NTOP Alternatives?

Home » CentOS » NTOP Alternatives?
CentOS 15 Comments

Hi all.

I have currently a task to implement a network traffic analyzer. Some years ago I’ve used NTOP for that purpose, I would also like to test some alternatives. Which alternatives can you recommend and why?

Thanks ;)

Best regards, Rafa

15 thoughts on - NTOP Alternatives?

  • Or for one-off capture/analysis runs, wireshark is pretty good. I
    doubt if anything will match ntop for continuous captures with the ability to summarize in a large variety of ways.

  • As a package, either the Fedora-based NetworkSecurityToolkit (NST) or the loosly-based-on-ubuntu BackTrack are nice. NST has some very cool features, and a web UI that allows some nice options.

    NST runs best on a dedicated piece of hardware; slap a couple of GigE NIC’s in a good box with dual procs, put one GigE on a SPAN port or a hardware tap, install NST on it and configure to your liking. If you want prepackaged updates that you don’t have to built yourself, subscribe to the NSTPro service.


    I’m using it here, and coupled with the power and configurability of Cisco’s SPAN it works really well for troubleshooting. I’m using it enough that I set up my own builder on Fedora 16, and have been building my own updates out of NST’s SVN, which has been interesting….

  • Having lurked in this thread, I think I’ll start using ntop as well. Did a quick test today on my laptop and got it up and running in no time.

    But to answer the question people at the office keeps asking me, I need to dump Network Load data with a 1-second granularity. Does anoybody know how to do that? Basic question is, do we have large fluctuations on our internet connection usage.

    Thanks in advance!

    with kind regards,
    Bent Terp

  • —– “Bent Terp” escreveu:

    Hi Bent,

    Give a try to Collectd: http://www.collectd.org is a RRDTOOL data collect system.

    I use it on various systems without impacts on performance.


    | Antonio S. Martins Jr. – Support Analyst | “Only The Shadow Knows |
    | Universidade Estadual de Maringá – Brasil| what evil lurks in the |
    | NPD – Núcleo de Processamento de Dados | Heart of Men!” |
    | E-Mail: asmartins@uem.br / shadow@uem.br | !!! Linux User: 52392 !!! |
    “Real Programmers don’t need comments — the code is obvious.”

    Esta mensagem foi verificada pelo sistema de antivirus e acredita-se estar livre de perigo.

  • Am 29.08.2012 um 12:24 schrieb Antonio da Silva Martins Junior:


    i use collectd to keep tracked system offloaded and send all data via network (encrypted) to a central system.

    The central system has a continuous data stream onto the storage (my case saving >64 incoming samples/minute). Not a penalty but i would run only the logging service on this central system.


  • Does anyone know a repo which contains ntop for CentOS 6.x?
    I have been using ntop for 5.x from rpmforge, but coundn’t find RPMS
    for 6.x there.

    net foss

  • Have you tried Darkstat – it’s a nice very very lightweight alternative I installed it on CentOS 6.2 (64 bit VM). It is pretty light.

    I would like to know on which host should I install it on LAN?

    gateway Machine, proxy Server or any host on that LAN?

    I just installed on a host On a LAN. But, It does NOT show All the host on the LAN.

    It does NOT show my mail gateway. It is on the same LAN.

    Then, How can get actual traffic on my LAN ?

    Anyway, If clicked host link, It shows in , out , total traffic? It is bytes?

    I think it is in byte?

    ntop has more info though.

    I have used this since long time. many options. very difficult to understand.

    what about bandwidthd ? I have tried twice. On which host, Should I
    install it to see network traffic my lan?

    really like to hear from you.

  • If you want it to be able to see all traffic on the local network, then you have to make sure all the traffic actually shows up on that interface –
    which is not usually the case on a switched network :-)

    My plan for today is to install darkstar on a separate physical host with dual nic’s, and tell the switch to copy all traffic on the VLAN’s that I
    wish to monitor to one port which will then be connected to one of the NIC’s on the darkstar host. This feature is called “port mirroring” on ProCurve switches but most professional switches have similar features, although they might be called differently.

    Alternatively, if you have a gateway machine that all traffic passes through, this would also be a good candidate unless traffic is so high that the additional load from darkstat impacts performance – or any bug in darkstat that just might interrupt regular operations.

    BR Bent

  • Hi. Darkstat worked like a charm on my laptop yesterday, for traffic to/from the laptop. So this morning I’ve been trying to make it work in the serverroom.

    I’ve set up a monitoring port on the switch and mirrored a vlan to it. To this monitoring switch port, I’ve connected the second nic on a spare server.

    But I can’t make it see the traffic:
    *Running for* 38 secs*, since* 2012-08-30 08:27:12 UTC+0000*.*
    *Total* 0 *bytes, in* 0 *packets.* (2,512,454 *captured,* 2,494,741 *

    *And so the graphs are blank :-(

    I’ve tried several incantations to no avail:
    usr/local/sbin/darkstat -i eth1 -p 5001 –no-daemon –no-dns -l ”″ –local-only
    /usr/local/sbin/darkstat -i eth1 -p 5001 –no-daemon –no-dns -l ”″
    /usr/local/sbin/darkstat -i eth1 -p 5001 –no-daemon –no-dns

    I’ve even tried assigning a bogus ip address on the monitored subnet to eth1, but that doesn’t help either.

    Any suggestions?

    with kind regards,

  • I think This is an URL for it. Where it shows with a picture.


    The same thing for bandwidthd software.

    Pls assume*, My Network Monitoring Server has *2 Ethernets and also I have port mirroring capable switch.

    if one Ethernet of Netwrok monitoring Sever connects to usual port in the switch, Other LAN PCs also connects to the usual ports of the same switch . Then, remaining Ethernet of the Monitoring Server should connect to a mirrored port.

    *Then, to which port , Should I connect my router ???

    to a usual port or mirrored port of that same switch?

    if Router should be connected to a mirrored port , We need 2 mirrored port of the same switch..

    Pls let me know since I would like to learn..

    IF my Gateway is running squid But NOT in transparent mode, just a usual way with configurations of users’ browsers,

    Can I install darkstar or bandwidthd on that gateway box?

    I really like to hear from you?