Hi all.
I have currently a task to implement a network traffic analyzer. Some years ago I've used NTOP for that purpose, I would also like to test some alternatives. Which alternatives can you recommend and why?
Thanks ;)
Best regards, Rafał Radecki.
On 28/08/2012 07:35, Rafał Radecki wrote:
Hi all.
I have currently a task to implement a network traffic analyzer. Some years ago I've used NTOP for that purpose, I would also like to test some alternatives. Which alternatives can you recommend and why?
Thanks ;)
If you looking at just a netflow web-frontend & netflow processing I quite like nfsen / nfdump
On Tue, Aug 28, 2012 at 10:23 AM, Giles Coochey giles@coochey.net wrote:
On 28/08/2012 07:35, Rafał Radecki wrote:
Hi all.
I have currently a task to implement a network traffic analyzer. Some years ago I've used NTOP for that purpose, I would also like to test some alternatives. Which alternatives can you recommend and why?
Thanks ;)
If you looking at just a netflow web-frontend & netflow processing I quite like nfsen / nfdump
Or for one-off capture/analysis runs, wireshark is pretty good. I doubt if anything will match ntop for continuous captures with the ability to summarize in a large variety of ways.
On Tuesday, August 28, 2012 02:35:25 AM Rafał Radecki wrote:
Hi all.
I have currently a task to implement a network traffic analyzer. Some years ago I've used NTOP for that purpose, I would also like to test some alternatives. Which alternatives can you recommend and why?
As a package, either the Fedora-based NetworkSecurityToolkit (NST) or the loosly-based-on-ubuntu BackTrack are nice. NST has some very cool features, and a web UI that allows some nice options.
NST runs best on a dedicated piece of hardware; slap a couple of GigE NIC's in a good box with dual procs, put one GigE on a SPAN port or a hardware tap, install NST on it and configure to your liking. If you want prepackaged updates that you don't have to built yourself, subscribe to the NSTPro service.
www.networksecuritytoolkit.org
I'm using it here, and coupled with the power and configurability of Cisco's SPAN it works really well for troubleshooting. I'm using it enough that I set up my own builder on Fedora 16, and have been building my own updates out of NST's SVN, which has been interesting....
After some search I think I will use ntop ;) Thanks for all help.
Best regards, Rafał.
2012/8/28 Lamar Owen lowen@pari.edu
On Tuesday, August 28, 2012 02:35:25 AM Rafał Radecki wrote:
Hi all.
I have currently a task to implement a network traffic analyzer. Some
years
ago I've used NTOP for that purpose, I would also like to test some alternatives. Which alternatives can you recommend and why?
As a package, either the Fedora-based NetworkSecurityToolkit (NST) or the loosly-based-on-ubuntu BackTrack are nice. NST has some very cool features, and a web UI that allows some nice options.
NST runs best on a dedicated piece of hardware; slap a couple of GigE NIC's in a good box with dual procs, put one GigE on a SPAN port or a hardware tap, install NST on it and configure to your liking. If you want prepackaged updates that you don't have to built yourself, subscribe to the NSTPro service.
www.networksecuritytoolkit.org
I'm using it here, and coupled with the power and configurability of Cisco's SPAN it works really well for troubleshooting. I'm using it enough that I set up my own builder on Fedora 16, and have been building my own updates out of NST's SVN, which has been interesting....
CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
On Wed, Aug 29, 2012 at 9:52 AM, Rafał Radecki radecki.rafal@gmail.comwrote:
After some search I think I will use ntop ;)
Having lurked in this thread, I think I'll start using ntop as well. Did a quick test today on my laptop and got it up and running in no time.
But to answer the question people at the office keeps asking me, I need to dump Network Load data with a 1-second granularity. Does anoybody know how to do that? Basic question is, do we have large fluctuations on our internet connection usage.
Thanks in advance!
with kind regards, Bent Terp
On 29/08/2012 09:29, Bent Terp wrote:
On Wed, Aug 29, 2012 at 9:52 AM, Rafał Radecki radecki.rafal@gmail.comwrote:
After some search I think I will use ntop ;)
Having lurked in this thread, I think I'll start using ntop as well. Did a quick test today on my laptop and got it up and running in no time.
But to answer the question people at the office keeps asking me, I need to dump Network Load data with a 1-second granularity. Does anoybody know how to do that? Basic question is, do we have large fluctuations on our internet connection usage.
Thanks in advance!
