ntopng and Cento
Mirror port in, flows out. For 10 to 100 Gbit links.
Choose your system
sudo apt-get update
sudo apt-get install -y software-properties-common wget
sudo add-apt-repository -y universe
wget https://packages.ntop.org//apt-stable/24.04/all/apt-ntop-stable.deb
sudo apt install -y ./apt-ntop-stable.deb
sudo apt-get update
sudo apt-get install -y pfring-dkms cento ntopng
sudo systemctl stop ntopng
sudo ntopng -i zmq://127.0.0.1:5556 &
sudo cento -i zc:eth1 --zmq tcp://127.0.0.1:5556
Rocky Linux 9 or AlmaLinux 9. On Rocky Linux 10, install redis first from another repository.
curl -s https://packages.ntop.org//centos-stable/ntop.repo | sudo tee /etc/yum.repos.d/ntop.repo > /dev/null
sudo dnf config-manager --set-enabled crb
sudo dnf install -y epel-release
sudo dnf install -y pfring-dkms cento ntopng
sudo systemctl stop ntopng
sudo ntopng -i zmq://127.0.0.1:5556 &
sudo cento -i zc:eth1 --zmq tcp://127.0.0.1:5556
Replace eth1 with the mirror port interface. Stop with Ctrl+C.
Full speed needs the ZC driver: sudo apt-get install -y pfring-drivers-zc-dkms (Rocky: sudo dnf install -y pfring-drivers-zc-dkms).
Then open http://YOUR-IP:3000, choose the new interface and open Flows. Cento needs a license.
