –

      That worked..

  • charles August 27, 2009, 7:06 pm

    cp: cannot stat `GeoLiteCity.dat’: No such file or directory
    make[2]: *** [install-data-local] Error 1
    make[2]: Leaving directory `/usr/local/ntop-3.3.10-rc1′
    make[1]: *** [install-am] Error 2
    make[1]: Leaving directory `/usr/local/ntop-3.3.10-rc1′
    make: *** [install-recursive] Error 1

    how to solve it, Thank you.

  • praveen September 24, 2009, 5:39 am

    i install ntop from rpm . when i start the ntop it starts well but after sometime it automatically stops

  • Nishth Vyas December 7, 2009, 7:56 am

    The provided link is not present. Please check.
    wget http://freshmeat.net/redir/ntop/7279/url_tgz/ntop-3.3.6.tar.gz

  • Sachin Gholap January 14, 2010, 7:51 am

    I m getting error when i use make command
    plzzz help me
    ntop.h:417:19: error: evdns.h: No such file or directory
    address.c: In function ‘dns_response_callback’:
    address.c:123: error: ‘DNS_ERR_NONE’ undeclared (first use in this function)
    address.c:123: error: (Each undeclared identifier is reported only once
    address.c:123: error: for each function it appears in.)
    address.c:129: error: ‘DNS_IPv6_AAAA’ undeclared (first use in this function)
    address.c:142: warning: assignment discards qualifiers from pointer target type
    address.c:150: error: ‘DNS_IPv4_A’ undeclared (first use in this function)
    address.c:164: error: ‘DNS_PTR’ undeclared (first use in this function)
    address.c: In function ‘queueAddress’:
    address.c:243: warning: nested extern declaration of ‘evdns_resolve_reverse’
    address.c:243: error: ‘DNS_ERR_NONE’ undeclared (first use in this function)
    address.c:249: warning: nested extern declaration of ‘evdns_resolve_reverse_ipv6′
    make[2]: *** [address.lo] Error 1
    make[2]: Leaving directory `/opt/ntop-3.3.10′
    make[1]: *** [all-recursive] Error 1
    make[1]: Leaving directory `/opt/ntop-3.3.10’
    make: *** [all] Error 2

  • Nice Thomas June 26, 2010, 4:31 am

    Hi

    I have tried installing ntop and installation is completed fine.
    But the link http://serverip:3000 is now working
    Mine is a vps. The /etc/sysconfig/iptables is an empty file.
    I am a getting a page load error while accessing the link
    http is up and running fine.
    Do you have any idea why it is due to?

  • Ace July 30, 2010, 3:40 am

    hi, i am having

    ERROR: gdbm header or library routines are missing…

    Any ideas? I have installed:

    gdbm-1.8.0-26.2.1

    • Pablo May 10, 2011, 7:42 pm

      Hi Ace, you need to install devel libraries try doing this
      yum install libpcap-devel gdbm-deve
      Cheers,
      Pablo

  • Red July 30, 2010, 4:20 am

    I have geoip-1.4.6-1 installed but still I get:

    Removing dups and misplaced entries from LIBS and INCS…
    checking for GeoIP_record_by_ipnum in -lGeoIP… no
    checking for GeoIP_name_by_ipnum_v6 in -lGeoIP… no
    Please install GeoIP (http://www.maxmind.com/)

    Is this an error or not?

  • chpego August 6, 2010, 3:30 am

    @ ACE : install libgdbm via yum => yum install libgdm -y
    @ Red : yum install GeoIP GeoIP-devel

  • Nandakumar August 27, 2010, 7:09 am

    I am getting error

    configure: error: Unable to find RRD at /usr/local/rrdtool: please use –with-rrd-home=DIR

    But i have rrd tool installed. Please help me to solve….

    Thanks,
    Nandakumar.D

    • xut September 7, 2010, 4:38 am

      yum install cairo-devel libxml2-devel pango-devel pango libpng-devel freetype freetype-devel libart_lgpl-devel libpcap libpcap*
      then install RRDTool
      you can download RRDTool from http://oss.oetiker.ch

  • Christo September 17, 2010, 2:36 am

    Hi,

    Getting the error below, I have added /usr/local/lib in ldconfig.conf and updated the cache but still showing the error.

