ntopng Documentation

ntopng can be used in combination with other ntop tools. Documentation to use ntopng with other tools is the object of this section.

User's Guide

• What is ntopng
  • Releases and Features
  • Installing on Linux
  • Installing on MacOS
  • Installing on Windows
  • Installing on FreeBSD
  • Installing on OPNsense/pfSense
  • Updating the Software on Linux
  • ntopng Community
  • ntopng Professional
  • ntopng Enterprise M
  • ntopng Enterprise L
  • ntopng Enterprise L Bundle
• Use Cases
  • Mikrotik
  • Suricata
  • Monitoring Large Networks
  • Processes Monitoring
  • SNMP Monitoring
  • Infrastructure Monitoring
  • Netflow/sFlow Monitoring
  • Mirror/SPAN/TAP Monitoring
  • Monitoring Multiple Locations
• Basic Concepts
  • Network Interfaces
  • System Interface
  • Hosts
  • Host Pools
  • Statistics
  • Alerts
  • Timeseries
  • Scripts and Checks
  • Local Broadcast Domain
  • Disk Space Requirements
• How to Start ntopng
  • The ntopng Configuration File
  • Running ntopng as a Daemon
  • Running on Windows
• Adding a License
  • Purchasing a License
  • Generating the License Key
  • Example
  • Using the License Manager
• Command Line Options
  • Command Line Options
  • Configuration File Example
• The ntopng Web GUI
  • The Network Interface GUI
  • The System Interface GUI
  • Settings
  • Developer
  • Help Menu
  • Other Pages and Info
• SNMP
  • Configuration and Discovery
  • Device Monitoring
  • Network Interfaces
  • Binding MAC Address to Interface
  • SNMP Usage
  • Interface Similarity
  • Network Topology
  • Device rules
• Interfaces
  • Packet vs ZMQ Interfaces
  • Interfaces vs View Interfaces
  • Using nTap as Virtual Tap with ntopng
• Alerts
  • Alerts Explorer
  • Available Alerts
  • Mitre Classification
  • Alerts List per License
  • Available Recipients
  • Alert Exclusions
  • Developing Alerts
• Using ntopng with ntop Tools
  • Using ntopng with nProbe
  • Using ntopng with nProbe (Collector Mode)
  • Using ntopng with nProbe IPS
  • Using ntopng with nProbe Agent
  • Using ntopng with n2disk
• ClickHouse (Flow Dump)
  • Installation
  • Connect to ClickHouse
  • What’s Stored in ClickHouse
  • TLS Connection
  • ClickHouse Is Eating All My Disk/Memory !
  • ClickHouse DB Schema
• Historical Flow Explorer
  • Enabling Flow Dump
  • Custom Queries
  • Historical Flows Explorer Analysis
  • Exporting Flows
  • Data Retention
  • Hourly Historical Flows
  • Aggregation Preferences
  • Replay Historical Flows
• Reports
  • Traffic Reports
  • Reports Editor
• Docker/Kubernetes
• OT, ICS, SCADA Monitoring
  • 1. ModbusTCP
  • 2. IEC 60870-5-104
• Kafka
  • Exporting Flows to Kafka
  • Collecting nProbe Flows Using Kafka
  • Sending Messages to Kafka
• Advanced Features
  • 1. User Authentication
  • 2. Asset Inventory
  • 3. sFlow/NetFlow Collection
  • 4. Physical Interfaces Aggregation: Interface Views
  • 5. Interfaces Disaggregation
  • 6. Traffic Profiles
  • 7. Local Traffic Volume Rules
  • 8. Multitenancy
  • 9. Device Applications
  • 10. Category Lists / Blacklists
  • 11. Device/MAC Address Tracking
  • 12. Behavior Analysis
  • 13. Bridging and Traffic Policing
  • 14. Flows Dump
  • 15. Live Pcap Download
  • 16. Syslog Log Ingestion
  • 17. IDS Acceleration
  • 18. Additional ntopng Features
  • 19. OEM Customizations
  • 20. Snapshots
• Operating ntopng on large networks
  • Red Badges
  • Packet Drops
  • Additional Tuning
• Third-Party Integrations
  • OPNsense
  • pfSense
  • Suricata Integration
  • Suricata Acceleration
  • Kibana
  • Grafana
  • NetBox
• FAQ
  • Licenses
  • What to Save: Timeseries, Flows, pcaps
  • Maximum Number of Interfaces
  • Cannot Login into the GUI
  • Too many failed authentication attempts
  • Reset ntopng Preferences
  • How Can I Troubleshoot SNMP ?
  • How can I monitor the sites visited by an host?
  • How do I know who is using most of my bandwidth?
  • How can I associate an hostname to a certain category?
  • How can I estimate the disk space required by ntopng?
  • Cannot see data in Grafana
  • Permission denied errors
• Performance and Hardware Sizing
  • Hardware Sizing
  • Flow Collection Performance
• Vulnerability Scan
  • Vulnerability Scan Page
  • Vulnerability Scan Last Report Page
  • Alerts
  • Charts
  • Open Ports
  • Scan Reports

