Install Ntopng Network Traffic Monitoring Tool on CentOS 7

Table of Contents

• Introduction
• Ntopng Features
• Requirements
• Installing Ntopng
• Start the Ntopng and Redis Service
• Configure Ntopng
• Allow Ntopng Through the Firewall
• Test Ntopng

Introduction

Ntopng is an opensource network traffic monitoring system that provides a web interface for real-time network monitoring. It very useful tool that helps you learn more about your network traffic.
Ntopng provides several tools for monitoring various protocols, traffic variants and bandwidth across multiple time frames. You can install ntopng on any monitoring server connected to your network and use a web browser to access real-time traffic reports available on the server.
In this tutorial, I will explain how to set up a web-based network traffic monitoring system on CentOS 7 using ntopng.

Ntopng Features

• Protocol-level real-time analysis of local network traffic.
• Geolocation of IP addresses.
• Network traffic matrix
• Historical traffic analysis
• Support for sFlow, NetFlow and IPFIX through nProbe.
• IPv6 support.

Requirements

• A server running CentOS v. 7

Installing Ntopng

Ntopng is not available in the default CentOS 7 repository. To begin, you will need to add the EPEL repository to your system by running the following command:

sudo yum install epel-release

Next, you will need to create an ntop repository for the stable builds. To do this, create a file named ntop.repo inside the /etc/yum.repos.d/ directory.

 sudo nano /etc/yum.repos.d/ntop.repo

Add the following content to the ntop.repo file:

[ntop]
name=ntop packages
baseurl=http://www.nmon.net/centos-stable/$releasever/$basearch/
enabled=1
gpgcheck=1
gpgkey=http://www.nmon.net/centos-stable/RPM-GPG-KEY-deri
[ntop-noarch]
name=ntop packages
baseurl=http://www.nmon.net/centos-stable/$releasever/noarch/
enabled=1
gpgcheck=1
gpgkey=http://www.nmon.net/centos-stable/RPM-GPG-KEY-deri

Save and exit the file.
Now, update the repositories and all installed packages with the following command:

 sudo yum -y update

Finally, install ntopng by running the following command:

sudo yum --enablerepo=epel install redis ntopng

Start the Ntopng and Redis Service

Once ntopng has been installed, you need to install the hiredis-devel package and start the redis server before starting ntopng.

sudo yum --enablerepo=epel install hiredis-devel

Now, start the redis service and enable the service to start at boot time:

sudo systemctl start redis.service
sudo systemctl enable redis.service

Let’s start ntopng and add the service to start at boot time:

sudo systemctl start ntopng.service
sudo systemctl enable ntopng.service

Configure Ntopng

Ntop will create a default configuration file at /etc/ntopng/ntopng.conf. However if you check the status, you’ll see that ntop gives you a "No Pro licence is found" error, and announces that it will return to community mode after 10 minutes.
To check the ntopng status, run:

sudo systemctl status ntopng

You should see the following output

You can remove this warning message by editing the ntopng configuration file:

sudo nano /etc/ntopng/ntopng.conf

Add/change the line shown below:

-G=/var/tmp/ntopng.pid\
--community

Save and exit the file, restart ntopng and check status again:

sudo systemctl restart ntopng
sudo systemctl status ntopng

Allow Ntopng Through the Firewall

Ntopng listens by default at the 3000 TCP port so you’ll need to add firewall rule to access ntopng from remote machine. You can do this by running following command:

sudo firewall-cmd --permanent --add-port=3000/tcp

Now, reload the firewalld service:

sudo firewall-cmd --reload

Test Ntopng

After setting everything up, you can access the ntopng web interface in a web browser by going to the URL http://your.server.ip:3000. Use the login information:
User: admin Password: admin
Enjoy...