Ntopng
ntopng is computer software for monitoring traffic on a computer network. It is designed to be a high-performance, low-resource replacement for ntop. The name is derived from ntop next generation. ntopng is open-source software released under the GNU General Public License for software. Source code versions are available for the operating systems: Unix, Linux, BSD, Mac OS X, and Windows. Binary versions are available for CentOS, Ubuntu, and OS X. A demo binary is available for Windows that limits analysis to 2,000 packets. ntopng's engine is written in the programming language C++. The optional web interface is written in Lua.
ntopng relies on the Redis key-value server rather than a traditional database, takes advantage of nDPI for protocol detection, supports geolocation of hosts, and is able to display real-time flow analysis for connected hosts.Sample use
ntopng --dns-mode 1 --interface 5 --daemon --redis localhost:6379 --verbose
Explanation: run ntopng executable, set DNS mode to decode DNS responses and resolve all numeric IPs, use fifth network interface, operate in daemon mode, use Redis server running on local host, and operate in verbose mode.
