ntop-3.3.9.tar.gz

NTOP(8) NTOP(8) NNAAMMEE ntop - display top network users SSYYNNOOPPSSIISS nnttoopp [@@ffiilleennaammee] [--aa|----aacccceessss--lloogg--ffiillee _<_p_a_t_h_>] [--bb|----ddiissaabbllee--ddeeccooddeerrss] [--cc|----ssttiicckkyy--hhoossttss] [--ee|----mmaaxx--ttaabbllee--rroowwss] [--ff|----ttrraaffffiicc--dduummpp--ffiillee _f_i_l_e_>] [--gg|----ttrraacckk--llooccaall--hhoossttss] [--hh|----hheellpp] [--jj|----ccrreeaattee--ootthheerr--ppaacckkeettss] [--ll|----ppccaapp--lloogg _<_p_a_t_h_>] [--mm|----llooccaall--ssuubbnneettss _<_a_d_d_r_e_s_s_e_s_>] [--nn|----nnuummeerriicc-- iipp--aaddddrreesssseess] [--oo|----nnoo--mmaacc] [--pp|----pprroottooccoollss _<_l_i_s_t_>] [--qq|----ccrreeaattee--ssuussppii-- cciioouuss--ppaacckkeettss] [--rr|----rreeffrreesshh--ttiimmee _<_n_u_m_b_e_r_>] [--ss|----nnoo--pprroommiissccuuoouuss] [--tt|----ttrraaccee--lleevveell _<_n_u_m_b_e_r_>] [--xx _<_m_a_x___n_u_m___h_a_s_h___e_n_t_r_i_e_s_>] [--ww|----hhttttpp-- sseerrvveerr _<_p_o_r_t_>] [--zz|----ddiissaabbllee--sseessssiioonnss] [--AA|----sseett--aaddmmiinn--ppaasssswwoorrdd _p_a_s_s_- _w_o_r_d] [--BB|----ffiilltteerr--eexxpprreessssiioonn _e_x_p_r_e_s_s_i_o_n] [--CC _<_c_o_n_f_i_gmode>_] [--DD|----ddoommaaiinn _<_n_a_m_e_>] [--FF|----ffllooww--ssppeecc _<_s_p_e_c_s_>] [--MM|----nnoo--iinntteerrffaaccee--mmeerrggee] [--NN|----wwwwnn--mmaapp _<_p_a_t_h_>] [--OO|--------oouuttppuutt--ppaacckkeett--ppaatthh _<_p_a_t_h_>] [--PP|----ddbb--ffiillee-- ppaatthh _<_p_a_t_h_>] [--QQ|----ssppooooll--ffiillee--ppaatthh _<_p_a_t_h_>] [--UU|----mmaappppeerr _<_U_R_L_>] [--VV|----vveerrssiioonn]] [--XX _<_m_a_x___n_u_m___T_C_P___s_e_s_s_i_o_n_s_>] [----ddiissaabbllee--iinnssttaannttsseessssiioonn-- ppuurrggee] [----ddiissaabbllee--mmuutteexxeexxttrraaiinnffoo] [----ddiissaabbllee--sscchheeddyyiieelldd] [----ddiissaabbllee-- ssttooppccaapp] [----ffcc--oonnllyy] [----iinnssttaannccee] [----nnoo--ffcc] [----nnoo--iinnvvaalliidd--lluunn] [----pp33pp-- ccpp] [----pp33pp--uurrii] [----sskkiipp--vveerrssiioonn--cchheecckk] [----ww33cc] [--44|----iippvv44]] [--66|----iippvv66]] Unix options: [--dd|----ddaaeemmoonn] [--ii|----iinntteerrffaaccee _<_n_a_m_e_>] [--uu|----uusseerr _<_u_s_e_r_>] [--KK|----eennaabbllee-- ddeebbuugg] [--LL] [----ppccaapp__sseettnnoonnbblloocckk] [----uussee--ssyysslloogg== _<_f_a_c_i_l_i_t_y_>] [----wweebb-- sseerrvveerr--qquueeuuee _<_n_u_m_b_e_r_>] Windows option: [--ii|----iinntteerrffaaccee _<_n_u_m_b_e_r_|_n_a_m_e_>] OpenSSL options: [--WW|----hhttttppss--sseerrvveerr _<_p_o_r_t_>] [----ssssll--wwaattcchhddoogg] DDEESSCCRRIIPPTTIIOONN nnttoopp shows the current network usage. It displays a list of hosts that are currently using the network and reports information concerning the (IP and non-IP) traffic generated and received by each host. nnttoopp may operate as a front-end collector (sFlow and/or netFlow plugins) or as a stand-alone collector/display program. A web browser is needed to access the information captured by the nnttoopp program. nnttoopp is a hybrid layer 2 / layer 3 network monitor, that is by default it uses the layer 2 Media Access Control (MAC) addresses AND the layer 3 tcp/ip addresses. nnttoopp is capable of associating the two, so that ip and non-ip traffic (e.g. arp, rarp) are combined for a complete picture of network activity. CCOOMMMMAANNDD--LLIINNEE OOPPTTIIOONNSS @@ffiilleennaammee The text of ffiilleennaammee is copied - ignoring line breaks and comment lines (anything following a #) - into the command line. nnttoopp behaves as if all of the text had simply been typed directly on the command line. For example, if the command line is "-t 3 @d -u ntop" and file d contains just the line '-d', then the effective command line is -t 3 -d -u ntop. Multiple @s are permitted. Nested @s (an @ inside the file) are not permitted. Remember, most nnttoopp options are "sticky", that is they just set an internal flag. Invoking them multiple times doesn't change nnttoopp''ss behavior. However, options that set a value, such as --trace-level, will use the LAST value given: --trace-level 2 --trace-level 3 will run as --trace-level 3. Beginning with 3.1, many command-line options may also be set via the web browser interface. These changes take effect on the next run of and on each subsequent run until changed. --aa || ----aacccceessss--lloogg--ffiillee By default nnttoopp does not maintain a log of HTTP requests to the inter- nal web server. