NTOP(8) NTOP(8) NNAAMMEE ntop - display top network users SSYYNNOOPPSSIISS nnttoopp [@@ffiilleennaammee] [--aa|----aacccceessss--lloogg--ffiillee _<_p_a_t_h_>] [--bb|----ddiissaabbllee--ddeeccooddeerrss] [--cc|----ssttiicckkyy--hhoossttss] [--ee|----mmaaxx--ttaabbllee--rroowwss] [--ff|----ttrraaffffiicc--dduummpp--ffiillee _f_i_l_e_>] [--gg|----ttrraacckk--llooccaall--hhoossttss] [--hh|----hheellpp] [--ll|----ppccaapp--lloogg _<_p_a_t_h_>] [--mm|----llooccaall--ssuubbnneettss _<_a_d_d_r_e_s_s_e_s_>] [--nn|----nnuummeerriicc--iipp--aaddddrreesssseess] [--pp|----pprroo-- ttooccoollss _<_l_i_s_t_>] [--qq|----ccrreeaattee--ssuussppiicciioouuss--ppaacckkeettss] [--rr|----rreeffrreesshh--ttiimmee _<_n_u_m_b_e_r_>] [--ss|----nnoo--pprroommiissccuuoouuss] [--tt|----ttrraaccee--lleevveell _<_n_u_m_b_e_r_>] [--xx _<_m_a_x___n_u_m___h_a_s_h___e_n_t_r_i_e_s_>] [--ww|----hhttttpp--sseerrvveerr _<_p_o_r_t_>] [--zz|----ddiissaabbllee--sseess-- ssiioonnss] [--AA|----sseett--aaddmmiinn--ppaasssswwoorrdd _p_a_s_s_w_o_r_d] [--BB|----ffiilltteerr--eexxpprreessssiioonn _e_x_p_r_e_s_s_i_o_n] [--CC _<_c_o_n_f_i_gmode>_] [--DD|----ddoommaaiinn _<_n_a_m_e_>] [--FF|----ffllooww--ssppeecc _<_s_p_e_c_s_>] [--MM|----nnoo--iinntteerrffaaccee--mmeerrggee] [--NN|----wwwwnn--mmaapp _<_p_a_t_h_>] [--OO|--------oouutt-- ppuutt--ppaacckkeett--ppaatthh _<_p_a_t_h_>] [--PP|----ddbb--ffiillee--ppaatthh _<_p_a_t_h_>] [--QQ|----ssppooooll--ffiillee-- ppaatthh _<_p_a_t_h_>] [--UU|----mmaappppeerr _<_U_R_L_>] [--VV|----vveerrssiioonn]] [--XX _<_m_a_x___n_u_m___T_C_P___s_e_s_- _s_i_o_n_s_>] [----ddiissaabbllee--iinnssttaannttsseessssiioonnppuurrggee] [----ddiissaabbllee--mmuutteexxeexxttrraaiinnffoo] [----ddiissaabbllee--nnddppii] [----ddiissaabbllee--ppyytthhoonn] [----iinnssttaannccee] [----pp33pp--ccpp] [----pp33pp--uurrii] [----sskkiipp--vveerrssiioonn--cchheecckk] [----ww33cc] [--44|----iippvv44]] [--66|----iippvv66]] Unix options: [--dd|----ddaaeemmoonn] [--ii|----iinntteerrffaaccee _<_n_a_m_e_>] [--uu|----uusseerr _<_u_s_e_r_>] [--KK|----eennaabbllee-- ddeebbuugg] [--LL] [----ppccaapp__sseettnnoonnbblloocckk] [----uussee--ssyysslloogg== _<_f_a_c_i_l_i_t_y_>] [----wweebb-- sseerrvveerr--qquueeuuee _<_n_u_m_b_e_r_>] Windows option: [--ii|----iinntteerrffaaccee _<_n_u_m_b_e_r_|_n_a_m_e_>] OpenSSL options: [--WW|----hhttttppss--sseerrvveerr _<_p_o_r_t_>] [----ssssll--wwaattcchhddoogg] DDEESSCCRRIIPPTTIIOONN nnttoopp shows the current network usage. It displays a list of hosts that are currently using the network and reports information concerning the (IP and non-IP) traffic generated and received by each host. nnttoopp may operate as a front-end collector (sFlow and/or netFlow plugins) or as a stand-alone collector/display program. A web browser is needed to access the information captured by the nnttoopp program. nnttoopp is a hybrid layer 2 / layer 3 network monitor, that is by default it uses the layer 2 Media Access Control (MAC) addresses AND the layer 3 tcp/ip addresses. nnttoopp is capable of associating the two, so that ip and non-ip traffic (e.g. arp, rarp) are combined for a complete picture of network activity. CCOOMMMMAANNDD--LLIINNEE OOPPTTIIOONNSS @@ffiilleennaammee The text of ffiilleennaammee is copied - ignoring line breaks and comment lines (anything following a #) - into the command line. nnttoopp behaves as if all of the text had simply been typed directly on the command line. For example, if the command line is "-t 3 @d -u ntop" and file d contains just the line '-d', then the effective command line is -t 3 -d -u ntop. Multiple @s are permitted. Nested @s (an @ inside the file) are not permitted. Remember, most nnttoopp options are "sticky", that is they just set an internal flag. Invoking them multiple times doesn't change nnttoopp''ss behavior. However, options that set a value, such as --trace-level, will use the LAST value given: --trace-level 2 --trace-level 3 will run as --trace-level 3. Beginning with 3.1, many command-line options may also be set via the web browser interface. These changes take effect on the next run of and on each subsequent run until changed. --aa || ----aacccceessss--lloogg--ffiillee By default