Network traffic analysis with netflow and ntop - Revision history http://wiki.dd-wrt.com/wiki/index.php?title=Network_traffic_analysis_with_netflow_and_ntop&action=history Revision history for this page on the wiki en MediaWiki 1.10.1 Fri, 29 Mar 2024 15:03:12 GMT Jsface: no workaround needed for rrdpath http://wiki.dd-wrt.com/wiki/index.php?title=Network_traffic_analysis_with_netflow_and_ntop&diff=44158&oldid=prev <p>no workaround needed for rrdpath</p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 16:40, 27 December 2012</td> </tr> <tr><td colspan="2" align="left"><strong>Line 84:</strong></td> <td colspan="2" align="left"><strong>Line 84:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">''RRD detail:'' I choose medium&lt;br&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">''RRD detail:'' I choose medium&lt;br&gt;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">''RRD Files Path:'' This is the location where rrd stores his data: \NTopWin32\rrd.&lt;br&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">''RRD Files Path:'' This is the location where rrd stores his data: \NTopWin32\rrd.&lt;br&gt;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">See at the workaround at the end of the article about the RRD Files path, the workaround must be done first if you need to store data on a separate disk!</td><td colspan="2">&nbsp;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td colspan="2" align="left"><strong>Line 255:</strong></td> <td colspan="2" align="left"><strong>Line 254:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">FAQ, in the menu ''About'' there is a link to FAQ but the faq.html file is not local available. You can copy the file from &lt;code&gt;&lt;nowiki&gt;www.ntopsupport.com/faq.html&lt;/nowiki&gt;&lt;/code&gt; to C:\OPENXTRA\NTopWin32\html\faq.html.&lt;br&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">FAQ, in the menu ''About'' there is a link to FAQ but the faq.html file is not local available. You can copy the file from &lt;code&gt;&lt;nowiki&gt;www.ntopsupport.com/faq.html&lt;/nowiki&gt;&lt;/code&gt; to C:\OPENXTRA\NTopWin32\html\faq.html.&lt;br&gt;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">There is a lot of important information available here.</td><td> </td><td style="background: #eee; font-size: smaller;">There is a lot of important information available here.</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"></td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"></td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">''RRD file path''&lt;br&gt;</td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">You cannot use &quot;:&quot; in the path, this is not allowed by rrd. This means that the data must be stored at the same disk as where ntop is installed. In my case I store application and data on a separate disk, for me this was important because rrd uses much space, depending of the setting.</td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">This can be solved by using a directory symbolic link. I used the function Junction from Sysinternals to do that. After installing Junction in the Windows directory the link is definied in the command interface with</td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"></td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">junction c:\NTopWin32 d:\NTopWin32</td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"></td><td colspan="2">&nbsp;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">where d:\NTopWin32 is the target directory, before you use the function the directory c:\NTopWin32 must not yet exist.</td><td colspan="2">&nbsp;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> </table> Thu, 27 Dec 2012 16:40:42 GMT Jsface http://wiki.dd-wrt.com/wiki/index.php/Talk:Network_traffic_analysis_with_netflow_and_ntop Jsface at 17:54, 24 December 2012 http://wiki.dd-wrt.com/wiki/index.php?title=Network_traffic_analysis_with_netflow_and_ntop&diff=44133&oldid=prev <p></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 17:54, 24 December 2012</td> </tr> <tr><td colspan="2" align="left"><strong>Line 278:</strong></td> <td colspan="2" align="left"><strong>Line 278:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* [http://www.dd-wrt.com/wiki/index.php/Using_RFlow_Collector_and_MySQL_To_Gather_Traffic_Information RFlow Collector and MySQL]</td><td> </td><td style="background: #eee; font-size: smaller;">* [http://www.dd-wrt.com/wiki/index.php/Using_RFlow_Collector_and_MySQL_To_Gather_Traffic_Information RFlow Collector and MySQL]</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* [http://heanet.dl.sourceforge.net/project/ntop/ntop/Documentation/rrdandntop.pdf Ntop, persistent data and rrd]</td><td> </td><td style="background: #eee; font-size: smaller;">* [http://heanet.dl.sourceforge.net/project/ntop/ntop/Documentation/rrdandntop.pdf Ntop, persistent data and rrd]</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">* [<del style="color: red; font-weight: bold; text-decoration: none;">http://</del>http://techowto.files.wordpress.com/2008/09/ntop-guide.pdf Ntop Bandwidth Monitoring Guide]</td><td>+</td><td style="background: #cfc; font-size: smaller;">* [http://techowto.files.wordpress.com/2008/09/ntop-guide.pdf Ntop Bandwidth Monitoring Guide]</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* [http://luca.ntop.org/download/ntop-users-guide/ntop_Users_Guide_2.3.pdf Ntop Users Guide]</td><td> </td><td style="background: #eee; font-size: smaller;">* [http://luca.ntop.org/download/ntop-users-guide/ntop_Users_Guide_2.3.pdf Ntop Users