    /usr/local/bin/ntop: error while loading shared libraries: /usr/local/lib/libntopreport-4.0.1.so: cannot restore segment prot after reloc: Permission denied

    • Christo September 17, 2010, 3:20 am

      Fixed it, seems selinux was the issue.

      http://www.gossamer-threads.com/lists/ntop/users/20506

      you can either disable SELinux (if you’re sure you can live without it)

      /etc/sysconfig/selinux:
      SELINUX=disabled

      or change the SELinux security context of the library file

      /usr/bin/chcon system_u:object_r:textrel_shlib_t
      /usr/local/lib/libntop-3.3.3.so

  • charlie December 28, 2010, 7:54 am

    This mean??? while I’m try to execute the startup of ntop

    # /usr/local/bin/ntop -d -L -u ntop -P /usr/local/var/ntop –skip-version-check –use-syslog=daemon

    **ERROR** ++++ DEMON MODE=1

    Tue Dec 28 15:52:52 2010 NOTE: Interface merge enabled by default
    Tue Dec 28 15:52:52 2010 Initializing gdbm databases
    Tue Dec 28 15:52:52 2010 **ERROR** ++++ DEMON MODE=1

  • Sudheera March 28, 2011, 6:24 am

    I cant get complied ,

    Just type make to compile ntop:
    # make

    wht can be the major reason?

  • Vince August 8, 2011, 2:39 pm

    Hi. Thanks for putting this tutorial together. After 2 days of tryhing to install this app, it’s working. I do have a question about an error that was pointed out above, but not answered. See below.

    Do this error message mean that it was started, but not running as a daemon at start up? I do get data and able to see graphs.

    Thanks for your help. Vince

    # /usr/local/bin/ntop -d -L -u ntop -P /usr/local/var/ntop –skip-version-check –use-syslog=daemon

    **ERROR** ++++ DEMON MODE=1

    Tue Dec 28 15:52:52 2010 NOTE: Interface merge enabled by default
    Tue Dec 28 15:52:52 2010 Initializing gdbm databases
    Tue Dec 28 15:52:52 2010 **ERROR** ++++ DEMON MODE=1

  • niro March 14, 2012, 1:38 pm

    Great tutorial!

    Thanks!

  • Nabyl July 24, 2012, 1:12 pm

    Great tutorial !
    I got it to work, but how do I get it to run as a daemon : ie on centos to be able to use service ntop start/stop/status ?
    thanks in advance

  • EnthY October 3, 2012, 8:29 pm

    for who’s try to install ntop on Centos, RedHat or OracleLinux 6 like me :)
    yum install cairo-devel libxml2-devel pango-devel pango libpng-devel -y
    yum install freetype freetype-devel libart_lgpl-devel wget gcc make -y
    yum install perl-ExtUtils-MakeMaker -y
    yum install graphviz -y

    before the ./autogen.sh

    it will help you

  • Vit July 1, 2013, 9:26 am

    this manual did not worked for me at Centos 5.x 64, ntop needed some “svn/subversion”, but i was not successfull installing it.

  • Max September 19, 2013, 7:49 am

    Could you please help me on this.

    /usr/bin/ntop -i “eth0,eth1,eth2” -d -L -u ntop -P /var/ntop –skip-version-check –use-syslog=daemon
    Thu Sep 19 13:18:34 2013 NOTE: Interface merge enabled by default
    Thu Sep 19 13:18:34 2013 Initializing gdbm databases
    Thu Sep 19 13:18:34 2013 **ERROR** ….open of /var/ntop/prefsCache.db failed: Can’t be writer
    Thu Sep 19 13:18:34 2013 Possible solution: please use ‘-P ‘
    Thu Sep 19 13:18:34 2013 **FATAL_ERROR** GDBM open failed, ntop shutting down…
    Thu Sep 19 13:18:34 2013 CLEANUP[t3086771920]: ntop caught signal 2 [state=2]
    Thu Sep 19 13:18:34 2013 ntop is now quitting…

Security: Are you a robot or human?

Leave a Comment

You can use these HTML tags and attributes: <strong> <em> <pre> <code> <a href="" title="">


   Tagged with: , , , , , , , , , , , , , ,