Today I’d like to tell you about the possibility of alerting when anomalies in network traffic are encountered. I use ntopng to generate, evaluate and forward these alerts. If you don’t know about ntopng, let me briefly describe for you what it does. According to its creator, ntopng is a High-Speed Web-based Traffic Analysis and…
Read MoreEver since version 5.4 of nBoxes with the Enterprise L license it’s been possible to use a new feature called Behavior Analysis. Let’s see what it is and how to take advantage of it. This ntopng feature enables monitoring of periodic flows of network traffic, i.e., flows that frequently repeat, by highlighting the services it…
Read MoreThe role of these two components is pretty clear: nProbe has the role of collecting traffic data, while nTop makes that data visible and easily analyzable. There is something, however, that needs to be explicitly stated, which is to decide whether it’s ntopng that should contact nProbe or vice versa, and as we’re in a…
Read MorenTop now uses the nDPI (network deep packet inspection) library to classify packets within network traffic for those protocols that either do not use a standard port (defined as well known ports like https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers and https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) or that are dynamically assigned. In any case the need to classify not only the packet header but also…
Read MoreA customer with a NetEye installation to which I had added the nTop module asked me if I could integrate nTop’s Grafana Dashboards, so they could view them by consulting NetEye’s ITOA Menu. The installation and configuration of nTop for this client, a task I had already conducted some time ago, was a matter of…
Read MoreIn the last few weeks I installed and configured some nBoxes with the new ntopng version 5.2. Now I’d like to briefly tell you all about it. For all of you who don’t know what an nBox is, I’ll relay the official definition here: nBox Recorder is a network traffic disk recorder application. With nBox…
Read MoreOne of my clients with a number of routers installed at their own remote location asked me if I could analyze the network flows at multiple locations. Their network architecture is a full mesh, and thus has private subnetworks, data center environments, and even in some cases cloud providers. Complex architectures like this require increasing…
Read MoreIntroduction The nTop application is one of NetEye’s integrated solutions for network traffic monitoring. In order to test its scalability, we decided to build a test bench where we could simulate a customer who needs to monitor a large number of devices (i.e., 1-2K routers) and wants to group this information at the nTop level…
Read MoreIdentify and Mitigate Attacks Protecting against cyber-attacks is becoming a top-priority for corporates around the world. An effective strategy for the protection against such events should focus at least on two dimensions, namely threat intelligence and perimeter defense. Using ntopng and nscrub we demonstrate how to effectively identify and mitigate threats in corporate networks with practical recommendations, guidelines and future directions to effectively…
Read MoreOverall about 150 people attended ntopConf, the yearly event for monitoring experts that turns their technical expertise into real-world practice in System Management and Traffic Monitoring. The first day was dedicated to training topics, and the second day to the conference itself. Our gratitude goes to the speakers, among them Georg who spoke about NetEye…
Read MoreWho is using your network and how? What kind of traffic does your company generate? Where does slow network performance come from? ntop has the answers. ntop is a network traffic probe that monitors network usage. This solution provides an intuitive, encrypted web user interface for the exploration of both real-time and historical traffic information. In our…
Read MoreIt all started with a pretty simple purpose: “The initial idea behind ntop was to create a simple tool to enable network visibility without having to deal with complicated network protocols,“ says ntop founder Luca Deri. What followed were 20 years of the highest quality development, motivation and passion, bringing ntop to what it is…
Read MoreChi riesce a sapere veramente quali sono i protocolli utilizzati nella rete locale? Solitamente con i netflow si può distinguere il traffico attraverso le porte L4 (80=http,443=https,..) ma non è più sufficiente. Alcune applicazioni usano invece porte dinamiche (vedi nfs, ftp, routed sap, …), altre le porte stesse, come si può allora essere in grado…
Read MoreWer von Ihnen weiß genau welche Protokolle im Unternehmensnetzwerk verwendet werden? Dank NetFlow können wir den Traffic der L4-Ports (80=http,443=https,..) unterscheiden, leider reicht das heutzutage aber nicht aus. Einige Applikationen verwenden dynamische Ports (siehe nfs, ftp, routed sap, …), andere nutzen die selben Ports, wie sollen wir diese noch voneinander unterscheiden? Erschwerend hinzu kommt, dass sich…
Read MoreWho really knows what are the protocols used in the local network? Usually with netflow you can distinguish traffic per l4 port (80=http,443=https,..) but this is no more sufficient. Some applications use dynamic ports (see nfs, ftp, routed sap, …), several applications use the same ports, how can we distinguish them? Applications grow and change really fast (like…
Read More