Step-by-Step Installation of ntopng on Rocky Linux 8

NtopNG is a helpful tool that is crucial for monitoring network usage. This app is available for Linux users, so here we will share a step-by-step installation process on the Linux operating system. Depending on where you are using OracleLinux 8, Rocky Linux 8, or any other OSs, the process might slightly differ for each case.  

Requirements

Hardware Specifications

This hardware requirement is for those who need to capture traffic from 100 Mbps to 1 Gbps:

-        Disk: 100 Go

-        Memory: 4 Go

-        CPU: 4 cores

-        2 network interfaces on the server (1st for network capture, and 2nd for the management)

System Requirements

-        NTP server with “precise” monitoring

-        DNS server to resolve captured IPs and for Internet access (in case there is no proxy)

-        Internet Access

Installation Steps

Prior to the actual installation processes, it is important to check where the system is updated. For this purpose, use the following command:

yum update -y
yum upgrade -y

Enabling Powertools and REMI Repositories

To have a proper installation process 2 important repositories also need to be installed, specifically REMI and Epel.

For the enabling of Epel, use the following line:

dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm

The next step will be REMI installation:

rpm -ivh http://rpms.remirepo.net/enterprise/remi-release-8.rpm

yum install dnf-plugins-core

dnf config-manager --set-enabled ol8_codeready_builder

dnf config-manager --set-enabled remi

Disabling SELinux and Firewalld

The next step is disabling of Firewalld and SELinux. First, open SELinux config:

vi /etc/selinux/config

Then find enforcing and change it to disabled. After that is successfully completed, you will need to reboot the system with:

Reboot

For the firewall, the process looks the following:

systemctl disable firewalld

systemctl stop firewalld

Setting Up the Monitoring Interface

The server includes a couple of various interfaces and you should select one that will be used as a monitoring interface. Here is an example of one possible interface:

lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000

     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00

     inet 127.0.0.1/8 scope host lo

         valid_lft forever preferred_lft forever

     inet6 ::1/128 scope host

         valid_lft forever preferred_lft forever

There might be 4 interfaces:

-        lo: Loopback (as in the example)

-        Wifi

-        Physical interface

-        USB interface  

Once you have selected the capture interface, you should do the following:

ip link set ${SPECIFY_INTERFACE} promisc on

For the physical interface that is called eno1, the process is the following:

ip link set eno1 promisc on

For the boot activation, this line should be added to the /etc/rc.d/rc.local file:

ip link set eno1 promisc on

For file loading activate rc-local:

vi /etc/systemd/system/rc-local.service

The following should be added:

[Unit]

Description=/etc/rc.local Compatibility

ConditionPathExists=/etc/rc.local

[Service]

Type=forking

ExecStart=/etc/rc.local start

TimeoutSec=0

StandardOutput=tty

RemainAfterExit=yes

SysVStartPriority=99

[Install]

WantedBy=multi-user.target

Then change the rights for the execution:

chmod +x /etc/rc.local

The next step is activation:

systemctl enable rc-local

To complete the process, it is crucial to restart the server:

eno1: <BROADCAST,MULTICAST,**PROMISC**,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000

link/ether f4:4d:30:6f:f7:e8 brd ff:ff:ff:ff:ff:ff

Installing NtopNG

For installation purposes, we will use the official repo:

cd /etc/yum.repos.d/

wget https://packages.ntop.org/centos-stable/ntop.repo -O ntop.repo

The next step is:

yum erase zeromq3

yum erase httpd

yum clean all

The final step is the actual installation:

yum install pfring-dkms n2disk nprobe ntopng cento

Configuring NtopNG

Setting the Monitoring Interface

Enter the file /etc/ntopng/ntopng.conf to add a specific name to the monitoring interface:

vi /etc/ntopng/ntopng.conf

Uncomment the following line and change it to the required name:

-i=eno1

Add the local network in the config file:

-m="192.178.1.0/23,162.188.2.0/24"

The final step will be activation:

systemctl start ntopng

systemctl enable ntopng

Optional: Changing the Port for the Web Interface

According to the default settings web interface is connected via TCP/3000. This can be modified in the following way:
vi /etc/ntopng/ntopng.conf

Uncomment the next line and use the port that is needed, for an example we mentioned 67:

#-w=3000

-w=67

After that, you will need to restart:

systemctl restart ntopng

Then you can check whether the chosen port is used by the process.

Accessing the Web Interface

In case you decide to use the default port, then you should better connect to the management IP. For example, in case your IP is 234.323.1.33, then the accessing will be the following:
http:// 234.323.1.33:3000/

Once you are redirected, then you need to specify the password and username details. During initial login, you will be asked to change the default password.

Additional Setup for the Monitoring Interface

One more additional set specifies that the monitoring interface gets traffic from the mirrored port. This can be easily done by entering the interface tab, there you will find settings and in the mirrored traffic you will need to put the tick.

Creating an API User Account

To receive NtopNG metrics, the API user account is required for Centreon. According to the default settings, the admin account is used so you need to change this.

Go to settings, select the users' tab, and select +. Plus is above the list of the web users and you will see an admin user there as well.

Don’t forget to choose a non privileged user and add other standard information as in the registration such as username, full name, PW, allowed networks, and allowed interface.