################################ NTOP모니터링Tool설치 트래픽 모니터링 2007.11.15 매뉴얼 류광섭 ################################ ntop을 설치하기 전에 선행되어야 할 툴중에 RRDTool이다. - RRDTool 설치 System Monitoring [root@localhost ntop]# BUILD_DIR=/tmp/rrdbuild [root@localhost ntop]# INSTALL_DIR=/usr/local/rrdtool [root@localhost ntop]# mkdir -p $BUILD_DIR [root@localhost ntop]# cd $BUILD_DIR [root@localhost ntop]# wget http://oss.oetiker.ch/rrdtool/pub/rrdtool-1.2.25.tar.gz [root@localhost ntop]# tar zxf rrdtool-1.2.19.tar.gz [root@localhost ntop]# cd $BUILD_DIR/rrdtool-1.2.19 [root@localhost ntop]# ./configure --prefix=$INSTALL_DIR --disable-python --disable-tcl [root@localhost ntop]# make clean [root@localhost ntop]# make [root@localhost ntop]# make install RRDTool을 설치하다 몇몇 패키지가 에러날경우 밑에서 골라서 설치한다. - Building zlib [root@localhost ntop]# cd $BUILD_DIR [root@localhost ntop]# wget http://oss.oetiker.ch/rrdtool/pub/libs/zlib-1.2.3.tar.gz [root@localhost ntop]# tar zxf zlib-1.2.3.tar.gz [root@localhost ntop]# cd zlib-1.2.3 [root@localhost ntop]# env CFLAGS="-O3 -fPIC" ./configure --prefix=$BUILD_DIR/lb && make && make install - Building libpng [root@localhost ntop]# cd $BUILD_DIR [root@localhost ntop]# wget http://people.ee.ethz.ch/~oetiker/webtools/rrdtool/pub/libs/libpng-1.2.10.tar.gz [root@localhost ntop]# tar zxvf libpng-1.2.10.tar.gz [root@localhost ntop]# cd libpng-1.2.10 [root@localhost ntop]# env CPPFLAGS="-I$BUILD_DIR/lb/include" LDFLAGS="-L$BUILD_DIR/lb/lib" CFLAGS="-O3 -fPIC" \ ./configure --disable-shared --prefix=$BUILD_DIR/lb && make && make install - Building freetype [root@localhost ntop]# cd $BUILD_DIR [root@localhost ntop]# wget http://oss.oetiker.ch/rrdtool/pub/libs/freetype-2.1.10.tar.bz2 [root@localhost ntop]# tar jxvf freetype-2.1.10.tar.bz2 [root@localhost ntop]# cd freetype-2.1.10 [root@localhost ntop]# env CPPFLAGS="-I$BUILD_DIR/lb/include" LDFLAGS="-L$BUILD_DIR/lb/lib" CFLAGS="-O3 -fPIC" \ ./configure --disable-shared --prefix=$BUILD_DIR/lb && make && make install - Building libart_lgpl [root@localhost ntop]# cd $BUILD_DIR [root@localhost ntop]# wget http://oss.oetiker.ch/rrdtool/pub/libs/libart_lgpl-2.3.17.tar.gz [root@localhost ntop]# tar zxvf libart_lgpl-2.3.17.tar.gz [root@localhost ntop]# cd libart_lgpl-2.3.17 [root@localhost ntop]# env CFLAGS="-O3 -fPIC" ./configure --disable-shared --prefix=$BUILD_DIR/lb && make && make install - Building libpcap 다운로드 : http://sourceforge.net [root@localhost ntop]# cd $BUILD_DIR [root@localhost ntop]# tar zxvf libpcap-0.9.8.tar.tar [root@localhost ntop]# cd libpcap-0.9.8 [root@localhost ntop]# ./configure && make && make install 이 환경변수들은 꼭 실행해주자 IR=-I$BUILD_DIR/lb/include CPPFLAGS="$IR $IR/libart-2.0 $IR/freetype2 $IR/libpng" LDFLAGS="-L$BUILD_DIR/lb/lib" CFLAGS=-O3 export CPPFLAGS LDFLAGS CFLAGS - ntop설치 다운로드 :http://sourceforge.net/project/downloading.php?group_id=17233&use_mirror=nchc&filename=ntop-3.3.tar.gz&49030191 [root@localhost ntop]# ./autogen.sh [root@localhost ntop]# ./configure --prefix=/usr/local/ntop [root@localhost ntop]# make [root@localhost ntop]# make install [root@localhost ntop]# cd /usr/local/ntop/bin/ [root@localhost ntop]# ./bin/ntop ntop startup - waiting for user response! Please enter the password for the admin user: Please enter the password again: [root@localhost ntop]# useradd ntop [root@localhost ntop]# chown -R ntop.ntop //usr/local/ntop/share/ntop [root@localhost ntop]# ./ntop -u ntop -w 81 -r 180 -i eth1 & -u : ntop을 실행할 유저 root로 할경우 보안경고와 함께 실행이 안됩니다. -w : http 프로토콜의 포트번호 -W : ssl 로 띄울 포트번호 -P : ntop 이 시작될때 생성되는 db 화일이 존재할 디렉토리 입니다..꼭 이 옵션을 줘야 합니다. -r : refresh 시간입니다. default 는 3초네요. -i : interface 지정입니다. -m : 모니터링할 네트웍 대역입니다. start_ntop.sh 작성 [root@localhost ntop]# /usr/local/ntop/bin/ntop -u ntop -w 3000 -P /usr/local/ntop -r 180 -i eth1 & stop_ntop.sh 작성 [root@localhost ntop]# kill -9 `lsof | grep LISTEN | grep ntop | awk '{print $2}'` 스크립트 작성해서 사용 하시면 됩니다. NTOP 옵션 참고하세요 ++++++++++++++++++++ Usage: ntop [OPTION] Basic options: [-h | --help] Display this help and exit [-u | --user ] Userid/name to run ntop under (see man page) [-t | --trace-level ] Trace level [0-6] [-P | --db-file-path ] Path for ntop internal database files [-Q | --spool-file-path ] Path for ntop spool files [-w | --http-server ] Web server (http:) port (or address:port) to listen on [-W | --https-server ] Web server (https:) port (or address:port) to listen on Advanced options: [-4 | --ipv4] Use IPv4 connections [-6 | --ipv6] Use IPv6 connections [-a | --access-log-file ] File for ntop web server access log [-b | --disable-decoders] Disable protocol decoders [-c | --sticky-hosts] Idle hosts are not purged from memory [-d | --daemon] Run ntop in daemon mode [-e | --max-table-rows ] Maximum number of table rows to report [-f | --traffic-dump-file ] Traffic dump file (see tcpdump) [-g | --track-local-hosts] Track only local hosts [-i | --interface ] Interface name or names to monitor [-j | --create-other-packets] Create file ntop-other-pkts.XXX.pcap file [-l | --pcap-log ] Dump packets captured to a file (debug only!) [-m | --local-subnets ] Local subnetwork(s) (see man page) [-n | --numeric-ip-addresses] Numeric IP addresses - no DNS resolution [-o | --no-mac] ntop will trust just IP addresses (no MACs) [-p | --protocols ] List of IP protocols to monitor (see man page) [-q | --create-suspicious-packets] Create file ntop-suspicious-pkts.XXX.pcap file [-r | --refresh-time ] Refresh time in seconds, default is 120 [-s | --no-promiscuous] Disable promiscuous mode [-x ] Max num. hash entries ntop can handle (default 8192) [-z | --disable-sessions] Disable TCP session tracking [-A] Ask admin user password and exit