Guide]</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* [http://www.simpleweb.org/w/images/e/e4/Tutorial_Slides_Ntop.pdf Ntop Tutorial Slides]</td><td> </td><td style="background: #eee; font-size: smaller;">* [http://www.simpleweb.org/w/images/e/e4/Tutorial_Slides_Ntop.pdf Ntop Tutorial Slides]</td></tr> </table> Mon, 24 Dec 2012 17:54:51 GMT Jsface http://wiki.dd-wrt.com/wiki/index.php/Talk:Network_traffic_analysis_with_netflow_and_ntop Jsface at 15:02, 24 December 2012 http://wiki.dd-wrt.com/wiki/index.php?title=Network_traffic_analysis_with_netflow_and_ntop&diff=44129&oldid=prev <p></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 15:02, 24 December 2012</td> </tr> <tr><td colspan="2" align="left"><strong>Line 267:</strong></td> <td colspan="2" align="left"><strong>Line 267:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==Finally==</td><td> </td><td style="background: #eee; font-size: smaller;">==Finally==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">The combination of a DD-WRT router running rflow and a PC running ntop provides a low cost solution for remote network traffic usage and activity (NetFlow monitoring). Rflow provides fast packet capture <del style="color: red; font-weight: bold; text-decoration: none;">(i.e. minimize packet capture loss) </del>and also captures packets efficiently thus preserving CPU cycles. With ntop Luca Deri has created a brilliant tool for seeing what is happening on your network in realtime. </td><td>+</td><td style="background: #cfc; font-size: smaller;">The combination of a DD-WRT router running rflow and a PC running ntop provides a low cost solution for remote network traffic usage and activity (NetFlow monitoring). Rflow provides fast packet capture and also captures packets efficiently thus preserving CPU cycles. With ntop Luca Deri has created a brilliant tool for seeing what is happening on your network in realtime. </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">This is only a basic tutorial to show what you can do with DD-WRT and rflow. ntop has many more possibilities, out of the box via configuration and via extra scripts which are available in the directory C:\OPENXTRA\NTopWin32\www and on the Internet.&lt;br&gt; </td><td> </td><td style="background: #eee; font-size: smaller;">This is only a basic tutorial to show what you can do with DD-WRT and rflow. ntop has many more possibilities, out of the box via configuration and via extra scripts which are available in the directory C:\OPENXTRA\NTopWin32\www and on the Internet.&lt;br&gt; </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">There is a new version 5 available for Windows with many more possibilities, it's worth looking at it.</td><td> </td><td style="background: #eee; font-size: smaller;">There is a new version 5 available for Windows with many more possibilities, it's worth looking at it.</td></tr> </table> Mon, 24 Dec 2012 15:02:30 GMT Jsface http://wiki.dd-wrt.com/wiki/index.php/Talk:Network_traffic_analysis_with_netflow_and_ntop Jsface at 14:37, 24 December 2012 http://wiki.dd-wrt.com/wiki/index.php?title=Network_traffic_analysis_with_netflow_and_ntop&diff=44128&oldid=prev <p></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 14:37, 24 December 2012</td> </tr> <tr><td colspan="2" align="left"><strong>Line 196:</strong></td> <td colspan="2" align="left"><strong>Line 196:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* What websites do the top bandwidth users visit?</td><td> </td><td style="background: #eee; font-size: smaller;">* What websites do the top bandwidth users visit?</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* What websites get the most traffic from within my organization?</td><td> </td><td style="background: #eee; font-size: smaller;">* What websites get the most traffic from within my organization?</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">* What websites'traffic consumes most of my bandwidth?</td><td>+</td><td style="background: #cfc; font-size: smaller;">* What websites' traffic consumes most of my bandwidth?</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* What applications are being used?</td><td> </td><td style="background: #eee; font-size: smaller;">* What applications are being used?</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">* Which local hosts <del style="color: red; font-weight: bold; text-decoration: none;">shrae </del>the most data?</td><td>+</td><td style="background: #cfc; font-size: smaller;">* Which local hosts <ins style="color: red; font-weight: bold; text-decoration: none;">share </ins>the most data?</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* At what time of the day is the network most Utilized?</td><td> </td><td style="background: #eee; font-size: smaller;">* At what time of the day is the network most Utilized?</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* Performing a network inventory</td><td> </td><td style="background: #eee; font-size: smaller;">* Performing a network inventory</td></tr> <tr><td colspan="2" align="left"><strong>Line 204:</strong></td> <td colspan="2" align="left"><strong>Line 204:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">* Detecting network security violations?</td><td> </td><td style="background: #eee; font-size: smaller;">* Detecting network security violations?