Developer's Guide

• Developing Plugins
  • Overview
    • Introduction
    • Capabilities
      • Monitoring an Analysis
      • Alerts Generation
      • Custom Pages
      • Timeseries
    • What is a Script
    • Availability
  • Alert Endpoints
    • How They Work
    • Endpoints Definition
      • Endpoint Script
      • Preferences Definition
    • Example
    • Alert Format
  • Alert Definitions
    • Alert Key
    • Flow Status Key
    • Alert Description
      • String
      • Function
    • Examples
    • Alert Summary
  • Checks
    • Structure
    • Flow and Host Checks
    • Syslog Checks
      • Scripts Location
      • Script API
      • Script Example
  • Check Hooks
    • Hooks Parameters
    • Hooks Example
  • Checks GUI
    • Input Builders
    • Threshold Cross
    • Items List
  • Localization
    • Scripts and Localization
    • Internal Handling
      • Parameters
      • Examples
  • Timeseries Schemas
    • Schemas Definition
    • Schemas Usage
  • Examples
    • Flow Flooders
    • Log Network Traffic
    • SNMP Topology Changed
  • Distributing Scripts
    • Debian/Ubuntu
      • Example
• API Documentation
  • RESTful API
    • 1. RESTful API v2 Specification
      • 1.1. Authentication
      • 1.2. Request Format
      • 1.3. Response Format
      • 1.4. API
        • 1.4.1. Interfaces
        • 1.4.2. Hosts
        • 1.4.3. Alerts
        • 1.4.4. Flows
        • 1.4.5. PCAP
        • 1.4.6. Users
        • 1.4.7. Infrastructures
        • 1.4.8. Health
        • 1.4.9. Configurations
        • 1.4.10. Vulnerability Scan
        • 1.4.11. Host
        • 1.4.12. SNMP
        • 1.4.13. All
        • 1.4.14. Observation Point
        • 1.4.15. Pools
        • 1.4.16. Traffic
        • 1.4.17. Timeseries
        • 1.4.18. Peers
        • 1.4.19. Top
        • 1.4.20. System
        • 1.4.21. Sites
        • 1.4.22. Maps
        • 1.4.23. User
        • 1.4.24. Checks
        • 1.4.25. Notification Endpoints
        • 1.4.26. Notification Recipients
        • 1.4.27. L7 Application Categories
        • 1.4.28. Configuration
        • 1.4.29. Active Monitoring
        • 1.4.30. Notifications
        • 1.4.31.
    • 2. Examples v2
      • 2.1. Interfaces
        • 2.1.1. Get Interface Data
        • 2.1.2. Get interface IP addresses
        • 2.1.3. Get L7 statistics for an interface
        • 2.1.4. Get actively monitored interfaces
      • 2.2. Hosts
        • 2.2.1. Get active hosts
        • 2.2.2. Get host data
        • 2.2.3. Get host custom data
        • 2.2.4. Get L7 statistics for a host
        • 2.2.5. Get host interfaces
      • 2.3. Flows
        • 2.3.1. Get flow counters for L4 protocols
        • 2.3.2. Get flow counters for L7 protocols
        • 2.3.3. Get active flows
        • 2.3.4. Get historical flows
      • 2.4. Alerts
        • 2.4.1. Get alerts timeseries
        • 2.4.2. Get alerts data
        • 2.4.3. Get alert severity constants
        • 2.4.4. Get alert type constants
        • 2.4.5. Get counters per severity
        • 2.4.6. Get counters per type
      • 2.5. L7 Application Protocols
        • 2.5.1. Get L7 application protocol constants
      • 2.6. L7 Application Categories
        • 2.6.1. Get L7 application category constants
      • 2.7. L4 Protocols
        • 2.7.1. Get L4 protocol constants
      • 2.8. Pools
        • 2.8.1. Add an Host Pool
        • 2.8.2. Edit an Host Pool
        • 2.8.3. Delete an Host Pool
        • 2.8.4. Get an Host Pool
        • 2.8.5. Get Members of an Host Pool
        • 2.8.6. Get All Pools of Any type
      • 2.9. SNMP
        • 2.9.1. Add an SNMP Device
        • 2.9.2. Change the Status of an SNMP Device Interface
      • 2.10. Misc
        • 2.10.1. Create a Session Cookie
    • 3. RESTful API v1 Specification
      • 3.1. Authentication
      • 3.2. Request Format
      • 3.3. Response Format
      • 3.4. API
        • 3.4.1. Interfaces
        • 3.4.2. Hosts
        • 3.4.3. Alerts
        • 3.4.4. Flows
        • 3.4.5. PCAP
        • 3.4.6. Users
        • 3.4.7. Infrastructures
        • 3.4.8. L4 Protocols
        • 3.4.9. L7 Application Protocols
