ZDNet.de: ntop: ein bedeutsames Tool fuer die Netzwerkanalyse
ZDNet.de speaks about ntop.
Author: Luca Deri
- Home
- Articles by: Luca Deri
PF_RING and Transparent Mode
PF_RING has been designed for enhancing packet capture performance. This means that the RX path must be accelerated, and in particular a way to accelerate this is by reducing the journey of…
Introducing PF_RING DNA (Direct NIC Access)
This is to announce the availability of PF_RING DNA (Direct NIC Access) that significantly increments performance (up to 80%) when compared with Linux packet capture and PF_RING (non DNA). PF_RING is polling…
ntop.org/ Joins the Open Information Security Foundation
Suricata is the next generation open source IDS/IPS developed byt the Open Information Security Foundation. It is a pleasure to announce that ntop has joined the core development team as the Linux…
ntop.org/ Accredited as Endace Technology Partner
We're proud to announce that ntop.org/ has been accredited as Endace technology partner as recognition for ntop contribution in the open-source world and also as guarantee for Endace customers that products such…
Exploiting Commodity Multi-core Systems for Network Traffic Analysis
This article Improvement of libpcap for lossless packet capturing in Linux using PF_RING kernel patch positions PF_RING (3.x, so some changes are needed when using version 4) against the Linux standard PF_PACKET…
ntop ASA Support
ntop supports NetFlow since many years including the latest v9/IPFIX versions. In 2005 Cisco ha releases a new line of x86 based security devices named ASA that unfortunately have not been supported…
Port Mirror vs Network Tap
In order to analyze network traffic, it's necessary to feed ntop/nProbe with network packets. There are two solutions to the problem: port mirror (also called SPAN in Cisco parlance) network tap Prior…
IRQ Balancing
On Linux, interrupts are handled automatically by the kernel. In particular there's a process named irqbalancer that is responsible for balancing interrupts across processors. Unfortunately the default is to let all processors…
