NAME
       ntop - display top network users

SYNOPSIS
       ntop  [-I] [-r refresh time] [-R filter rules] [-f traffic
       dump file] [-n] [-N] [-M] [-p] IP  protocols  to  monitor]
       [-i  interface]  [-e  num  rows]  [-w  port] [-d] [-S] [-P
       dbpath] [-m local subnet] [-l log period] [-a  access  log
       file  path]  [-t  trace level] [-F flow filter expression]
       [filter expression]

DESCRIPTION
       ntop shows the current network usage. It displays  a  list
       of  hosts that are currently using the network and reports
       information concerning the (IP and non-IP) traffic  gener-
       ated by each host.  ntop can be started either in a termi-
       nal window (see intop ) or in  web  mode.  In  the  latter
       case, a web browser is needed to use the program.



COMMAND-LINE OPTIONS
       -I
        This  flag is obsolete: it used to start ntop in interac-
        tive mode.  intop provides you a character  based  inter-
        face.


       -R
        Specifies  the  filter  rules  used  by ntop for emitting
        alerts and warnings when the traffic matches  the  speci-
        fied  rules.  Shall you need further details about filter
        rules, please refer to ntop-rules (8) man page.


       -r
        Specifies the delay (in seconds) between  screen  updates
        (the  default  is  3 seconds). If the -l flag is used, it
        specifies how often entries are logged in the  log  file.
        Please note that if the delay is very short (1 second for
        instance), ntop might not be able to process all the net-
        work traffic.


       -f
        Specifies  the  file  containing tcpdump captured traffic
        that will be browsed before to start sniffing.


       -N
        Forces ntop not to use nmap (if it is installed).

       -M
        Forces ntop not to  merge  network  interfaces  together.
        This  means  that  ntop  will collect statistics for each
        interface and will not merge data together.


       -n
        This causes ntop to show numeric IP addresses instead  of
        the  symbolic  names. This option can useful when the DNS
        is not present or quite slow.  You can toggle the address
        format (numeric vs. symbolic) by pressing the n key while
        ntop is running.


       -p
        It is used to specify the IP  protocols  that  ntop  will
        monitor.   The   format  is  <label>=<protocol  list>  [,
        <label>=<protocol list>], where label is used to symboli-
        cally identify the <protocol list>. The format of <proto-
        col list> is <protocol>[|<protocol>], where <protocol> is
        either  a  valid  protocol specified inside the /etc/ser-
        vices  file  or  a  numeric  port  range  (e.g.  80,   or
        6000-6500).  If  the  -p  flag  is  omitted the following
        default      value      is      used:       "FTP=ftp|ftp-
        data,HTTP=http|www|https,DNS=name|domain,Telnet=tel-
        net|login,NBios-IP=netbios-ns|netbios-dgm|netbios-
        ssn,Mail=pop-2|pop-3|kpop|smtp|imap|imap2,SNMP=snmp|snmp-
        trap,NEWS=nntp,NFS=mount|pcnfs|bwnfs|nfs|nfsd-sta-
        tus,X11=6000-6010,SSH=ssh".  If  the  <protocol  list> is
        very long you may store in a file  (for  instance  proto-
        col.list)  the  value  of the <protocol list> and specify
        the file name instead of the <protocol  list>  (in  above
        example you will invoke 'ntop -p protocol.list').



       -i
        Specifies  the network interface used by ntop If multiple
        interfaces are used (this feature is  available  only  if
        ntop  is  compiled  with  thread support) they have to be
        separated with a comma. For instance -i "eth0,lo".  Traf-
        fic  information obtained by all the interfaces is merged
        together as if the traffic would have  been  produced  by
        one interface. Use the -M flag for not merging traffic.


       -e
        Is  the  manimum number of HTML table rows that ntop will
        display. This flag makes sense in web mode only.


       -w
        browse traffic information remotely. Supposing  to  start
        ntop  at  the port 3000 (default port), the URL to access
        is http://hostname:3000/. Users and URLs to protect  with
        passwords  are  stored  in  a  database  file. By default
        user/URL administration are accessible  uniquely  by  the
        user admin with password admin Passwords are stored in an
        encrypted form into the database  for  further  security.
        Please  note  that  an HTTP server is NOT needed but it's
        embedded into the application.


       -d
        This flag causes ntop to become  a  daemon,  i.e.  it  is
        started in background and detached from the terminal.


       -S
        Use  this flag for telling ntop to save information about
        host traffic on shutdown. This allows ntop not  to  loose
        traffic  stats across multiple ntop sessions. Please note
        that information about TCP session is (obviously) lost.