I know it's a Windows utility (WINE??), but we used STG traffic grapher in a previous ISP environment. Graphing at a 1s interval is possible, looks very much like MRTG.
Have you tried Darkstat - it's a nice very very lightweight alternative
http://unix4lyfe.org/darkstat/
ntop has more info though.
regards
Keep rocking the free (opensource) world
On 29 August 2012 09:56, Giles Coochey giles@coochey.net wrote:
On 29/08/2012 09:29, Bent Terp wrote:
On Wed, Aug 29, 2012 at 9:52 AM, Rafał Radecki radecki.rafal@gmail.comwrote:
After some search I think I will use ntop ;)
Having lurked in this thread, I think I'll start using ntop as well. Did a quick test today on my laptop and got it up and running in no time.
But to answer the question people at the office keeps asking me, I need to dump Network Load data with a 1-second granularity. Does anoybody know how to do that? Basic question is, do we have large fluctuations on our internet connection usage.
Thanks in advance!
I know it's a Windows utility (WINE??), but we used STG traffic grapher in a previous ISP environment. Graphing at a 1s interval is possible, looks very much like MRTG.
-- Regards,
Giles Coochey, CCNA, CCNAS NetSecSpec Ltd +44 (0) 7983 877438 http://www.coochey.net http://www.netsecspec.co.uk giles@coochey.net
CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
Have you tried Darkstat - it's a nice very very lightweight alternative
I installed it on Centos 6.2 (64 bit VM). It is pretty light.
I would like to know on which host should I install it on LAN?
gateway Machine, proxy Server or any host on that LAN?
I just installed on a host On a LAN. But, It does NOT show All the host on the LAN.
It does NOT show my mail gateway. It is on the same LAN.
Then, How can get actual traffic on my LAN ?
Anyway, If clicked host link, It shows in , out , total traffic? It is bytes?
I think it is in byte?
ntop has more info though.
I have used this since long time. many options. very difficult to understand.
what about bandwidthd ? I have tried twice. On which host, Should I install it to see network traffic my lan?
really like to hear from you.
r
On Thu, Aug 30, 2012 at 4:32 AM, Indunil Jayasooriya indunil75@gmail.comwrote:
Have you tried Darkstat - it's a nice very very lightweight alternative
I installed it on Centos 6.2 (64 bit VM). It is pretty light.
I would like to know on which host should I install it on LAN?
If you want it to be able to see all traffic on the local network, then you have to make sure all the traffic actually shows up on that interface - which is not usually the case on a switched network :-)
My plan for today is to install darkstar on a separate physical host with dual nic's, and tell the switch to copy all traffic on the VLAN's that I wish to monitor to one port which will then be connected to one of the NIC's on the darkstar host. This feature is called "port mirroring" on ProCurve switches but most professional switches have similar features, although they might be called differently.
gateway Machine, proxy Server or any host on that LAN?
Alternatively, if you have a gateway machine that all traffic passes through, this would also be a good candidate unless traffic is so high that the additional load from darkstat impacts performance - or any bug in darkstat that just might interrupt regular operations.
BR Bent
I would like to know on which host should I install it on LAN?
My plan for today is to install darkstar on a separate physical host with dual nic's, and tell the switch to copy all traffic on the VLAN's that I wish to monitor to one port which will then be connected to one of the NIC's on the darkstar host. This feature is called "port mirroring" on ProCurve switches but most professional switches have similar features, although they might be called differently.
I think This is an URL for it. Where it shows with a picture.
http://community.spiceworks.com/how_to/show/1261
The same thing for bandwidthd software.
* Pls assume*, My Network Monitoring Server has *2 Ethernets and also I have port mirroring capable switch.
* if one Ethernet of Netwrok monitoring Sever connects to usual port in the switch, Other LAN PCs also connects to the usual ports of the same switch . Then, remaining Ethernet of the Monitoring Server should connect to a mirrored port.
*Then, to which port , Should I connect my router ???
* to a usual port or mirrored port of that same switch?
if Router should be connected to a mirrored port , We need 2 mirrored port of the same switch..
Pls let me know since I would like to learn..
gateway Machine, proxy Server or any host on that LAN?
Alternatively, if you have a gateway machine that all traffic passes through, this would also be a good candidate unless traffic is so high that the additional load from darkstat impacts performance - or any bug in darkstat that just might interrupt regular operations.
IF my Gateway is running squid But NOT in transparent mode, just a usual way with configurations of users' browsers,
Can I install darkstar or bandwidthd on that gateway box?