</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">Displaying a Host's Active TCP/UDP Sessions&lt;br&gt;</del></td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Suppose you identify a particular host as the major consumer of bandwidth, what if you want to find out just what exactly he is doing online that is consuming so much bandwidth? Here is how ntop can help:</td><td> </td><td style="background: #eee; font-size: smaller;">Suppose you identify a particular host as the major consumer of bandwidth, what if you want to find out just what exactly he is doing online that is consuming so much bandwidth? Here is how ntop can help:</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> </table> Mon, 24 Dec 2012 14:37:02 GMT Jsface http://wiki.dd-wrt.com/wiki/index.php/Talk:Network_traffic_analysis_with_netflow_and_ntop Jsface at 14:34, 24 December 2012 http://wiki.dd-wrt.com/wiki/index.php?title=Network_traffic_analysis_with_netflow_and_ntop&diff=44126&oldid=prev <p></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 14:34, 24 December 2012</td> </tr> <tr><td colspan="2" align="left"><strong>Line 192:</strong></td> <td colspan="2" align="left"><strong>Line 192:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==Usage==</td><td> </td><td style="background: #eee; font-size: smaller;">==Usage==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">For some interesting usage scenario's see </del>[http://techowto.files.wordpress.com/2008/09/ntop-guide.pdf Ntop Bandwidth Monitoring Guide]</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">In the </ins>[http://techowto.files.wordpress.com/2008/09/ntop-guide.pdf Ntop Bandwidth Monitoring Guide] <ins style="color: red; font-weight: bold; text-decoration: none;">you can find some interesting usage scenario's, like:</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">* Who are the top internet bandwidth users on my network?</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">* What websites do the top bandwidth users visit?</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">* What websites get the most traffic from within my organization?</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">* What websites'traffic consumes most of my bandwidth?</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">* What applications are being used?</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">* Which local hosts shrae the most data?</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">* At what time of the day is the network most Utilized?</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">* Performing a network inventory</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">* Exporting traffic data</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">* Detecting network security violations?</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Displaying a Host's Active TCP/UDP Sessions&lt;br&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">Displaying a Host's Active TCP/UDP Sessions&lt;br&gt;</td></tr> </table> Mon, 24 Dec 2012 14:34:47 GMT Jsface http://wiki.dd-wrt.com/wiki/index.php/Talk:Network_traffic_analysis_with_netflow_and_ntop Jsface at 13:19, 24 December 2012 http://wiki.dd-wrt.com/wiki/index.php?title=Network_traffic_analysis_with_netflow_and_ntop&diff=44123&oldid=prev <p></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 13:19, 24 December 2012</td> </tr> <tr><td colspan="2" align="left"><strong>Line 108:</strong></td> <td colspan="2" align="left"><strong>Line 108:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"># Extra services</td><td> </td><td style="background: #eee; font-size: smaller;"># Extra services</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">#</td><td> </td><td style="background: #eee; font-size: smaller;">#</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">ssh <del style="color: red; font-weight: bold; text-decoration: none;"> </del>22/tcp</td><td>+</td><td style="background: #cfc; font-size: smaller;">ssh <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>22/tcp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">ms-sql-s <del style="color: red; font-weight: bold; text-decoration: none;"> </del>1433/tcp</td><td>+</td><td style="background: #cfc; font-size: smaller;">ms-sql-s <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>1433/tcp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">ms-sql-s <del style="color: red; font-weight: bold; text-decoration: none;"> </del>1433/udp</td><td>+</td><td style="background: #cfc; font-size: smaller;">ms-sql-s <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>1433/udp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">ms-sql-m <del style="color: red; font-weight: bold; text-decoration: none;"> </del>1434/tcp</td><td>+</td><td style="background: #cfc; font-size: smaller;">ms-sql-m <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>1434/tcp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">ms-sql-m <del style="color: red; font-weight: bold; text-decoration: none;"> </del>1434/udp</td><td>+</td><td style="background: #cfc; font-size: smaller;">ms-sql-m <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>1434/udp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">upnp <del style="color: red; font-weight: bold; text-decoration: none;"> </del>1780/tcp</td><td>+</td><td style="background: #cfc; font-size: smaller;">upnp <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>1780/tcp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">upnp <del style="color: red; font-weight: bold; text-decoration: none;"> </del>1780/udp</td><td>+</td><td style="background: #cfc; font-size: smaller;">upnp <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>1780/udp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">ssdp <del style="color: red; font-weight: bold; text-decoration: none;"> </del>1900/udp</td><td>+</td><td style="background: #cfc; font-size: smaller;">ssdp <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>1900/udp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">ntop <del style="color: red; font-weight: bold; text-decoration: none;"> </del>3000/tcp</td><td>+</td><td style="background: #cfc; font-size: smaller;">ntop <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>3000/tcp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">rdp <del style="color: red; font-weight: bold; text-decoration: none;"> </del>3389/tcp</td><td>+</td><td style="background: #cfc; font-size: smaller;">rdp <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>3389/tcp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">rdp <del style="color: red; font-weight: bold; text-decoration: none;"> </del>3389/udp</td><td>+</td><td style="background: #cfc; font-size: smaller;">rdp <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>3389/udp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">atq <del style="color: red; font-weight: bold; text-decoration: none;"> </del>3456/udp</td><td>+</td><td style="background: #cfc; font-size: smaller;">atq <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>3456/udp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">nat-t <del style="color: red; font-weight: bold; text-decoration: none;"> </del>4500/udp</td><td>+</td><td style="background: #cfc; font-size: smaller;">nat-t <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>4500/udp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">remotescan <del style="color: red; font-weight: bold; text-decoration: none;"> </del>6077/tcp</td><td>+</td><td style="background: #cfc; font-size: smaller;">remotescan <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>6077/tcp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">remotescan <del style="color: red; font-weight: bold; text-decoration: none;"> </del>6078/udp</td><td>+</td><td style="background: #cfc; font-size: smaller;">remotescan <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>6078/udp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">netflow <del style="color: red; font-weight: bold; text-decoration: none;"> </del>9996/udp</td><td>+</td><td style="background: #cfc; font-size: smaller;">netflow <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>9996/udp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">dropbox <del style="color: red; font-weight: bold; text-decoration: none;"> </del>17500/tcp</td><td>+</td><td style="background: #cfc; font-size: smaller;">dropbox <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>17500/tcp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">dropbox <del style="color: red; font-weight: bold; text-decoration: none;"> </del>17500/udp</td><td>+</td><td style="background: #cfc; font-size: smaller;">dropbox <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>17500/udp</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">&lt;/pre&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">&lt;/pre&gt;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td colspan="2" align="left"><strong>Line 139:</strong></td> <td colspan="2" align="left"><strong>Line 139:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">In the following file I have first defined the default values and added some extra protocols.</td><td> </td><td style="background: #eee; font-size: smaller;">In the following file I have first defined the default values and added some extra protocols.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">[[Image:protocol_list.jpg]]</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">&lt;pre&gt;</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">## Default ntop protocollist ##</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">FTP=ftp|ftp-data|69</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">HTTP=http|www|https|3128</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">DNS=name|domain</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Telnet=telnet|login</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">NBios-IP=netbios-ns|netbios-dgm|netbios-ssn</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Mail=pop-2|pop-3|pop3|kpop|smtp|imap|imap2</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">DHCP-BOOTP=67-68</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">SNMP=snmp|snmp-trap</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">NNTP=nntp</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">NFS/AFS=mount|pcnfs|bwnfs|nfsd|nfs|nfsd-status|7000-7009</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">VoIP=5060|2000|54045</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">X11=6000-6010</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">SSH=22</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">## Default ntop Peer-to-Peer protocols ##</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Gnutella=6346|6347|6348</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Kazaa=1214</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">WinMX=6699|7730</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">DC++=-1</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">eDonkey=4661-4665</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">BitTorrent=6881-6999|6969</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">## Default ntop Messenger protocols ##</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Messenger=1503|1863|5000|5001|5190-5193</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">## Extra ntop protocols ##</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Comodo=1037-1045|1280|4447-4448</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Avast=1281-1282</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">NetFlow=9996</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">UPnP=1780|1900</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Dropbox=17500</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Ntop=3000</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Remotescan=6077|6078</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">RDP=3389</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Streaming=554|1755|1935|3689|4070|5222|7070</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">Nat-t=4500</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">IIS=1025|3456</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">SQL=1433</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">LDAP=ldap|ldaps</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">RPC=111</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">SLP=427</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">LPR=515|631</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">&lt;/pre&gt;</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">After you have created the file you have to configure ntop to use this file. </td><td> </td><td style="background: #eee; font-size: smaller;">After you have created the file you have to configure ntop to use this file. </td></tr> <tr><td colspan="2" align="left"><strong>Line 175:</strong></td> <td colspan="2" align="left"><strong>Line 219:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">''Hostname resolving''&lt;br&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">''Hostname resolving''&lt;br&gt;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">PC's in my network are not always on, I found when ntop starts he resolves the hostnames of al host in the network, but after some time when these PC's switch off and on ntop forget the hostname. For me it was no problem to restart the ntop service with a bat file every night with a scheduled task of Windows. The bat file look like this</td><td> </td><td style="background: #eee; font-size: smaller;">PC's in my network are not always on, I found when ntop starts he resolves the hostnames of al host in the network, but after some time when these PC's switch off and on ntop forget the hostname. For me it was no problem to restart the ntop service with a bat file every night with a scheduled task of Windows. The bat file look like this</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;"> </del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">&lt;pre&gt;</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">[[Image</del>:<del style="color: red; font-weight: bold; text-decoration: none;">Restart_ntop</del>.<del style="color: red; font-weight: bold; text-decoration: none;">jpg]]</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">@echo off</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">REM - File</ins>: <ins style="color: red; font-weight: bold; text-decoration: none;">Daily Restart ntop for win32</ins>.<ins style="color: red; font-weight: bold; text-decoration: none;">bat</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">REM - Description: Restart ntop for Win32 Service tbv name resolving</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">REM - Author: Jan S</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">echo Restarting ntop for Win32...</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">echo ======================================================</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">net stop &quot;ntop for Win32&quot;</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">net start &quot;ntop for Win32&quot;</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">echo ======================================================</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">echo ntop for Win32 Restarted</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">&lt;/pre&gt;</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">''Broken links''&lt;br&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">''Broken links''&lt;br&gt;</td></tr> </table> Mon, 24 Dec 2012 13:19:09 GMT Jsface http://wiki.dd-wrt.com/wiki/index.php/Talk:Network_traffic_analysis_with_netflow_and_ntop Jsface at 13:12, 24 December 2012 http://wiki.dd-wrt.com/wiki/index.php?title=Network_traffic_analysis_with_netflow_and_ntop&diff=44121&oldid=prev <p></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 13:12, 24 December 2012</td> </tr> <tr><td colspan="2" align="left"><strong>Line 92:</strong></td> <td colspan="2" align="left"><strong>Line 92:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">The structure of the file is </td><td> </td><td style="background: #eee; font-size: smaller;">The structure of the file is </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">&lt;pre&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">&lt;pre&gt;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">port <del style="color: red; font-weight: bold; text-decoration: none;"> </del>port alias <del style="color: red; font-weight: bold; text-decoration: none;"> </del># description</td><td>+</td><td style="background: #cfc; font-size: smaller;">port <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>port alias <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins># description</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">name <del style="color: red; font-weight: bold; text-decoration: none;"> </del>number/tcp </td><td>+</td><td style="background: #cfc; font-size: smaller;">name <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>number/tcp </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">like this:</td><td> </td><td style="background: #eee; font-size: smaller;">like this:</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">pop2 109/tcp <del style="color: red; font-weight: bold; text-decoration: none;"> </del>pop-2 # Post Office Protocol - V2</td><td>+</td><td style="background: #cfc; font-size: smaller;">pop2 109/tcp <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>pop-2 # Post Office Protocol - V2</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">pop3 110/tcp <del style="color: red; font-weight: bold; text-decoration: none;"> </del>pop-3 # Post Office Protocol - Version 3</td><td>+</td><td style="background: #cfc; font-size: smaller;">pop3 110/tcp <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>pop-3 # Post Office Protocol - Version 3</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">sunrpc 111/udp <del style="color: red; font-weight: bold; text-decoration: none;"> </del>rpcbind</td><td>+</td><td style="background: #cfc; font-size: smaller;">sunrpc 111/udp <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>rpcbind</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> </table> Mon, 24 Dec 2012 13:12:40 GMT Jsface http://wiki.dd-wrt.com/wiki/index.php/Talk:Network_traffic_analysis_with_netflow_and_ntop Jsface at 13:11, 24 December 2012 http://wiki.dd-wrt.com/wiki/index.php?title=Network_traffic_analysis_with_netflow_and_ntop&diff=44120&oldid=prev <p></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 13:11, 24 December 2012</td> </tr> <tr><td colspan="2" align="left"><strong>Line 92:</strong></td> <td colspan="2" align="left"><strong>Line 92:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">The structure of the file is </td><td> </td><td style="background: #eee; font-size: smaller;">The structure of the file is </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">&lt;pre&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">&lt;pre&gt;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">port <del style="color: red; font-weight: bold; text-decoration: none;"> </del>port alias <del style="color: red; font-weight: bold; text-decoration: none;"> </del># description</td><td>+</td><td style="background: #cfc; font-size: smaller;">port <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>port alias <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins># description</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">name <del style="color: red; font-weight: bold; text-decoration: none;"> </del>number/tcp </td><td>+</td><td style="background: #cfc; font-size: smaller;">name <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>number/tcp </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">like this:</td><td> </td><td style="background: #eee; font-size: smaller;">like this:</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">pop2 <del style="color: red; font-weight: bold; text-decoration: none;"> </del>109/tcp <del style="color: red; font-weight: bold; text-decoration: none;"> </del>pop-2 # Post Office Protocol - V2</td><td>+</td><td style="background: #cfc; font-size: smaller;">pop2 <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>109/tcp <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>pop-2 # Post Office Protocol - V2</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">pop3 <del style="color: red; font-weight: bold; text-decoration: none;"> </del>110/tcp <del style="color: red; font-weight: bold; text-decoration: none;"> </del>pop-3 # Post Office Protocol - Version 3</td><td>+</td><td style="background: #cfc; font-size: smaller;">pop3 <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>110/tcp <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>pop-3 # Post Office Protocol - Version 3</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">sunrpc <del style="color: red; font-weight: bold; text-decoration: none;"> </del>111/udp <del style="color: red; font-weight: bold; text-decoration: none;"> </del>rpcbind</td><td>+</td><td style="background: #cfc; font-size: smaller;">sunrpc <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>111/udp <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>rpcbind</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td colspan="2" align="left"><strong>Line 108:</strong></td> <td colspan="2" align="left"><strong>Line 108:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"># Extra services</td><td> </td><td style="background: #eee; font-size: smaller;"># Extra services</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">#</td><td> </td><td style="background: #eee; font-size: smaller;">#</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">ssh <del style="color: red; font-weight: bold; text-decoration: none;"> </del>22/tcp</td><td>+</td><td style="background: #cfc; font-size: smaller;">ssh <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>22/tcp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">ms-sql-s 1433/tcp</td><td>+</td><td style="background: #cfc; font-size: smaller;">ms-sql-s <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>1433/tcp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">ms-sql-s 1433/udp</td><td>+</td><td style="background: #cfc; font-size: smaller;">ms-sql-s <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>1433/udp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">ms-sql-m 1434/tcp</td><td>+</td><td style="background: #cfc; font-size: smaller;">ms-sql-m <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>1434/tcp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">ms-sql-m 1434/udp</td><td>+</td><td style="background: #cfc; font-size: smaller;">ms-sql-m <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>1434/udp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">upnp <del style="color: red; font-weight: bold; text-decoration: none;"> </del>1780/tcp</td><td>+</td><td style="background: #cfc; font-size: smaller;">upnp <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>1780/tcp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">upnp <del style="color: red; font-weight: bold; text-decoration: none;"> </del>1780/udp</td><td>+</td><td style="background: #cfc; font-size: smaller;">upnp <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>1780/udp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">ssdp <del style="color: red; font-weight: bold; text-decoration: none;"> </del>1900/udp</td><td>+</td><td style="background: #cfc; font-size: smaller;">ssdp <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>1900/udp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">ntop <del style="color: red; font-weight: bold; text-decoration: none;"> </del>3000/tcp</td><td>+</td><td style="background: #cfc; font-size: smaller;">ntop <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>3000/tcp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">rdp <del style="color: red; font-weight: bold; text-decoration: none;"> </del>3389/tcp</td><td>+</td><td style="background: #cfc; font-size: smaller;">rdp <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>3389/tcp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">rdp <del style="color: red; font-weight: bold; text-decoration: none;"> </del>3389/udp</td><td>+</td><td style="background: #cfc; font-size: smaller;">rdp <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>3389/udp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">atq <del style="color: red; font-weight: bold; text-decoration: none;"> </del>3456/udp</td><td>+</td><td style="background: #cfc; font-size: smaller;">atq <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>3456/udp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">nat-t <del style="color: red; font-weight: bold; text-decoration: none;"> </del>4500/udp</td><td>+</td><td style="background: #cfc; font-size: smaller;">nat-t <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>4500/udp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">remotescan 6077/tcp</td><td>+</td><td style="background: #cfc; font-size: smaller;">remotescan <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>6077/tcp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">remotescan 6078/udp</td><td>+</td><td style="background: #cfc; font-size: smaller;">remotescan <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>6078/udp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">netflow <del style="color: red; font-weight: bold; text-decoration: none;"> </del>9996/udp</td><td>+</td><td style="background: #cfc; font-size: smaller;">netflow <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>9996/udp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">dropbox <del style="color: red; font-weight: bold; text-decoration: none;"> </del>17500/tcp</td><td>+</td><td style="background: #cfc; font-size: smaller;">dropbox <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>17500/tcp</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">dropbox <del style="color: red; font-weight: bold; text-decoration: none;"> </del>17500/udp</td><td>+</td><td style="background: #cfc; font-size: smaller;">dropbox <ins style="color: red; font-weight: bold; text-decoration: none;"> </ins>17500/udp</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">&lt;/pre&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">&lt;/pre&gt;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> </table> Mon, 24 Dec 2012 13:11:21 GMT Jsface http://wiki.dd-wrt.com/wiki/index.php/Talk:Network_traffic_analysis_with_netflow_and_ntop Jsface at 13:09, 24 December 2012 http://wiki.dd-wrt.com/wiki/index.php?title=Network_traffic_analysis_with_netflow_and_ntop&diff=44119&oldid=prev <p></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 13:09, 24 December 2012</td> </tr> <tr><td colspan="2" align="left"><strong>Line 37:</strong></td> <td colspan="2" align="left"><strong>Line 37:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">==Rfow <del style="color: red; font-weight: bold; text-decoration: none;">plugin </del>configuration==</td><td>+</td><td style="background: #cfc; font-size: smaller;">==Rfow configuration==</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">You have to create a virtual rflow interface. </td><td> </td><td style="background: #eee; font-size: smaller;">You have to create a virtual rflow interface. </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Do this by selecting ''Plugins | All'' in the menu listing at the top of the webpage. </td><td> </td><td style="background: #eee; font-size: smaller;">Do this by selecting ''Plugins | All'' in the menu listing at the top of the webpage. </td></tr> <tr><td colspan="2" align="left"><strong>Line 91:</strong></td> <td colspan="2" align="left"><strong>Line 91:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">In the Windows version you will find the file &quot;services&quot; (without extension) in the directory C:\Program Files\OPENXTRA\NTopWin32.&lt;br&gt; </td><td> </td><td style="background: #eee; font-size: smaller;">In the Windows version you will find the file &quot;services&quot; (without extension) in the directory C:\Program Files\OPENXTRA\NTopWin32.