ntop

Hi All,

I have been playing around with this openssource tool an my linux machine, and found it very good. Thought that I would post it here.

It is not so much a security tool, but more a network analysis tool.

Quote:

---

ntop is a network traffic probe that shows the network usage, similar to what the popular top Unix command does. ntop is based on libpcap and it has been written in a portable way in order to virtually run on every Unix platform and on Win32 as well.

ntop users can use a a web browser (e.g. netscape) to navigate through ntop (that acts as a web server) traffic information and get a dump of the network status. In the latter case, ntop can be seen as a simple RMON-like agent with an embedded web interface. The use of make ntop easy to use and suitable for monitoring various kind of networks.

---

It can be downloaded from here:

http://www.ntop.org/ntop.html

sounds pretty cool. it is available for the win32 platform as well so ill try it out tomorrow 56k @ home :-(

I've mentioned about ntop here while discussing some other network management tools:
http://www.antionline.com/showthread...104#post579104

Yes, I've been playing with ntop and it's cool. It's a network traffic analysis tool, it can run on win32, and that leads into a question: why did you post in *nix Security Discussions?

Peace always,
<jdenny>

Another great network protocol analyzer is Ethereal and this is my personal favorite for *nix and windows.

Quote:

---

Source: Ethereal
Ethereal is a free network protocol analyzer for Unix and Windows. It allows you to examine data from a live network or from a capture file on disk. You can interactively browse the capture data, viewing summary and detail information for each packet. Ethereal has several powerful features, including a rich display filter language and the ability to view the reconstructed stream of a TCP session.

---

~micael

From what I understand ntop sniffs only sniffs the local segment to get it's data right? So you'd have to have sensors spread in each segment if you wanted to use it as a permanent monitoring tool?

Ammo