I really like to hear from you?
On Wed, Aug 29, 2012 at 10:59 AM, Morgan Cox morgancoxuk@gmail.com wrote:
Have you tried Darkstat - it's a nice very very lightweight alternative
Hi. Darkstat worked like a charm on my laptop yesterday, for traffic to/from the laptop. So this morning I've been trying to make it work in the serverroom.
I've set up a monitoring port on the switch and mirrored a vlan to it. To this monitoring switch port, I've connected the second nic on a spare server.
But I can't make it see the traffic: *Running for* 38 secs*, since* 2012-08-30 08:27:12 UTC+0000*.* *Total* 0 *bytes, in* 0 *packets.* (2,512,454 *captured,* 2,494,741 * dropped)
*And so the graphs are blank :-(
I've tried several incantations to no avail: usr/local/sbin/darkstat -i eth1 -p 5001 --no-daemon --no-dns -l " 0.0.0.0/0.0.0.0" --local-only /usr/local/sbin/darkstat -i eth1 -p 5001 --no-daemon --no-dns -l " 0.0.0.0/0.0.0.0" /usr/local/sbin/darkstat -i eth1 -p 5001 --no-daemon --no-dns
I've even tried assigning a bogus ip address on the monitored subnet to eth1, but that doesn't help either.
Any suggestions?
with kind regards, Bent
----- "Bent Terp" bent@terp.se escreveu:
De: "Bent Terp" bent@terp.se Para: "CentOS mailing list" centos@centos.org Enviadas: Quarta-feira, 29 de Agosto de 2012 5:29:07 (GMT-0300) Auto-Detected Assunto: Re: [CentOS] NTOP alternatives?
On Wed, Aug 29, 2012 at 9:52 AM, Rafał Radecki radecki.rafal@gmail.comwrote:
After some search I think I will use ntop ;)
Having lurked in this thread, I think I'll start using ntop as well. Did a quick test today on my laptop and got it up and running in no time.
But to answer the question people at the office keeps asking me, I need to dump Network Load data with a 1-second granularity. Does anoybody know how to do that? Basic question is, do we have large fluctuations on our internet connection usage.
Hi Bent,
Give a try to Collectd: www.collectd.org is a RRDTOOL data collect system.
I use it on various systems without impacts on performance.
Antonio.
Am 29.08.2012 um 12:24 schrieb Antonio da Silva Martins Junior:
----- "Bent Terp" bent@terp.se escreveu:
De: "Bent Terp" bent@terp.se Para: "CentOS mailing list" centos@centos.org Enviadas: Quarta-feira, 29 de Agosto de 2012 5:29:07 (GMT-0300) Auto-Detected Assunto: Re: [CentOS] NTOP alternatives?
On Wed, Aug 29, 2012 at 9:52 AM, Rafał Radecki radecki.rafal@gmail.comwrote:
After some search I think I will use ntop ;)
Having lurked in this thread, I think I'll start using ntop as well. Did a quick test today on my laptop and got it up and running in no time.
But to answer the question people at the office keeps asking me, I need to dump Network Load data with a 1-second granularity. Does anoybody know how to do that? Basic question is, do we have large fluctuations on our internet connection usage.
Hi Bent,
Give a try to Collectd: www.collectd.org is a RRDTOOL data collect system.
+1
i use collectd to keep tracked system offloaded and send all data via network (encrypted) to a central system.
I use it on various systems without impacts on performance.
The central system has a continuous data stream onto the storage (my case saving >64 incoming samples/minute). Not a penalty but i would run only the logging service on this central system.
-- LF
On Wed, Aug 29, 2012 at 4:52 PM, Rafał Radecki radecki.rafal@gmail.com wrote:
After some search I think I will use ntop ;)
Does anyone know a repo which contains ntop for centos 6.x? I have been using ntop for 5.x from rpmforge, but coundn't find RPMS for 6.x there.
-- net foss
On 30.08.2012 03:28, Net Foss wrote:
On Wed, Aug 29, 2012 at 4:52 PM, Rafał Radecki radecki.rafal@gmail.com wrote:
After some search I think I will use ntop ;)
Does anyone know a repo which contains ntop for centos 6.x? I have been using ntop for 5.x from rpmforge, but coundn't find RPMS for 6.x there.
-- net foss _______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
http://li.nux.ro/download/nux/misc/el6/x86_64/ntop-4.1.0-3.el6.nux.x86_64.rp... backported from Fedora, untested.