### Install and Start ntopng via Homebrew Source: https://www.ntop.org/guides/ntopng/_sources/installation.rst.txt Commands to set up Redis and launch the ntopng process on macOS. ```bash brew install redis ``` ```bash brew services start redis ``` ```bash sudo ntopng ``` -------------------------------- ### Start ntopng with Secure ClickHouse Connection Source: https://www.ntop.org/guides/ntopng/flow_dump/clickhouse/clickhouse.html Example command to start ntopng with a secure ClickHouse connection. ```bash ntopng -F "clickhouse;127.0.0.1@9000,9440s;ntopng;default;default` ``` -------------------------------- ### Enable and start services Source: https://www.ntop.org/guides/ntopng/_sources/third_party_integrations/pfsense.rst.txt Enable services at boot and start them manually. ```bash sysrc redis_enable="YES" sysrc ntopng_enable="YES" ``` ```bash service redis start ``` ```bash service ntopng start ``` -------------------------------- ### Start ntopng with ClickHouse Cloud Source: https://www.ntop.org/guides/ntopng/flow_dump/clickhouse/clickhouse.html Example command to connect ntopng to ClickHouse Cloud using a secure connection. ```bash ntopng -F "clickhouse-cloud;127.0.0.1@9440,3306s;ntopng;default,default;default` ``` -------------------------------- ### Get Host Pool Source: https://www.ntop.org/guides/ntopng/_sources/api/rest/examples_v2.rst.txt Examples for retrieving host pool information. ```bash curl -s -u admin:admin -H "Content-Type: application/json" -d '{"pool": 1}' http://localhost:3000/lua/rest/v2/get/host/pools.lua curl -s -u admin:admin -H "Content-Type: application/json" -d '{}' http://localhost:3000/lua/rest/v2/get/host/pools.lua ``` -------------------------------- ### Kafka Export Command Examples Source: https://www.ntop.org/guides/ntopng/flow_dump/kafka/export_flows.html Practical examples for configuring Kafka exports with single or multiple brokers and optional compression settings. ```text kafka;127.0.0.1;ntopng_flows ``` ```text kafka;127.0.0.1:7689,192.168.1.20,192.168.1.2;ntopng_flows;compression.codec=gzip ``` -------------------------------- ### Start Services Source: https://www.ntop.org/guides/ntopng/third_party_integrations/pfsense.html Commands to manually start the redis and ntopng services. ```shell service redis start ``` ```shell service ntopng start ``` -------------------------------- ### Install ntopng and Redis plugins Source: https://www.ntop.org/guides/ntopng/_sources/third_party_integrations/opnsense.rst.txt Update the package database and install the required enterprise plugins via the shell. ```bash pkg update pkg install os-ntopng-enterprise os-redis ``` -------------------------------- ### Install ntopng package Source: https://www.ntop.org/guides/ntopng/_sources/third_party_integrations/pfsense.rst.txt Install the ntopng and redis packages from the configured repository. ```bash pkg install ntopng redis ``` -------------------------------- ### Install ClickHouse on FreeBSD Source: https://www.ntop.org/guides/ntopng/flow_dump/clickhouse/installation.html Manual installation steps for the ClickHouse binary on FreeBSD systems. ```bash curl https://clickhouse.com/ | sh mv clickhouse /usr/local/bin/ ``` -------------------------------- ### Configure ntopng ZMQ endpoint for IPS events Source: https://www.ntop.org/guides/ntopng/_sources/using_with_other_tools/nfw.rst.txt Example commands to start nfw and ntopng with ZMQ endpoints for policy enforcement. ```bash nfw -q 0 -z tcp://ntopng-host:5556 -p tcp://ntopng-host:5557 ntopng -i tcp://127.0.0.1:1234 --zmq-publish-events tcp://*:5557 ``` -------------------------------- ### Launch nProbe Cento with ClickHouse export Source: https://www.ntop.org/guides/ntopng/using_with_other_tools/cento.html Example command to start nProbe Cento with ClickHouse export enabled. ```bash cento -i zc:eth1 --zmq tcp://127.0.0.1:5556 --clickhouse 192.168.1.1 --dpi-level 2 ``` -------------------------------- ### Install ntopng service with NSSM Source: https://www.ntop.org/guides/ntopng/_sources/how_to_start/running_on_windows.rst.txt Use the NSSM utility to install ntopng as a service with custom configuration. ```bash C:\nssm\nssm.exe install ntopng ``` -------------------------------- ### Start ntopng in read-only flow dump mode Source: https://www.ntop.org/guides/ntopng/using_with_other_tools/cento.html Example command to start ntopng in read-only mode to read flows from ClickHouse. ```bash ntopng -i tcp://*:5556c -F clickhouse --readonly-flows-dump ``` -------------------------------- ### Enable Services Source: https://www.ntop.org/guides/ntopng/third_party_integrations/pfsense.html Configures redis and ntopng to start automatically on boot. ```shell sysrc redis_enable="YES" sysrc ntopng_enable="YES" ``` -------------------------------- ### Install n2disk on Linux Source: https://www.ntop.org/guides/ntopng/_sources/using_with_other_tools/n2disk.rst.txt Commands to install the n2disk application on systems using apt or yum package managers. ```bash apt-get install n2disk ``` ```bash yum install n2disk ``` -------------------------------- ### Install ntopng Python requirements Source: https://www.ntop.org/guides/ntopng/_sources/api/python/index.rst.txt Install the necessary dependencies for the ntopng Python API. ```bash pip3 install -r requirements.txt ``` -------------------------------- ### GET /lua/pro/rest/v1/get/infrastructure/instance.lua Source: https://www.ntop.org/guides/ntopng/api/rest/api_v1.html Retrieves one or all infrastructure configurations. ```APIDOC ## GET /lua/pro/rest/v1/get/infrastructure/instance.lua ### Description Get one or all infrastructure configs. ### Method GET ### Endpoint /lua/pro/rest/v1/get/infrastructure/instance.lua ``` -------------------------------- ### Install ntopng Python package Source: https://www.ntop.org/guides/ntopng/_sources/api/python/index.rst.txt Install the latest ntopng Python package via pip. ```bash pip3 install ntopng ``` -------------------------------- ### Example ntopng.conf configuration file Source: https://www.ntop.org/guides/ntopng/_sources/how_to_start/configuration_file.rst.txt A sample configuration file demonstrating common settings like HTTP ports, DNS modes, and memory limits. ```bash # Listen on localhost:3000 only --http-port=:3000 # Use prefix due to nginx proxy --http-prefix="/ntopng" # Everybody's admin #--disable-login=1 # Do not resolve any names --dns-mode=3 # Limit memory usage --max-num-flows=200000 --max-num-hosts=250000 # Dump flows to ClickHouse --dump-flows=clickhouse #--verbose ``` -------------------------------- ### ntopng Configuration File Syntax Source: https://www.ntop.org/guides/ntopng/_sources/cli_options/cli_options_example.rst.txt Example configuration file showing PID path and multiple interface definitions. ```bash # The configuration file is similar to the command line, with the exception that an equal # sign '=' must be used between key and value. Example: -i=p1p2 or --interface=p1p2 For # options with no value (e.g. -v) the equal is also necessary. Example: "-v=" must be used. # # # -G|--pid-path # Specifies the path where the PID (process ID) is saved. This option is ignored when # ntopng is controlled with systemd (e.g., service ntopng start). # -G=/var/run/ntopng.pid # # -i|--interface # Specifies the network interface or collector endpoint to be used by ntopng for network # monitoring. On Unix you can specify both the interface name (e.g. lo) or the numeric # interface id as shown by ntopng -h. On Windows you must use the interface number instead. # Note that you can specify -i multiple times in order to instruct ntopng to create multi- # ple interfaces. # # -i=eth1 -i=eno1 -i=eno2 -i=lo -i=tcp://127.0.0.1:5556 # # # -m|--local-networks ``` -------------------------------- ### Configure ntopng settings Source: https://www.ntop.org/guides/ntopng/_sources/third_party_integrations/pfsense.rst.txt Copy the sample configuration file and set appropriate ownership. ```bash cp /usr/local/etc/ntopng/ntopng.conf.sample /usr/local/etc/ntopng/ntopng.conf chown ntopng:ntopng /usr/local/etc/ntopng/ntopng.conf ``` -------------------------------- ### ntopng Configuration File Syntax Source: https://www.ntop.org/guides/ntopng/cli_options/cli_options_example.html Example configuration file demonstrating the use of equal signs for key-value pairs and various network and flow settings. ```text # The configuration file is similar to the command line, with the exception that an equal # sign '=' must be used between key and value. Example: -i=p1p2 or --interface=p1p2 For # options with no value (e.g. -v) the equal is also necessary. Example: "-v=" must be used. # # # -G|--pid-path # Specifies the path where the PID (process ID) is saved. This option is ignored when # ntopng is controlled with systemd (e.g., service ntopng start). # -G=/var/run/ntopng.pid # # -i|--interface # Specifies the network interface or collector endpoint to be used by ntopng for network # monitoring. On Unix you can specify both the interface name (e.g. lo) or the numeric # interface id as shown by ntopng -h. On Windows you must use the interface number instead. # Note that you can specify -i multiple times in order to instruct ntopng to create multi- # ple interfaces. # # -i=eth1 -i=eno1 -i=eno2 -i=lo -i=tcp://127.0.0.1:5556 # # # -m|--local-networks # ntopng determines the ip addresses and netmasks for each active interface. Any traffic on # those networks is considered local. This parameter allows the user to define additional # networks and subnetworks whose traffic is also considered local in ntopng reports. All # other hosts are considered remote. If not specified the default is set to 192.168.1.0/24. # # Commas separate multiple network values. Both netmask and CIDR notation may be used, # even mixed together, for instance "131.114.21.0/24,10.0.0.0/255.0.0.0". # -m="10.10.123.0/24=Milan,10.8.124.0/24=Paris,10.7.10.0/24=Rome,10.6.0.0/24=Florence" # # -n|--dns-mode # Sets the DNS address resolution mode: 0 - Decode DNS responses and resolve only local # (-m) numeric IPs 1 - Decode DNS responses and resolve all numeric IPs 2 - Decode DNS # responses and don't resolve numeric IPs 3 - Don't decode DNS responses and don't resolve # -n=1 # # -X|--max-num-flows # Set max number of active flows (default: 131072) # -X=500000 # # -x|--max-num-hosts # Set max number of active hosts (default: 131072) # -x=500000 ``` -------------------------------- ### GET /lua/rest/v1/get/host/pools.lua Source: https://www.ntop.org/guides/ntopng/api/rest/api_v1.html Get one or all host pools. ```APIDOC ## GET /lua/rest/v1/get/host/pools.lua ### Description Get one or all host pools. ### Method GET ### Endpoint /lua/rest/v1/get/host/pools.lua ### Response #### Success Response (200) - **0** - OK ``` -------------------------------- ### Start ntopng via command line Source: https://www.ntop.org/guides/ntopng/_sources/how_to_start/index.rst.txt Use these commands to launch ntopng by specifying a configuration file or passing command line options directly. ```bash ntopng ntopng ``` -------------------------------- ### GET /lua/rest/v1/get/host/pool_by_member.lua Source: https://www.ntop.org/guides/ntopng/api/rest/api_v1.html Get an host pool given a member. ```APIDOC ## GET /lua/rest/v1/get/host/pool_by_member.lua ### Description Get an host pool given a member. ### Method GET ### Endpoint /lua/rest/v1/get/host/pool_by_member.lua ### Response #### Success Response (200) - **0** - OK - **-3** - NOT_GRANTED - **-5** - INVALID_ARGUMENTS - **-17** - BIND_POOL_MEMBER_FAILED ``` -------------------------------- ### GET /lua/rest/v1/get/host/pool/members.lua Source: https://www.ntop.org/guides/ntopng/api/rest/api_v1.html Get all the members of a given host pool. ```APIDOC ## GET /lua/rest/v1/get/host/pool/members.lua ### Description Get all the members of a given host pool. ### Method GET ### Endpoint /lua/rest/v1/get/host/pool/members.lua ### Parameters #### Query Parameters - **recipient_id** (int16) - Required - A recipient id ### Response #### Success Response (200) - **0** - OK ``` -------------------------------- ### Install License Key to File Source: https://www.ntop.org/guides/ntopng/_sources/versions_and_licensing.rst.txt Save the generated license key into the /etc/ntopng.license file to apply it to the ntopng instance. ```bash # echo "XJQ6U04QIW2ixxzNMfGnWibAySvd8Rd3K4qxymrZNT3DoR0m1K6Ybx1nnG1Y1n+7O4znPE4Zroy+A5EZZfu/i0UzrOhly/HNUgNju+RTP6d/zAvMTs04ZtIG9/BjalrrOfHzw0bU3uTm0z1F+S5N6IFUP6cXzoWP+yrpGmPjzmQHGa5kSw5IJw6YjmPvAgGLHsKn+u2KoA6xP7c4eZ7YGJ/S6MTmYtLFOBse4qoaViSC30RBu54QVG4Zafz4qwhMEnT+hijwbkWJfjZBRzl3eLE05HclnkRWibuYJqKG6c9NRExF0u6a3+P/+ouB7PcczDf8G4O22MWgr2cTNjsmRA==" > /etc/ntopng.license ``` -------------------------------- ### GET /lua/rest/v1/get/network/pools.lua Source: https://www.ntop.org/guides/ntopng/api/rest/api_v1.html Get one or all local network pools. ```APIDOC ## GET /lua/rest/v1/get/network/pools.lua ### Description Get one or all local network pools. ### Method GET ### Endpoint /lua/rest/v1/get/network/pools.lua ### Response #### Success Response (200) - **0** - OK - **-16** - POOL_NOT_FOUND ``` -------------------------------- ### GET /lua/rest/v1/get/system/stats.lua Source: https://www.ntop.org/guides/ntopng/api/rest/api_v1.html Get statistics of the system on top of which ntopng is running. ```APIDOC ## GET /lua/rest/v1/get/system/stats.lua ### Description Get statistics of the system on top of which ntopng is running. ### Method GET ### Endpoint /lua/rest/v1/get/system/stats.lua ### Response #### Success Response (200) - **0** (integer) - OK ``` -------------------------------- ### License Manager Configuration File Source: https://www.ntop.org/guides/ntopng/versions_and_licensing.html Example configuration file defining the license manager host, instance identity, authentication token, and product edition. ```ini LICENSE_MANAGER=127.0.0.1:9999 # # Unique instance name # INSTANCE_NAME=dummy ntopng instance # # User authentication token # AUTH_TOKEN=fjfgsfgsj # # nprobe ntopng # PRODUCT_FAMILY=ntopng # # pro enterprise_s enterprise_m enterprise_l # PRODUCT_EDITION=enterprise_m ``` -------------------------------- ### GET /lua/rest/v1/get/pools.lua Source: https://www.ntop.org/guides/ntopng/api/rest/api_v1.html Get all pools defined for any available pool type. ```APIDOC ## GET /lua/rest/v1/get/pools.lua ### Description Get all pools defined for any available pool type. ### Method GET ### Endpoint /lua/rest/v1/get/pools.lua ### Response #### Success Response (200) - **0** - OK - **-16** - POOL_NOT_FOUND ``` -------------------------------- ### Run ntopng alerts sample application Source: https://www.ntop.org/guides/ntopng/_sources/api/python/index.rst.txt Execute the alerts sample script with required connection parameters. ```bash python3 alerts.py -n http://localhost:3000 -i admin -p password -i 0 ``` -------------------------------- ### View ntopng help information Source: https://www.ntop.org/guides/ntopng/_sources/cli_options/cli_options.rst.txt Display the available command line parameters and usage instructions. ```bash Usage: ntopng or ntopng Options: [--dns-mode|-n] | DNS address resolution mode | 0 - Decode DNS responses and resolve | local numeric IPs only (default) | 1 - Decode DNS responses and resolve all | numeric IPs | 2 - Decode DNS responses but don't | resolve numeric IPs | 3 - Don't decode DNS/MDNS/HTTP/TLS responses | and don't resolve numeric IPs (all hosts) | 4 - Don't decode DNS/MDNS/HTTP/TLS responses | and don't resolve numeric IPs (localhost only) [--interface|-i] | Input interface name (numeric/symbolic), | view or pcap file path, including: | zmq:// [ZMQ flow collection] | tcp:// [Deprecated - use zmq://] | kafka:// [Kafka flow collection] | kafka-ssl:// [Kafka flow collection over SSL/TLS] [--data-dir|-d] | Data directory (must be writable). | Default: /var/lib/ntopng [--install-dir|-t] | Set the