Ntop is a very useful tool for reviewing traffic on your network. Remembering what was surfed the night before, or guessing what somebody else did is not a sure fire way to get answers. Ntop provides that insight with certainty using graphs and tables. It also generates alerts when it discovers aberrant behavior. That sounds great, but how is it setup?
The first choice should be to run ntop on Linux. ntop is very well supported on most if not all of the Linux platforms. However, not everyone likes to run Linux. OpenBSD is great, but only ntop version 1.1 is supported. The latest version of 3.310 is available on Free BSD 8.0. It is not perfect, but usable.
Details appear later in this article. Follow these steps to get quickly started:
adduser ntop
chown -R ntop /var/db/ntop
echo ntop_enable=”YES” >> /etc/rc.conf
echo ntop_flags=””-d –use-syslog=daemon –u ntop”” >> /etc/rc.conf
cd /usr/local/share/GeoIP
wget http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz
wget http://geolite.maxmind.com/download/geoip/database/asnum/GeoIPASNum.dat.gz
gzip –d *.gz
ln –s /usr/local/share/GeoIP/GeoIPASNum.dat /usr/local/etc/ntop/
ln –s /usr/local/share/GeoIP/GeoLiteCity.dat /usr/local/etc/ntop/
cd /tmp
wget http://prdownloads.sourceforge.net/ettercap/ettercap-0.6.b.tar.gz?download
tar xzvf ./ettercap-0.6.b.tar.gz ./ettercap-0.6.b/etter.passive.os.fp
mv ettercap-0.6.b/etter.passive.os.fp /usr/local/etc/ntop/etter.finger.os
wget -r -l2 -Nc -A.pat http://l7-filter.sourceforge.net/layer7-protocols/
mv l7-filter.sourceforge.net/layer7-protocols /usr/local/etc/ntop/l7-patterns
![[padlock button]](http://images.lomin.com/letter_button.png)