       -P
        This allows to specify where  db-files  are  searched  or
        created  (default  "."). In addition DBPATH/html is added
        to the searchlist for the WEB-files


       -m
        This flag allows users to specify the subnets whose traf-
        fic   is   considered   local.  The  format  is  <network
        address>/<# subnet mask bits>[,<network address>/<#  sub-
        net        mask        bits>].        For        instance
        "131.114.21.0/24,10.0.0.0/255.0.0.0".


       -l
        This causes ntop to periodically (specified with  the  -r
        flag)  log  network information data in the file ntop.log
        whose format is self-explanatory. This flag specifies the
        collection  time  between two consecutive log entries (in
        seconds). Please note that it is easy to use the log file
        to produce graphics (e.g. using gnuplot).


       -a
        By   default   ntop   logs  HTTP  accesses  in  the  file
        ntop.access.log in the current directory. Use  this  flag
        to  specify the path of the file where HTTP accesses will
        be logged. Each log entry is in  Apache-like  style.  The
        only  difference  between Apache and ntop is that .B ntop
        serve the request.


       -t
        This flag specifies the level of ntop tracings on stdout.
        The  trace  level ranges between 0 (no trace) and 5 (full
        debug tracings). The default trace value is 3. The higher
        is  the  trace  level  the  more information are printed.
        Trace level 1 is used to print errors only, level  2  for
        both warnings and errors, and so on.


       -F
        It  is used to specify network flows similar to more pow-
        erful applications such as NeTraMet. A flow is  a  stream
        of captured packets that match a specified rule. The for-
        mat   is   <flow-label>='<matching   expression>'[,<flow-
        label>='<matching  expression>'], where the label is used
        to  symbolically  identify  the  flow  specified  by  the
        expression.  The  expression  format  is specified in the
        appendix. If an expression is specified, then the  infor-
        mation  concerning  flows  can  be accessed following the
        HTML link named 'List NetFlows'.  For instance suppose to
        define  two  flows  with  the following expression "Luca-
        Hosts='host         jake.unipi.it         or         host
        pisanino.unipi.it',GatewayRoutedPkts='gateway       gate-
        way.unipi.it'". All the traffic  sent/received  by  hosts
        jake.unipi.it  or  pisanino.unipi.it is collected by ntop
        and added to the LucaHosts flow, whereas all  the  packet
        routed  by  the gateway gateway.unipi.it are added to the
        GatewayRoutedPkts flow. If the flows list  is  very  long
        you  may  store  in  a file (for instance flows.list) the
        list of flows and specify the file name  instead  of  the
        flows  list  (in  above  example you will invoke 'ntop -F
        flows.list').




       filter expression
        ntop , similar to what  tcpdump  does,  allows  users  to
        specify  an expression that restricts the type of traffic
        handled by ntop hence  to  select  only  the  traffic  of
        interest.  For instance, suppose to be interested only in
        the traffic generated/received by the host jake.unipi.it.
        ntop can then be started with the following filter: 'ntop
        src host jake.unipi.it or dst  host  jake.unipi.it'.  See
        the  tcpdump  man page for further information about this
        topic.



       users  can  access  the  traffic information using conven-
       tional web browsers. The main HTML page, is divided is two
       frames.  The left frame allows users to select the traffic
       view that will be displayed in the right frame.  Available
       sections  are:  sort traffic by data sent, sort traffic by
       data received,  traffic  statistics,  active  hosts  list,
       remote  to  local  (i.e. inside the subnet defined for the
       network board from which the program is  currently  sniff-
       ing)  IP  traffic,  local  to  remote IP traffic, local to
       local IP traffic, list of active TCP sessions, IP protocol
       distribution  statistics,  IP  protocol  usage, IP traffic
       matrix.


NOTES
       ntop is based on the libpcap library that can be found  at
       ftp://ftp.ee.lbl.gov/libpcap.tar.Z.   The   Win32  version
       makes use of libpcap for Win32 that can be downloaded from
       http://www.ntop.org/libpcap.html).


SEE ALSO
       intop(1),  ntop-rules(8),  top(1),  ngrep(8),  tcpdump(8).
       netramet(http://www.auckland.ac.nz/net/Account-
       ing/ntm.Release.note.html).

AUTHOR
       Please   send   bug  reports  to  the  ntop  mailing  list
       <ntop@ntop.org>.    ntop's    author    is    Luca    Deri
       <deri@ntop.org>.























Man(1) output converted with man2html