installation directory to . | Should be set when installing ntopng | under custom directories [--daemon|-e] | Daemonize ntopng [--httpdocs-dir|-1] | HTTP documents root directory. | Default: httpdocs [--scripts-dir|-2] | Scripts directory. | Default: scripts [--callbacks-dir|-3] | Callbacks directory. | Default: scripts/callbacks [--pcap-dir|-5] | Storage directory used for continuous traffic | recording in PCAP format. | Default: /var/lib/ntopng [--no-promisc|-u] | Don't set the interface in promisc mode. [--geoip-dir] | Load GeoIP databases from the specified directory. [--http-port|-w] <[addr:]port> | HTTP. Set to 0 to disable http server. | Addr can be an IPv4 (192.168.1.1) | or IPv6 ([3ffe:2a00:100:7031::1]) addr. | Surround IPv6 addr with square brackets. | Prepend a ':' without addr before the | listening port on the loopback address. | Default port: 3000 | Examples: | -w :3000 | -w 192.168.1.1:3001 | -w [3ffe:2a00:100:7031::1]:3002 [--https-port|-W] <[:]https port> | HTTPS. See also -w above. Default: 3001 [--http-log|-L] | Log HTTP requests in the specified file [--local-networks|-m] | Local networks in CIDR format and | autonomous system in asn format. | The file accepts multiple lines with networks in CIDR format. | An optional '=' is supported | to specify an alias. | Examples: | -m "192.168.1.0/24,172.16.0.0/16" | -m "192.168.1.0/24=LAN_1,192.168.2.0/24=LAN_2,10.0.0.0/8" | -m "/path/to/local_networks_file" [--ndpi-protocols|-p] .protos | Specify a nDPI protocol file | (eg. protos.txt) [--redis|-r] | Redis connection. is specified as | [h[:port[:pwd]]][@db-id] where db-id | identifies the database Id (default 0). ``` -------------------------------- ### GET /lua/rest/v1/recipient/pools.lua Source: https://www.ntop.org/guides/ntopng/api/rest/api_v1.html Get all pools defined for any available pool type for a given recipient id. ```APIDOC ## GET /lua/rest/v1/recipient/pools.lua ### Description Get all pools defined for any available pool type for a given recipient id. ### Method GET ### Endpoint /lua/rest/v1/recipient/pools.lua ### Response #### Success Response (200) - **0** - OK ``` -------------------------------- ### Check ntopng version and System ID Source: https://www.ntop.org/guides/ntopng/versions_and_licensing.html Use the --version flag to retrieve the current build information and System ID required for license generation. ```bash $ ntopng --version Version: 5.1.210819 [Enterprise/Professional build] [...] System Id: LA2D7D2FB9206AAF2--UA2D7D2FBDDCCD490--OL ``` -------------------------------- ### GET /lua/rest/v2/get/host/data.lua Source: https://www.ntop.org/guides/ntopng/_sources/api/rest/api_v2.rst.txt Retrieves data for a specific host on a given interface using a GET request. ```APIDOC ## GET /lua/rest/v2/get/host/data.lua ### Description Retrieves host data from the specified interface. ### Method GET ### Endpoint /lua/rest/v2/get/host/data.lua ### Parameters #### Query Parameters - **ifid** (string) - Required - The interface ID. - **host** (string) - Required - The IP address of the host. ``` -------------------------------- ### Verify ntopng configuration directory Source: https://www.ntop.org/guides/ntopng/_sources/how_to_start/running_as_a_daemon.rst.txt List the contents of the configuration directory to confirm the presence of ntopng.conf and ntopng.start. ```bash root@devel:/etc/ntopng$ ls -lha total 28K drwxr-xr-x 2 root root 4.0K Mar 17 15:44 . drwxr-xr-x 117 root root 12K Mar 11 12:16 .. -rw-r--r-- 1 root root 211 Mar 15 17:54 ntopng.conf -rw-r--r-- 1 root root 0 Mar 17 15:44 ntopng.start ``` -------------------------------- ### License Manager Configuration Source: https://www.ntop.org/guides/ntopng/_sources/versions_and_licensing.rst.txt Example configuration file for connecting ntopng to a License Manager (LM). ```bash LICENSE_MANAGER=127.0.0.1:9999 # # Unique instance name # INSTANCE_NAME=dummy ntopng instance # # User authentication token # AUTH_TOKEN=fjfgsfgsj # # nprobe ntopng # PRODUCT_FAMILY=ntopng # # pro enterprise_s enterprise_m enterprise_l # PRODUCT_EDITION=enterprise_m ``` -------------------------------- ### Install license key Source: https://www.ntop.org/guides/ntopng/_sources/third_party_integrations/pfsense.rst.txt Save the license key to the required configuration path. ```bash echo LICENSE_KEY > /usr/local/etc/ntopng.license ``` -------------------------------- ### Local All-in-One Deployment Configuration Source: https://www.ntop.org/guides/ntopng/_sources/using_with_other_tools/cento.rst.txt Simplified configuration for running Cento, ClickHouse, and ntopng on the same host. ```bash cento -i zc:eth1 --clickhouse 127.0.0.1 --clickhouse-interface-id 1 ntopng -i tcp://*:5556c -F clickhouse --readonly-flows-dump ``` -------------------------------- ### Plain-English Policy Requirement Examples Source: https://www.ntop.org/guides/ntopng/nanalyst/features/policies.html Examples of natural language inputs used to define network security or operational policies. ```text "No SSH for host 192.168.2.38 during business hours" "Alert if any host's traffic is more than 2x its hourly baseline" "Detect outbound connections to non-approved countries" ``` -------------------------------- ### Authenticate with ntopng Token Source: https://www.ntop.org/guides/ntopng/_sources/authentication.rst.txt