Customer Success Story: ntop
ntopng is the next generation version of the original ntop, a network traffic probe that shows the network usage, similar to what the popular top Unix command does. ntopng is based on libpcap and it has been written in a portable way in order to virtually run on every Unix platform, MacOSX and on Windows as well.
ntopng users can use a web browser to navigate through ntop (that acts as a web server) traffic information and get a dump of the network status. In the latter case, ntopng can be seen as a simple RMON-like agent with an embedded web interface. The use of a web interface; limited configuration and administration via the web interface; and reduced CPU and memory usage (they vary according to network size and traffic) all make ntop easy to use and suitable for monitoring various kind of networks.
ntop wanted to give its customers the ability to analyze network traffic in a simple way and to be their source of network monitoring data. Because ntop’s users don’t need low-level information and often just want to know high-level facts, ntop had to translate networking information, such as packet loss, into something meaningful. In particular, for security, ntop needed to understand if something unexpected is happening on the network and how to fix it. ntop’s original solution already provided a visualization platform, but they needed flexible and scalable time series functionality to achieve monitoring granularity. ntop wanted to build a solution in line with its approach to network traffic monitoring.
ntopng allows comprehensive traffic views from very high-level to very low-level. This enables users to identify which host, physical port, or switch is causing issues and to troubleshoot the problem since such visibility provides a complete report of the network’s state. Using InfluxDB, ntopng is open to “big data” systems that can scale with data in volume and speed. It is able to export monitoring information in JSON format towards various systems including Elasticsearch / Logstash and ZMQ. ntopng is also able to collect, self-produce (from packets), and export monitoring information by normalizing it in JSON format.
“Removing the inability to monitor large networks with many counters and with low granularity is compulsory, and InfluxDB is definitively adequate for this task.”
Luca Deri, Founder, ntop