Install NTOP on Debian and Configure to Use NetFlow on Mikrotik RouterOS

Ntop is a network monitoring tool similar to Unix top, which shows network traffic usage. It can act as a NetFlow collector for flows generated by routers such as Cisco or Mikrotik. NetFlow is an industry standard for flow-based traffic monitoring.

We will install and configure Ntop to collect flows generated by Mikrotik router. Note: “Ntop” != “NtopNG”.

Install Pre-required Software

We’re using Debian Wheezy:

# uname -rv
3.2.0-4-686-pae #1 SMP Debian 3.2.51-1

Update the system first:

# apt-get update
# apt-get upgrade

Install required software:

# apt-get install libtool automake autoconf make build-essential python-dev subversion

Install external tools and libraries required by ntop:

# apt-get install libpcap-dev libgdbm-dev zlib1g-dev libgeoip-dev libgraphviz-dev graphviz rrdtool librrd-dev

Ntop Installation via Source Code

Download the source package:

# cd ~ ; wget http://sourceforge.net/projects/ntop/files/ntop/Stable/ntop-5.0.1.tar.gz

Extract the archive:

# tar xvfz ntop-5.0.1.tar.gz && cd ntop-5.0.1

Configure, compile and install ntop:

# ./autogen.sh
# make
# make install

Create a new system account for ntop:

# useradd -r -s /bin/false ntop

Change ownership appropriately:

# chown -R ntop:ntop /usr/local/share/ntop /usr/local/lib/ntop

Update links and cache to the shared libraries:

# /sbin/ldconfig

Start Ntop as a Daemon

# ntop -cd -i eth0 -u ntop -W 3001 -m 10.132.1.0/24

-c : prevent idle hosts from being purged from memory
-d : causes ntop to become a daemon
-i : specifies the network interface to use
-u : the user ntop should run as after it initialises (but must be started as root)
-W : starts an embedded ntop web server for HTTPS
-m : specifies local subnets

Use man ntop for more command line options if needed. Also note that port 3001 needs to opened on a firewall.

Troubleshooting Ntop

If you get the error message below when launching ntop:

error while loading shared libraries: libntopreport-5.0.1.so: cannot open shared object file: No such file or directory

Update links and cache to the shared libraries:

# /sbin/ldconfig

Enable and Configure NetFlow Plugin on Ntop

Connect to ntop web interface here:

https://<ntop_ip>:3001

Active NetFlow plugin: “Plugins” -> “NetFlow” -> “Activate”.

Open NetFlow configuration panel: “Plugins” -> “NetFlow” -> “Configure”.

Click Add NetFlow Device and fill in the following:

1. NetFlow Device: “Mikrotik”
2. Local Collector UDP Port: 2055
3. Virtual NetFlow Interface Network Address: 10.132.1.0/24 (change appropriately!)

Enable and Configure NetFlow on Mikrotik RouterOS

Enabling traffic flow on the Mikrotik can be done via SSH:

[sandy@mikrotik] > /ip traffic-flow 
[sandy@mikrotik] /ip traffic-flow> set enabled=yes interfaces=all

Print current configuration:

[sandy@mikrotik] /ip traffic-flow> print
 enabled: yes
 interfaces: all
 cache-entries: 4k
 active-flow-timeout: 30m
 inactive-flow-timeout: 15s

Add NetFlow target (our Debian machine):

[sandy@mikrotik] /ip traffic-flow> /ip traffic-flow target
[sandy@mikrotik] /ip traffic-flow target> add address=10.132.1.27:2055 disabled=no version=5

Print target configuration:

[sandy@mikrotik] /ip traffic-flow target> print 
Flags: X - disabled 
 # ADDRESS VERSION
 0 10.132.1.27:2055 5

That’s it, now we have to wait a couple of minutes and review data in the ntop web interface.

Ntop WebUI Report

Report created on Sun Jan 12 15:28:19 2014 [ntop uptime: 44:04] 
Generated by ntop v.5.0.1 (32 bit) [i686-pc-linux-gnu]
© 1998-2012 by Luca Deri, built: Jan 11 2014 23:13:11.
Version: the CURRENT stable version
Listening on [eth0,Mikrotik] for all packets (i.e. without a filtering expression) 
Web reports include only interface "Mikrotik"

Source from : https://www.lisenet.com

Install NTOP

This tutorial copy paste from http://www.lungstruck.com/, on a this post, I wrote about how I setup a transparent bridge computer, which is able to monitor all network traffic passed through it. It works great, but to make it really useful, it needs some software that can report on the monitored network traffic in a useful manner. I decided to use ntop for this purpose, as it provides powerful reporting on bandwidth usage, which is exactly what I’m after. I’m not a regular Linux user, so I usually take the easy approach and install software through whatever GUI-based software manager is included. When I did this in Linux Mint however, I found the version available was not the latest, which is 5.0.1. I also learned that ntop has since been replaced by ntopng, which wasn’t available through the GUI. I’ve had some college courses in Linux/Unix administration, so I figured I could handle installing it “the hard way”. In this post, I’ll cover how I got ntop 5.0.1 running on my bridge computer.

First, a note about my choice. I went with ntop 5.0.1 rather than the newer ntopng. The reason is simple: I found more documentation on installing ntop than I did for ntopng. Primarily, I relied on these two articles: nTop vs darkstat, and Install ntop on RH Enterprise Linux / CentOS Linux.

Starting with my bridge computer that I already setup (with the bridge interface being br0), here’s what I did. I’ve tested this on both Linux Mint 15 xfce 32-bit and Ubuntu Server 12.04.3 LTS 32-bit.

Install the dependencies:

sudo apt-get install libpcap-dev libgdbm-dev libevent-dev librrd-dev python-dev libgeoip-dev automake libtool subversion

Then download ntop 5.0.1 from SourceForge, uncompress it, build it, install it and copy the necessary files:

wget --trust-server-name http://sourceforge.net/projects/ntop/files/ntop/Stable/ntop-5.0.1.tar.gz/download
tar xzvf ntop-5.0.1.tar.gz
cd ntop-5.0.1/
./autogen.sh
make
sudo make install
sudo cp /usr/local/lib/libntop* /usr/lib/

Before running ntop, I created an ntop user and setup the appropriate permissions:

sudo useradd -M -s /sbin/nologin -r ntop
sudo chown -R ntop:root /usr/local/var/ntop
sudo chown -R ntop:ntop /usr/local/share/ntop

Now set the administrator password for ntop’s web interface:

sudo ntop --set-admin-password=1234

And it’s ready for testing. Start ntop:

sudo ntop -i "br0" -d -L -u ntop -P /usr/local/var/ntop --skip-version-check -use-syslog=daemon

Open a web browser and try http://localhost:3000. It works!

Finally, I want it to startup automatically, so i added the following line to /etc/rc.local:

/usr/local/bin/ntop -i "br0" -d -L -u ntop -P /usr/local/var/ntop --skip-version-check -use-syslog=daemon

Rebooted and tested it again, it works! The only other thing I did for the Linux Mint computer was to install SSH, since it’s not installed automatically:

Sudo apt-get install openssh-server
/etc/init.d/ssh start

The resulting ntop bridge works great. I’ve had in place at work for over a week without any problems, and it’s helped identify some bandwidth hogs on our network.