nnttoopp does not maintain a log of HTTP requests to the inter- nal web server. Use this parameter to request logging and to specify the location of the file where these HTTP requests are logged. Each log entry is in Apache-like style. The only difference between Apache and nnttoopp logs is that an additional column has been added which has the time (in milliseconds) that nnttoopp needed to serve the request. Log entries look like this: 192.168.1.1 - - [04/Sep/2003:20:38:55 -0500] - "GET / HTTP/1.1" 200 1489 4 192.168.1.1 - - [04/Sep/2003:20:38:55 -0500] - "GET /index_top.html HTTP/1.1" 200 1854 4 192.168.1.1 - - [04/Sep/2003:20:38:55 -0500] - "GET /index_inner.html HTTP/1.1" 200 1441 7 192.168.1.1 - - [04/Sep/2003:20:38:56 -0500] - "GET /index_left.html HTTP/1.1" 200 1356 4 192.168.1.1 - - [04/Sep/2003:20:38:56 -0500] - "GET /home_.html HTTP/1.1" 200 154/617 9 192.168.1.1 - - [04/Sep/2003:20:38:56 -0500] - "GET /home.html HTTP/1.1" 200 1100/3195 10 192.168.1.1 - - [04/Sep/2003:20:38:56 -0500] - "GET /About.html HTTP/1.1" 200 2010 10 This parameter is the complete file name of the access log. In prior releases it was erroneously called --access-log-path. --bb || ----ddiissaabbllee--ddeeccooddeerrss This parameter disables protocol decoders. Protocol decoders examine and collect information about layer 2 proto- cols such as NetBIOS or Netware SAP, as well as about specific tcp/ip (layer 3) protocols, such as DNS, http and ftp. This support is specifically coded for each protocol and is different from the capability to count raw information (packets and bytes) by protocol specified by the -p | --protocols parameter, below. Decoding protocols is a significant consumer of resources. If the nnttoopp host is underpowered or monitoring a very busy network, you may wish to disable protocol decoding via this parameter. It may also be appropriate to use this parameter if you believe that nnttoopp has prob- lems handling some protocols that occur on your network. Even if decoding is disabled, ftp-data traffic is still decoded to look for passive ftp port commands. --cc || ----ssttiicckkyy--hhoossttss Use this parameter to prevent idle hosts from being purged from mem- ory. By default idle hosts are periodically purged from memory. An idle host is identified when no packets from or to that host have been mon- itored for the period of time defined by the value of PARM_HOST_PURGE_MINIMUM_IDLE in globals-defines.h. If you use this option, all hosts - active and idle - are retained in memory for the duration of the nnttoopp run. P2P users, port scans, popular web servers and other activity will cause nnttoopp to record data about a large number of hosts. On an active network, this will consume a significant - and always growing - amount of memory. It is strongly recommended that you use a filtering expression to limit the hosts which are stored if you use --sticky- hosts. The idle purge is a statistical one - a random selection of the eligi- ble hosts will be purged during each cycle. Thus it is possible on a busy system for an idle host to remain in the nnttoopp tables and appear 'active' for some considerable time after it is truly idle. --dd || ----ddaaeemmoonn This parameter causes ntop to become a daemon, i.e. a task which runs in the background without connection to a specific terminal. To use nnttoopp other than as a casual monitoring tool, you probably will want to use this option. WWAARRNNIINNGG:: If you are running as a daemon, the messages from nnttoopp will be 'printed' on to stdout and thus dropped. You probably don't want to do this. So remember to also use the -L or --use-syslog options to save the messages into the system log. --ee || ----mmaaxx--ttaabbllee--rroowwss This defines the maximum number of lines that nnttoopp will display on each generated HTML page. If there are more lines to be displayed than this setting permits, only part of the data will be displayed. There will be page forward/back arrows placed at the bottom of the page for navigation between pages. --ff || ----ttrraaffffiicc--dduummpp--ffiillee By default, nnttoopp captures traffic from network interface cards (NICs) or from