&lt;br&gt; </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">The structure of the file is </td><td> </td><td style="background: #eee; font-size: smaller;">The structure of the file is </td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&lt;pre&gt;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">port port alias # description</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">name number/tcp </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">portname portnumber</del>/tcp <del style="color: red; font-weight: bold; text-decoration: none;">alias </del># <del style="color: red; font-weight: bold; text-decoration: none;">description</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">like this:</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">like this&lt;br&gt;</del></td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">pop2 109</ins>/tcp <ins style="color: red; font-weight: bold; text-decoration: none;">pop-2 </ins># <ins style="color: red; font-weight: bold; text-decoration: none;">Post Office Protocol - V2</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">pop3 110/tcp pop-3 # Post Office Protocol - Version 3</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">sunrpc 111/udp rpcbind</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">[[Image:services1.jpg]]</td><td colspan="2">&nbsp;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">You can add portnames to this file if you want ntop to show a portname in stead of a port number.</td><td> </td><td style="background: #eee; font-size: smaller;">You can add portnames to this file if you want ntop to show a portname in stead of a port number.</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">I have added the follwing ports:<del style="color: red; font-weight: bold; text-decoration: none;">&lt;br&gt;</del></td><td>+</td><td style="background: #cfc; font-size: smaller;">I have added the follwing ports:</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"><del style="color: red; font-weight: bold; text-decoration: none;">[[Image:services2.jpg]]</del></td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">#</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"># Extra services</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">#</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">ssh 22/tcp</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">ms-sql-s 1433/tcp</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">ms-sql-s 1433/udp</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">ms-sql-m 1434/tcp</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">ms-sql-m 1434/udp</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">upnp 1780/tcp</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">upnp 1780/udp</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">ssdp 1900/udp</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">ntop 3000/tcp</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">rdp 3389/tcp</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">rdp 3389/udp</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">atq 3456/udp</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">nat-t 4500/udp</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">remotescan 6077/tcp</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">remotescan 6078/udp</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">netflow 9996/udp</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">dropbox 17500/tcp</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">dropbox 17500/udp</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">&lt;/pre&gt;</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Stop and start the ntop service for the changes to take effect. </td><td> </td><td style="background: #eee; font-size: smaller;">Stop and start the ntop service for the changes to take effect. </td></tr> </table> Mon, 24 Dec 2012 13:09:09 GMT Jsface http://wiki.dd-wrt.com/wiki/index.php/Talk:Network_traffic_analysis_with_netflow_and_ntop Jsface at 09:49, 24 December 2012 http://wiki.dd-wrt.com/wiki/index.php?title=Network_traffic_analysis_with_netflow_and_ntop&diff=44118&oldid=prev <p></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 09:49, 24 December 2012</td> </tr> <tr><td colspan="2" align="left"><strong>Line 21:</strong></td> <td colspan="2" align="left"><strong>Line 21:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Common default ports for Netflow are 2055 and 9996. In my first setup I used port 2055 but because this port was used by other applications I had to change to 9996 to make my installation stable. </td><td> </td><td style="background: #eee; font-size: smaller;">Common default ports for Netflow are 2055 and 9996. In my first setup I used port 2055 but because this port was used by other applications I had to change to 9996 to make my installation stable. </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">''Interface:'' LAN&amp;<del style="color: red; font-weight: bold; text-decoration: none;">WAN </del>&lt;br&gt;</td><td>+</td><td style="background: #cfc; font-size: smaller;">''Interface:'' LAN&amp;<ins style="color: red; font-weight: bold; text-decoration: none;">WLAN </ins>&lt;br&gt;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Then click ''&quot;Apply Settings&quot;''</td><td> </td><td style="background: #eee; font-size: smaller;">Then click ''&quot;Apply Settings&quot;''</td></tr> </table> Mon, 24 Dec 2012 09:49:53 GMT Jsface http://wiki.dd-wrt.com/wiki/index.php/Talk:Network_traffic_analysis_with_netflow_and_ntop