Examples of using the authentication token in HTTP headers and via command-line tools. ```text Authorization: Token 39ca319a42... ``` ```text curl -v http://localhost:3000/lua/locale.lua -H 'Authorization: Token 39ca319a42...' ``` -------------------------------- ### Configure OEM Branding and Assets Source: https://www.ntop.org/guides/ntopng/_sources/advanced_features/oem.rst.txt Paths for defining custom product names, logos, favicons, and CSS themes. ```bash /etc/ntopng/product_name ``` ```bash /etc/ntopng/custom_logo.png ``` ```bash /etc/ntopng/custom_favicon.ico ``` ```bash /etc/ntopng/custom-theme.css ``` -------------------------------- ### POST lua/rest/v1/import/all/config.lua Source: https://www.ntop.org/guides/ntopng/api/rest/api_v1.html Import all configurations providing a JSON file. ```APIDOC ## POST lua/rest/v1/import/all/config.lua ### Description Import all configurations including Pools, Active Monitoring, Notifications (Endpoints and Recipients), Checks, SNMP devices. ### Method POST ### Endpoint lua/rest/v1/import/all/config.lua ### Response #### Success Response (200) - **0** (integer) - OK ``` -------------------------------- ### GET /lua/rest/v2/get/pools.lua Source: https://www.ntop.org/guides/ntopng/api/rest/examples_v2.html Retrieves all pools of any type. ```APIDOC ## GET /lua/rest/v2/get/pools.lua ### Description Retrieves a list of all pools configured in the system regardless of type. ### Method GET ### Endpoint http://devel:3000/lua/rest/v2/get/pools.lua ``` -------------------------------- ### GET /lua/rest/v1/delete/host/pool.lua Source: https://www.ntop.org/guides/ntopng/api/rest/api_v1.html Delete an host pool. ```APIDOC ## GET /lua/rest/v1/delete/host/pool.lua ### Description Delete an host pool. ### Method GET ### Endpoint /lua/rest/v1/delete/host/pool.lua ### Response #### Success Response (200) - **0** - OK - **-3** - NOT_GRANTED - **-5** - INVALID_ARGUMENTS - **-14** - EDIT_POOL_FAILED ``` -------------------------------- ### Get All Pools Source: https://www.ntop.org/guides/ntopng/_sources/api/rest/examples_v1.rst.txt Retrieve all pools of any type. ```bash curl -s -u admin:admin -H "Content-Type: application/json" curl http://devel:3000/lua/rest/v1/get/pools.lua ``` -------------------------------- ### Configure local networks via command line Source: https://www.ntop.org/guides/ntopng/basic_concepts/hosts.html Define local networks during ntopng startup to enable enhanced monitoring for specific IP ranges. ```bash ntopng --local-networks 10.0.0.0/8 ``` ```bash ntopng --local-networks 10.0.0.0/8=Office,192.168.2.0/24=Home ``` -------------------------------- ### Launch ntopng-config utility Source: https://www.ntop.org/guides/ntopng/_sources/how_to_start/configuration_file.rst.txt Command to launch the graphical configuration script with root privileges. ```bash $ sudo ntopng-config ``` -------------------------------- ### Retrieve system information for licensing Source: https://www.ntop.org/guides/ntopng/_sources/third_party_integrations/pfsense.rst.txt Run this command to obtain the Version and System ID required for generating an ntopng license. ```bash /usr/local/bin/ntopng -V ``` -------------------------------- ### GET /lua/rest/v1/bind/host/pool/member.lua Source: https://www.ntop.org/guides/ntopng/api/rest/api_v1.html Bind a member to an host pool. ```APIDOC ## GET /lua/rest/v1/bind/host/pool/member.lua ### Description Bind a member to an host pool. ### Method GET ### Endpoint /lua/rest/v1/bind/host/pool/member.lua ### Response #### Success Response (200) - **0** - OK - **-16** - POOL_NOT_FOUND ``` -------------------------------- ### GET /lua/rest/v1/delete/network/pool.lua Source: https://www.ntop.org/guides/ntopng/api/rest/api_v1.html Delete a local network pool. ```APIDOC ## GET /lua/rest/v1/delete/network/pool.lua ### Description Delete a local network pool. ### Method GET ### Endpoint /lua/rest/v1/delete/network/pool.lua ### Response #### Success Response (200) - **0** - OK - **-3** - NOT_GRANTED - **-5** - INVALID_ARGUMENTS - **-16** - POOL_NOT_FOUND ``` -------------------------------- ### Display ntopng help Source: https://www.ntop.org/guides/ntopng/_sources/how_to_start/running_on_windows.rst.txt Use the /c flag to run ntopng in console mode and display help information. ```bash ntopng /c -h ``` -------------------------------- ### GET /lua/rest/v2/get/l4/protocol/consts.lua Source: https://www.ntop.org/guides/ntopng/_sources/api/rest/examples_v2.rst.txt Retrieves L4 protocol constants. ```APIDOC ## GET /lua/rest/v2/get/l4/protocol/consts.lua ### Description Retrieves a list of L4 protocol constants. ### Method GET ### Endpoint /lua/rest/v2/get/l4/protocol/consts.lua ### Response #### Success Response (200) - **rc** (integer) - Return code - **rsp** (array) - List of protocols with name and id - **rc_str** (string) - Status message #### Response Example { "rc": 0, "rsp": [ { "name": "TCP", "id": 6 } ], "rc_str": "OK" } ``` -------------------------------- ### GET /lua/pro/rest/v1/get/db/flows.lua Source: https://www.ntop.org/guides/ntopng/api/rest/api_v1.html Executes a query to the flows database. ```APIDOC ## GET /lua/pro/rest/v1/get/db/flows.lua ### Description Executes a query to the flows database. ### Method GET ### Endpoint /lua/pro/rest/v1/get/db/flows.lua ### Parameters #### Query Parameters - **ifid** (integer) - Required - Interface identifier - **begin_time_clause** (integer) - Required - Start time (epoch) - **end_time_clause** (integer) - Required - Start time (epoch) - **select_clause** (string) - Optional - Select clause (default: *) - **where_clause** (string) - Optional - Where clause (default: none) - **maxhits_clause** (integer) - Optional - Max hits (default: 10) ``` -------------------------------- ### Configure local networks using a file Source: https://www.ntop.org/guides/ntopng/basic_concepts/hosts.html Use an external configuration file to manage long lists of local networks. ```bash ntopng --local-networks /etc/ntopng/localnetworks.txt ``` ```text 10.0.0.0/8=Office 192.168.2.0/24=Home ``` -------------------------------- ### GET /lua/rest/v2/get/alert/severity/counters.lua Source: https://www.ntop.org/guides/ntopng/api/rest/api_v1.html Retrieves alert counters by severity. ```APIDOC ## GET /lua/rest/v2/get/alert/severity/counters.lua ### Description Returns alert severity counters in descending order. ### Method GET ### Endpoint /lua/rest/v2/get/alert/severity/counters.lua ### Parameters #### Query Parameters - **ifid** (integer) - Required - Interface identifier - **status** (string) - Required - Status filter (historical, historical-flows) - **epoch_begin** (integer) - Required - Start time (epoch) - **epoch_end** (integer) - Required - Start time (epoch) ### Response #### Success Response (200) - **0** - OK ``` -------------------------------- ### Run ntopng with ClickHouse Cloud Source: https://www.ntop.org/guides/ntopng/flow_dump/clickhouse/installation.html Example command line usage for connecting ntopng to a ClickHouse Cloud instance. ```bash ./ntopng -F "clickhouse-cloud;my-cloud-host.clickhouse.org@9440,3306s;ntopng;ch-user,mysql-user;ch-password" ``` -------------------------------- ### Configure ntop repository for pfSense Plus Source: https://www.ntop.org/guides/ntopng/_sources/third_party_integrations/pfsense.rst.txt Create these configuration files to allow package installation on pfSense Plus versions using custom root certificates. ```text ntop: { env: { SSL_CA_CERT_FILE=/usr/local/share/certs/ca-root-nss.crt }, fingerprints: "/usr/local/etc/pkg/fingerprints/ntop", url: https://packages.ntop.org/FreeBSD/${ABI}/latest, signature_type: "fingerprints", priority: 100, enabled: yes } ``` ```text function: "sha256" fingerprint: "d912f631f592c3aebc4f59b25ee85b5118d24a50066c6013d736fa64eb0c4cd2" ``` -------------------------------- ### GET /lua/rest/v2/get/alert/type/counters.lua Source: https://www.ntop.org/guides/ntopng/api/rest/api_v1.html Retrieves alert counters by type. ```APIDOC ## GET /lua/rest/v2/get/alert/type/counters.lua ### Description Returns alert type counters in descending order. ### Method GET ### Endpoint /lua/rest/v2/get/alert/type/counters.lua ### Parameters #### Query Parameters - **ifid** (integer) - Required - Interface identifier - **status** (string) - Required - Status filter (historical, historical-flows) - **epoch_begin** (integer) - Required - Start time (epoch) - **epoch_end** (integer) - Required - Start time (epoch) ### Response #### Success Response (200) - **0** - OK ``` -------------------------------- ### Configure ntopng and nProbe communication Source: https://www.ntop.org/guides/ntopng/_sources/cli_options/cli_options.rst.txt Examples for setting up nProbe to send data to ntopng via ZMQ. ```bash nprobe -i eth0 -n none --zmq "tcp://*:5556" ntopng -i "tcp://:5556" ``` ```bash nprobe -i eth0 -n none --zmq-probe-mode --zmq "tcp://:5556" ntopng -i "tcp://*:5556c" ``` -------------------------------- ### GET /lua/rest/v1/get/alert/severity/consts.lua Source: https://www.ntop.org/guides/ntopng/api/rest/api_v1.html Retrieves alert severity constants. ```APIDOC ## GET /lua/rest/v1/get/alert/severity/consts.lua ### Description Returns alert severity string and integer severity id for each defined severity. ### Method GET ### Endpoint /lua/rest/v1/get/alert/severity/consts.lua ### Response #### Success Response (200) - **0** - OK ``` -------------------------------- ### GET /lua/rest/v2/get/alert/severity/consts.lua Source: https://www.ntop.org/guides/ntopng/_sources/api/rest/examples_v2.rst.txt Retrieves the alert severity constants. ```APIDOC ## GET /lua/rest/v2/get/alert/severity/consts.lua ### Description Retrieves the mapping of alert severity levels to their constant IDs. ### Method GET ### Endpoint /lua/rest/v2/get/alert/severity/consts.lua ### Response #### Success Response (200) - **rsp** (array) - List of severity objects - **rc** (integer) - Return code - **rc_str** (string) - Status message ``` -------------------------------- ### Configure nProbe for ntopng Source: https://www.ntop.org/guides/ntopng/_sources/using_with_other_tools/nprobe.rst.txt Replace the existing nProbe configuration with the provided sample and restart the service. ```bash cp /etc/nprobe/nprobe.conf.ntopng.sample /etc/nprobe/nprobe.conf systemctl restart nprobe ``` -------------------------------- ### Install ntop repository Source: https://www.ntop.org/guides/ntopng/_sources/third_party_integrations/opnsense.rst.txt Use this command in the OPNsense shell to add the ntop package repository. ```bash pkg add