ntopng Command Linux: Complete Guide to Web-Based Network Traffic Monitoring

Network traffic monitoring is crucial for maintaining optimal network performance, security, and troubleshooting connectivity issues. The ntopng command provides a powerful web-based solution for real-time network traffic analysis on Linux systems. This comprehensive guide explores everything you need to know about using ntopng effectively.

What is ntopng?

ntopng (network top next generation) is an advanced, web-based network traffic monitoring tool that provides real-time analysis of network flows. It’s the successor to the original ntop utility, offering enhanced features including:

• Web-based graphical interface
• Real-time traffic analysis
• Network flow monitoring
• Historical data storage
• Security threat detection
• Geolocation mapping
• REST API support

Installing ntopng on Linux

Ubuntu/Debian Installation

For Ubuntu and Debian-based systems, install ntopng using the package manager:

# Update package repository
sudo apt update

# Install ntopng
sudo apt install ntopng

# Install additional dependencies
sudo apt install redis-server

CentOS/RHEL/Fedora Installation

For Red Hat-based distributions:

# Install EPEL repository (CentOS/RHEL)
sudo yum install epel-release

# Install ntopng
sudo yum install ntopng redis

# For Fedora
sudo dnf install ntopng redis

Source Code Installation

For the latest features, compile from source:

# Install build dependencies
sudo apt install build-essential git autoconf automake libtool pkg-config

# Clone repository
git clone https://github.com/ntop/ntopng.git
cd ntopng

# Build and install
./autogen.sh
make
sudo make install

Basic ntopng Command Syntax

The basic syntax for ntopng command is:

ntopng [options] [interface]

Common Command Options

Starting ntopng: Practical Examples

Example 1: Basic Network Monitoring

Monitor traffic on the default network interface:

sudo ntopng -i eth0

Expected Output:

26/Aug/2025 04:58:32 [ntopng.cpp:1856] Welcome to ntopng x86_64 v.5.6 - Please report bugs at https://github.com/ntop/ntopng/issues
26/Aug/2025 04:58:32 [ntopng.cpp:1857] Built on Linux 5.4.0 with GCC 9.4.0
26/Aug/2025 04:58:32 [ntopng.cpp:1858] Copyright 2011-2023 ntop.org
26/Aug/2025 04:58:32 [Prefs.cpp:1124] Data directory: /var/lib/ntopng/ntopng.db
26/Aug/2025 04:58:32 [HTTPserver.cpp:1456] HTTP server listening on port 3000

Example 2: Custom Port and Interface

Start ntopng on a specific interface with custom web port:

sudo ntopng -i enp0s3 -P 8080

This command monitors the enp0s3 interface and makes the web interface available on port 8080.

Example 3: Multiple Interface Monitoring

Monitor multiple network interfaces simultaneously:

sudo ntopng -i eth0,wlan0 -P 3000

Configuration File Setup

Create a configuration file for persistent settings:

sudo nano /etc/ntopng/ntopng.conf

Example configuration:

# Network interface to monitor
-i=eth0

# HTTP server port
-P=3000

# Data directory
-d=/var/lib/ntopng

# Redis configuration
-r=127.0.0.1:6379

# User to run as
-u=ntopng

# Enable geolocation
--enable-geo

# Log level
-l=3

Web Interface Features

Dashboard Overview

Once ntopng is running, access the web interface at http://localhost:3000. The dashboard provides:

• Real-time Statistics: Live traffic graphs and counters
• Top Talkers: Hosts generating most traffic
• Application Protocols: Traffic breakdown by protocol
• Geographic Distribution: Traffic mapped by location

Navigation Menu

The web interface includes several key sections:

Advanced Monitoring Features

Flow Analysis

Enable detailed flow monitoring:

sudo ntopng -i eth0 -F "tcp" --enable-flows

This command focuses on TCP flows and provides detailed connection analysis.

Security Monitoring

Enable security features for threat detection:

sudo ntopng -i eth0 --enable-security --enable-malware-detection

Historical Data Collection

Configure ntopng to store historical data:

sudo ntopng -i eth0 -d /var/lib/ntopng --enable-timeseries

Troubleshooting Common Issues

Permission Errors

If you encounter permission errors, ensure proper user permissions:

# Create ntopng user
sudo useradd -r -s /bin/false ntopng

# Set data directory permissions
sudo chown -R ntopng:ntopng /var/lib/ntopng

Interface Not Found

List available network interfaces:

# Show all interfaces
ip link show

# Show only active interfaces
ip link show up

Redis Connection Issues

Verify Redis server status:

# Check Redis status
sudo systemctl status redis-server

# Start Redis if not running
sudo systemctl start redis-server

Performance Optimization

Memory Management

Optimize memory usage for large networks:

sudo ntopng -i eth0 --max-num-hosts 10000 --max-num-flows 50000

CPU Usage Optimization

Reduce CPU usage with sampling:

sudo ntopng -i eth0 --packet-filter "not port 22" --cpu-affinity 0,1

Integration and Automation

Systemd Service Configuration

Create a systemd service for automatic startup:

sudo nano /etc/systemd/system/ntopng.service

Service configuration:

[Unit]
Description=ntopng network monitoring daemon
After=network.target

[Service]
Type=simple
User=ntopng
ExecStart=/usr/bin/ntopng /etc/ntopng/ntopng.conf
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target

Enable and start the service:

sudo systemctl enable ntopng
sudo systemctl start ntopng

API Integration

Access ntopng data programmatically using REST API:

# Get interface statistics
curl "http://localhost:3000/lua/rest/v1/get/interface/data.lua"

# Get top hosts
curl "http://localhost:3000/lua/rest/v1/get/host/top.lua"

Security Considerations

Access Control

Configure authentication for the web interface:

# Add user authentication
sudo ntopng -i eth0 --http-auth-type basic --user admin:password

Network Security

Bind ntopng to specific interfaces for security:

sudo ntopng -i eth0 --http-address 127.0.0.1 -P 3000

Best Practices

Regular Maintenance

• Log Rotation: Configure log rotation to prevent disk space issues
• Database Cleanup: Regularly clean old data to maintain performance
• Updates: Keep ntopng updated for latest features and security patches

Monitoring Strategy

• Baseline Establishment: Create network performance baselines
• Alert Configuration: Set up alerts for unusual traffic patterns
• Regular Reviews: Schedule periodic traffic analysis reviews

Conclusion

The ntopng command provides comprehensive network traffic monitoring capabilities for Linux systems. From basic traffic analysis to advanced security monitoring, ntopng offers the tools needed for effective network management. By following the examples and best practices outlined in this guide, you can implement robust network monitoring that enhances both performance and security.

Whether you’re troubleshooting network issues, monitoring bandwidth usage, or detecting security threats, ntopng’s web-based interface and powerful features make it an essential tool for network administrators and system engineers.