netFlow/sFlow probes. However, nnttoopp can also read data from a file - typically a tcpdump capture or the output from one of the nnttoopp packet capture options. if you specify -f, nnttoopp will not capture any traffic from NICs during or after the file has been read. netFlow/sFlow capture - if enabled - would still be active. This option is mostly used for debug purposes. --gg || ----ttrraacckk--llooccaall--hhoossttss By default, nnttoopp tracks all hosts that it sees from packets captured on the various NICs. Use this parameter to tell nnttoopp to capture data only about local hosts. Local hosts are defined based on the addresses of the NICs and those networks identified as local via the -m | --local-subnets parameter. This parameter is useful on large networks or those that see many hosts, (e.g. a border router or gateway), where information about remote hosts is not desired/required to be tracked. --hh || ----hheellpp Print help information for nnttoopp,, including usage and parameters. --ii || ----iinntteerrffaaccee Specifies the network interface or interfaces to be used by nnttoopp for network monitoring. If multiple interfaces are used (this feature is available only if ntop is compiled with thread support) their names must be separated with a comma. For instance -i "eth0,lo". If not specified, the default is the first Ethernet device, e.g. eth0. The specific device that is 'first' is highly system dependent. Espe- cially on systems where the device name reflects the driver name instead of the type of interface. By default, traffic information obtained by all the interfaces is merged together as if the traffic was seen by only one interface. Use the -M parameter to keep traffic separate by interface. If you do not want nnttoopp to monitor any interfaces, use -i none. Under Windows, the parameter value is either the number of the inter- face or its name, e.g. {6252C14C-44C9-49D9-BF59-B2DC18C7B811}. Run nnttoopp -h to see a list of interface name-number mappings (at the end of the help information). --ll || ----ppccaapp--lloogg This parameter causes a dump file to be created of the network traffic captured by nnttoopp in tcpdump (pcap) format. This file is useful for debug, and may be read back into nnttoopp by the -f | --traffic-dump-file parameter. The dump is made after processing any filter expression ( never even sees filtered packets). The output file will be named _<_p_a_t_h_>_/_<_l_o_g_>_._<_d_e_v_i_c_e_>_._p_c_a_p (Windows: _<_p_a_t_h_>_/_<_l_o_g_>_._p_c_a_p ), where is defined by the -O | --output- packet-path parameter and is defined by this -l | --pcap-log parameter. --mm || ----llooccaall--ssuubbnneettss nnttoopp determines the ip addresses and netmasks for each active inter- face. Any traffic on those networks is considered local. This param- eter allows the user to define additional networks and subnetworks whose traffic is also considered local in nnttoopp reports. All other hosts are considered remote. Commas separate multiple network values. Both netmask and CIDR nota- tion may be used, even mixed together, for instance "131.114.21.0/24,10.0.0.0/255.0.0.0". The local subnet - as defined by the interface address(es) - is/are always local and do not need to be specified. If you do give the same value as a NIC's local address, a harmless warning message is issued. --nn || ----nnuummeerriicc--iipp--aaddddrreesssseess By default, nnttoopp resolves IP addresses using a combination of active (explicit) DNS queries and passive sniffing. Sniffing of DNS responses occurs when nnttoopp receives a network packet containing the response to some other user's DNS query. nnttoopp captures this informa- tion and enters it into nnttoopp''ss DNS cache, in expectation of shortly seeing traffic addressed to that host. This way nnttoopp significantly reduces the number of DNS queries it makes. This parameter causes nnttoopp to skip DNS resolution, showing only numeric IP addresses instead of the symbolic names. This option can useful when the DNS is not present or quite slow. --pp || ----pprroottooccoollss This parameter is used to specify the TCP/UDP protocols that nnttoopp will monitor. The format is