https://packages.ntop.org/FreeBSD/FreeBSD:14:amd64/latest/ntop-1.0.pkg ``` -------------------------------- ### GET /lua/rest/v2/get/l4/protocol/consts.lua Source: https://www.ntop.org/guides/ntopng/api/rest/examples_v2.html Retrieves a list of L4 protocol constants. ```APIDOC ## GET /lua/rest/v2/get/l4/protocol/consts.lua ### Description Retrieves the list of available L4 protocol constants. ### Method GET ### Endpoint /lua/rest/v2/get/l4/protocol/consts.lua ### Response #### Success Response (200) - **rc** (integer) - Return code - **rsp** (array) - List of L4 protocols - **rc_str** (string) - Status string #### Response Example { "rc": 0, "rsp": [ { "name": "IP", "id": 0 } ], "rc_str": "OK" } ``` -------------------------------- ### GET /lua/rest/v1/delete/recipients.lua Source: https://www.ntop.org/guides/ntopng/api/rest/api_v1.html Delete all defined recipients and reset them to factory-defaults. ```APIDOC ## GET /lua/rest/v1/delete/recipients.lua ### Description Delete all defined recipients and reset them to factory-defaults. ### Method GET ### Endpoint /lua/rest/v1/delete/recipients.lua ### Response #### Success Response (200) - **0** (integer) - OK ``` -------------------------------- ### Declarative GUI definition with localization keys Source: https://www.ntop.org/guides/ntopng/_sources/scripts/localization.rst.txt Example showing how ntopng automatically resolves keys prefixed with i18n_. ```lua gui = { i18n_title = "room_temp_monitor.my_title", i18n_description = "room_temp_monitor.my_title", } ``` -------------------------------- ### GET /lua/rest/v1/delete/pools.lua Source: https://www.ntop.org/guides/ntopng/api/rest/api_v1.html Delete all pools for any available pool type. ```APIDOC ## GET /lua/rest/v1/delete/pools.lua ### Description Delete all pools for any available pool type. ### Method GET ### Endpoint /lua/rest/v1/delete/pools.lua ### Response #### Success Response (200) - **0** - OK - **-3** - NOT_GRANTED - **-5** - INVALID_ARGUMENTS - **-16** - POOL_NOT_FOUND ``` -------------------------------- ### POST lua/rest/v1/reset/all/config.lua Source: https://www.ntop.org/guides/ntopng/api/rest/api_v1.html Reset all system configurations. ```APIDOC ## POST lua/rest/v1/reset/all/config.lua ### Description Reset all configurations. ### Method POST ### Endpoint lua/rest/v1/reset/all/config.lua ### Response #### Success Response (200) - **0** - OK - **-3** - NOT_GRANTED - **-5** - INVALID_ARGUMENTS - **-27** - CONFIGURATION_FILE_MISMATCH - **-28** - PARTIAL_IMPORT ``` -------------------------------- ### GET /lua/rest/v1/get/alert/type/consts.lua Source: https://www.ntop.org/guides/ntopng/api/rest/examples_v1.html Retrieves the constants defined for alert types. ```APIDOC ## GET /lua/rest/v1/get/alert/type/consts.lua ### Description Retrieves the constants defined for alert types. ### Method GET ### Endpoint http://localhost:3000/lua/rest/v1/get/alert/type/consts.lua ### Response #### Success Response (200) - **rsp** (array) - List of alert type objects - **rc** (integer) - Return code - **rc_str** (string) - Status message ``` -------------------------------- ### GET /lua/rest/v1/edit/host/pool.lua Source: https://www.ntop.org/guides/ntopng/api/rest/api_v1.html Edit an host pool with members and configuration. ```APIDOC ## GET /lua/rest/v1/edit/host/pool.lua ### Description Edit an host pool with members and configuration. ### Method GET ### Endpoint /lua/rest/v1/edit/host/pool.lua ### Response #### Success Response (200) - **0** - OK - **-3** - NOT_GRANTED - **-5** - INVALID_ARGUMENTS - **-13** - ADD_POOL_FAILED ``` -------------------------------- ### Configure OEM Repository Source: https://www.ntop.org/guides/ntopng/_sources/advanced_features/oem.rst.txt Path for the APT sources file to enable automatic updates in OEM mode. ```bash /etc/apt/sources.list.d/ntop-oem.list ``` -------------------------------- ### GET /lua/rest/v2/get/l7/category/consts.lua Source: https://www.ntop.org/guides/ntopng/_sources/api/rest/examples_v2.rst.txt Retrieves L7 application category constants. ```APIDOC ## GET /lua/rest/v2/get/l7/category/consts.lua ### Description Retrieves a list of L7 application category constants. ### Method GET ### Endpoint /lua/rest/v2/get/l7/category/consts.lua ### Response #### Success Response (200) - **rc_str** (string) - Status message - **rsp** (array) - List of categories with name and cat_id - **rc** (integer) - Return code #### Response Example { "rc_str": "OK", "rsp": [ { "name": "Web", "cat_id": 5 } ], "rc": 0 } ``` -------------------------------- ### Example Natural Language Queries Source: https://www.ntop.org/guides/ntopng/_sources/nanalyst/chat_interface.rst.txt Demonstrates the syntax for plain English queries used to interact with the nAnalyst agent. ```text "Show me DNS query volume for each hour in the last day and the top queried domains" "Which hosts contacted the most external IPs in the last 6 hours?" "Is there any unusual outbound traffic from 192.168.1.50?" "What applications are consuming the most bandwidth on the LAN?" ``` -------------------------------- ### POST /lua/pro/rest/v1/add/infrastructure/instance.lua Source: https://www.ntop.org/guides/ntopng/api/rest/api_v1.html Adds a new infrastructure configuration. ```APIDOC ## POST /lua/pro/rest/v1/add/infrastructure/instance.lua ### Description