This chapter is from the book
This chapter is from the book
This chapter is from the book
ntop
One particularly interesting tool for constant network monitoring is the ntop utility. Basically, ntop displays the top network users. Figure 3.5 shows ntop running in an xterminal.
){kind=link}
Figure 3.5 ntop in action.
The ntop utility has a vast array of command-line options and interactive commands. Table 3.12 gives a few examples of the more interesting ones.
Table 3.12 ntop Options
|
-r |
Changes the rate that ntop updates the screen display. This is very helpful for determining time ranges in which a problem may be occurring. |
-p |
Specifies the IP protocol to monitor. Because the default is all, this option can act as a filter. |
-l |
Logs information captured by ntop into ntop.log. An application here is post-analysis of ntop results. |
Interpreting ntop is pretty straightforward. The Host field contains either a hostname (if it can be resolved) or an IP address.
Table 3.13 ntop Output Fields
|
Field |
Description |
|---|---|
|
Host |
Contains either a hostname (if it can be resolved) or an IP address |
|
Act |
Gives more information about the host: B indicates that a host has received and sent data. R indicates that a host has received data. S indicates that a host has sent data. I indicates that a host is idle. |
|
Rcvd |
Shows the amount of traffic that a host received between updates. |
|
Sent |
Shows the amount of traffic that a host sent between updates. |
|
<protocol> |
Gives three columns (TCP, UDP, and ICMP) that show the changes of the protocol type. |
To make a little more sense of this, consider the following line as an example:
cingwise.ipsosasi.net S 2.2 Kb 4.8 MB 1.8 Kb 420 0 0
The hostname is cingwise.ipsosasi.net, and the last thing the host did was send traffic. During the last update, it received 2.2Kb and sent 4.8MB; there was a difference of 420 bytes between updates in traffic with the TCP protocol.
The ntop utility is very useful for watching network activity in general.