        • 3.4.10. L7 Application Categories
        • 3.4.11. SNMP
        • 3.4.12. Pools
        • 3.4.13. Notification Recipients
        • 3.4.14. Notification Endpoints
        • 3.4.15. All
        • 3.4.16. Active Monitoring
        • 3.4.17. Notifications
        • 3.4.18.
    • 4. Examples v1
      • 4.1. Interfaces
        • 4.1.1. Get Interface Data
        • 4.1.2. Get interface IP addresses
        • 4.1.3. Get L7 statistics for an interface
        • 4.1.4. Get actively monitored interfaces
      • 4.2. Hosts
        • 4.2.1. Get active hosts
        • 4.2.2. Get host data
        • 4.2.3. Get host custom data
        • 4.2.4. Get L7 statistics for a host
        • 4.2.5. Get host interfaces
      • 4.3. Flows
        • 4.3.1. Get flow counters for L4 protocols
        • 4.3.2. Get flow counters for L7 protocols
        • 4.3.3. Get active flows
        • 4.3.4. Get historical flows
      • 4.4. Alerts
        • 4.4.1. Get alerts timeseries
        • 4.4.2. Get alerts data
        • 4.4.3. Get alert severity constants
        • 4.4.4. Get alert type constants
        • 4.4.5. Get counters per severity
        • 4.4.6. Get counters per type
      • 4.5. L7 Application Protocols
        • 4.5.1. Get L7 application protocol constants
      • 4.6. L7 Application Categories
        • 4.6.1. Get L7 application category constants
      • 4.7. L4 Protocols
        • 4.7.1. Get L4 protocol constants
      • 4.8. Pools
        • 4.8.1. Add an Host Pool
        • 4.8.2. Edit an Host Pool
        • 4.8.3. Delete an Host Pool
        • 4.8.4. Get an Host Pool
        • 4.8.5. Get Members of an Host Pool
        • 4.8.6. Get All Pools of Any type
      • 4.9. SNMP
        • 4.9.1. Add an SNMP Device
        • 4.9.2. Change the Status of an SNMP Device Interface
      • 4.10. Misc
        • 4.10.1. Create a Session Cookie
  • Lua API
    • 1. ntop Lua Object
      • 1.1. Cache API
      • 1.2. Prefs API
      • 1.3. Filesystem API
      • 1.4. Network API
      • 1.5. Users API
      • 1.6. Misc API
    • 2. interface Lua Object
      • 2.1. Hosts API
      • 2.2. Flows API
      • 2.3. Misc API
      • 2.4. MACs API
      • 2.5. nDPI API
      • 2.6. Dump API
    • 3. Host Checks
      • 3.1. Operational Mode
      • 3.2. Script Example
      • 3.3. Host Object Methods
    • 4. Flow Checks
      • 4.1. Operational Mode
      • 4.2. Script Example
      • 4.3. Flow Object Methods
    • 5. Interface Checks
    • 6. Network Checks
  • Python API
    • Prerequisites
    • Installation
    • Examples
    • API
      • Ntopng
      • Interface
      • Host
      • Historical
  • Timeseries API
    • Basic Concepts
      • Schema
      • Schema Name
      • Metric Types
      • Driver
    • Exporting Data
    • Modify an existing Schema
    • Adding New Metrics
      • General Overview
        • Case 1: Adding metrics via the ::lua method
        • Case 2: Adding metrics inside a TimeseriesPoint
        • Case 3: Adding metrics for Lua only objects
      • Custom Timeseries Scripts
        • Structure of Custom Timeseries Scripts
        • Example
      • Charting New Metrics
    • Accessing Metrics
      • Interface Metrics
      • Host Metrics
    • Metrics
      • Interface Metrics
      • Device Metrics
      • Host Metrics
      • Subnet Metrics
      • VLAN Metrics
      • SNMP Interface Metrics
      • Traffic Profile Metrics
      • Host Pool Metrics
      • ASN Metrics
      • Country Metrics
      • Flow Device Metrics
      • Event Exporter Metrics
      • Container Metrics
      • POD Metrics
      • Process Metrics
      • System Metrics
    • Querying Data
      • Number Of Hosts In The Last Minute
      • Traffic On An Interface In The Last Minute
      • Traffic On An Interface In The Last Hour, Per Minute
      • Traffic On An Interface In The Last Hour
    • ts_utils API
    • Driver Implementation
  • Alerts API
    • Engaged Alerts
      • alert_api API
        • Trigger alert
        • Metadata
  • Recording API
    • recording_utils API

Other Products

• nProbe
• nProbe Cento
• n2disk
• nDPI
• PF_RING
• nEdge
• nScrub
• nBox
• nTap
• License Manager