Add a new infrastructure configuration. ### Method POST ### Endpoint /lua/pro/rest/v1/add/infrastructure/instance.lua ``` -------------------------------- ### GET /lua/rest/v1/get/pcap/live_extraction.lua Source: https://www.ntop.org/guides/ntopng/api/rest/api_v1.html Performs live PCAP traffic extraction. ```APIDOC ## GET /lua/rest/v1/get/pcap/live_extraction.lua ### Description Raw PCAP data is returned. ### Method GET ### Endpoint /lua/rest/v1/get/pcap/live_extraction.lua ### Parameters #### Query Parameters - **ifid** (integer) - Required - Interface identifier - **epoch_begin** (integer) - Required - Start time (epoch) - **epoch_end** (integer) - Required - Start time (epoch) - **bpf_filter** (string) - Required - BPF filter ``` -------------------------------- ### GET /lua/rest/v2/get/l7/application/consts.lua Source: https://www.ntop.org/guides/ntopng/_sources/api/rest/examples_v2.rst.txt Retrieves L7 application protocol constants. ```APIDOC ## GET /lua/rest/v2/get/l7/application/consts.lua ### Description Retrieves a list of L7 application protocol constants. ### Method GET ### Endpoint /lua/rest/v2/get/l7/application/consts.lua ### Response #### Success Response (200) - **rc_str** (string) - Status message - **rsp** (array) - List of protocols with name, cat_id, and appl_id - **rc** (integer) - Return code #### Response Example { "rc_str": "OK", "rsp": [ { "name": "DNS", "cat_id": 14, "appl_id": 5 } ], "rc": 0 } ``` -------------------------------- ### Connect ntopng to local ClickHouse Source: https://www.ntop.org/guides/ntopng/flow_dump/clickhouse/clickhouse.html Example command to connect ntopng to a local ClickHouse instance. ```bash ntopng -F "clickhouse;127.0.0.1;ntopng;default;default" ``` -------------------------------- ### Run Suricata Source: https://www.ntop.org/guides/ntopng/_sources/third_party_integrations/suricata.rst.txt Start the Suricata process using the specified configuration file and network interface. ```bash suricata -c /etc/suricata/suricata.yaml -i eth1 ``` -------------------------------- ### GET /lua/pro/rest/v1/get/db/topk_flows.lua Source: https://www.ntop.org/guides/ntopng/api/rest/api_v1.html Executes a top-k query to the flows database. ```APIDOC ## GET /lua/pro/rest/v1/get/db/topk_flows.lua ### Description Executes a top-k query to the flows database. ### Method GET ### Endpoint /lua/pro/rest/v1/get/db/topk_flows.lua ### Parameters #### Query Parameters - **ifid** (integer) - Required - Interface identifier - **begin_time_clause** (integer) - Required - Start time (epoch) - **end_time_clause** (integer) - Required - Start time (epoch) - **select_keys_clause** (string) - Optional - Select comma-separated keys list - **select_values_clause** (string) - Optional - Select value - **where_clause** (string) - Optional - Where clause - **topk_clause** (string) - Optional - Top-K clause - **approx_search** (string) - Optional - Approximate search - **maxhits_clause** (integer) - Optional - Max hits ``` -------------------------------- ### GET /lua/rest/v2/get/ntopng/interfaces.lua Source: https://www.ntop.org/guides/ntopng/api/rest/examples_v2.html Retrieves a list of all actively monitored interfaces. ```APIDOC ## GET /lua/rest/v2/get/ntopng/interfaces.lua ### Description Retrieves a list of all actively monitored interfaces. ### Method GET ### Endpoint /lua/rest/v2/get/ntopng/interfaces.lua ``` -------------------------------- ### Add Host Pool Source: https://www.ntop.org/guides/ntopng/_sources/api/rest/examples_v2.rst.txt Examples for adding various types of host pools including network, IP, and MAC address configurations. ```bash curl -s -u admin:admin -H "Content-Type: application/json" -d '{"pool_name": "themaina", "pool_members": "192.168.2.0/24@0", "recipients":"0"}' http://localhost:3000/lua/rest/v2/add/host/pool.lua curl -s -u admin:admin -H "Content-Type: application/json" -d '{"pool_name": "themaina", "pool_members": "192.168.2.0/24@0,192.168.3.0/24@0", "recipients":"0"}' http://localhost:3000/lua/rest/v2/add/host/pool.lua curl -s -u admin:admin -H "Content-Type: application/json" -d '{"pool_name": "themainamac", "pool_members": "AA:BB:CC:DD:EE:FF", "recipients":"0"}' http://localhost:3000/lua/rest/v2/add/host/pool.lua curl -s -u admin:admin -H "Content-Type: application/json" -d '{"pool_name": "themainaip", "pool_members": "8.8.8.8/32@2", "recipients":"0"}' http://localhost:3000/lua/rest/v2/add/host/pool.lua curl -s -u admin:admin -H "Content-Type: application/json" -d '{"pool_name": "themainaempty", "pool_members": "", "recipients":"0"}' http://localhost:3000/lua/rest/v2/add/host/pool.lua ``` -------------------------------- ### GET /lua/rest/v2/get/alert/type/consts.lua Source: https://www.ntop.org/guides/ntopng/_sources/api/rest/examples_v2.rst.txt Retrieves a list of alert type constants. ```APIDOC ## GET /lua/rest/v2/get/alert/type/consts.lua ### Description Retrieves the available alert type constants defined in the system. ### Method GET ### Endpoint /lua/rest/v2/get/alert/type/consts.lua ### Response #### Success Response (200) - **rc_str** (string) - Status message - **rc** (integer) - Return code - **rsp** (array) - List of alert types with key and type name #### Response Example { "rc_str": "OK", "rc": 0, "rsp": [ { "key": 9, "type": "alert_flow_blocked" } ] } ```