Sunday, January 4, 2015

Install NTOP on Debian and Configure to Use NetFlow on Mikrotik RouterOS

Ntop is a network monitoring tool similar to Unix top, which shows network traffic usage. It can act as a NetFlow collector for flows generated by routers such as Cisco or Mikrotik. NetFlow is an industry standard for flow-based traffic monitoring.

We will install and configure Ntop to collect flows generated by Mikrotik router. Note: “Ntop” != “NtopNG”.

Install Pre-required Software

We’re using Debian Wheezy:
$ uname -rv
3.2.0-4-686-pae #1 SMP Debian 3.2.51-1
Update the system first:
# apt-get update && apt-get upgrade -uV
Install required software:
# apt-get install libtool automake autoconf make build-essential python-dev subversion
Install external tools and libraries required by ntop:
# apt-get install libpcap-dev libgdbm-dev zlib1g-dev libgeoip-dev libgraphviz-dev \
graphviz rrdtool librrd-dev

Ntop Installation via Source Code

Download the source package:
# cd ~ ; wget
Extract the archive:
# tar xvfz ntop-5.0.1.tar.gz && cd ntop-5.0.1
Configure, compile and install ntop:
# ./
# make
# make install
Create a new system account for ntop:
# useradd -r -s /bin/false ntop
Change ownership appropriately:
# chown -R ntop:ntop /usr/local/share/ntop /usr/local/lib/ntop /usr/local/var/ntop
Update links and cache to the shared libraries:
# /sbin/ldconfig

Start Ntop as a Daemon

# ntop -cd -i eth0 -u ntop -W -m
-c : prevent idle hosts from being purged from memory
-d : causes ntop to become a daemon
-i : specifies the network interface to use
-u : the user ntop should run as after it initialises (but must be started as root)
-W : starts an embedded ntop web server for HTTPS
-m : specifies local subnets
Use man ntop for more command line options if needed. Also note that port 3001 needs to opened on a firewall if public access is needed.

Troubleshooting Ntop

If you get the error message below when launching ntop:
error while loading shared libraries: cannot open shared object file: No such file or directory
Update links and cache to the shared libraries:
# /sbin/ldconfig

Enable and Configure NetFlow Plugin on Ntop

Connect to ntop web interface here:
Active NetFlow plugin: “Plugins” -> “NetFlow” -> “Activate”.
Open NetFlow configuration panel: “Plugins” -> “NetFlow” -> “Configure”.
Click Add NetFlow Device and fill in the following:
  1. NetFlow Device: “Mikrotik”
  2. Local Collector UDP Port: 2055
  3. Virtual NetFlow Interface Network Address: (change appropriately!)

Enable and Configure NetFlow on Mikrotik RouterOS

Enabling traffic flow on the Mikrotik can be done via SSH:
[admin@mikrotik] > /ip traffic-flow 
[admin@mikrotik] /ip traffic-flow> set enabled=yes interfaces=all
Print current configuration:
[admin@mikrotik] /ip traffic-flow> print
 enabled: yes
 interfaces: all
 cache-entries: 4k
 active-flow-timeout: 30m
 inactive-flow-timeout: 15s
Add NetFlow target (our Debian machine):
[admin@mikrotik] /ip traffic-flow> /ip traffic-flow target
[admin@mikrotik] /ip traffic-flow target> add address= disabled=no version=5
Print target configuration:
[admin@mikrotik] /ip traffic-flow target> print 
Flags: X - disabled 
 0 5
That’s it, now we have to wait a couple of minutes and review data in the ntop web interface.

Configure Iptables on Debian

# iptables -A INPUT -s -p udp --dport 2055 -j ACCEPT
# iptables -A INPUT -s -p tcp -m multiport --dport 3000,3001 -j ACCEPT

Ntop WebUI Report

Troubleshooting Usage

**WARNING** INIT: Unable to create pid file (/usr/local/var/ntop/

Make sure ntop user is the owner of the directory (so can write to it):
# chown ntop /usr/local/var/ntop

**ERROR** RRD: Disabled – unable to create base directory (err 13, /usr/local/var/ntop/rrd)

The directory may not exist, so create it and change ownership to ntop user:
# mkdir /usr/local/var/ntop/rrd
# chown -R ntop /usr/local/var/ntop/rrd/

ERROR: Missing dot tool (expected /usr/local/bin/dot). Please set its path (key dot.path) here.

This may occur trying to use a “Local Network Traffic Map” when dot is not found. Find out where dot is:
# which dot
And create a symlink (or alternatively edit preferences under https://localhost:3001/editPrefs.html):
# ln -s /usr/bin/dot /usr/local/bin/dot

No comments:

Post a Comment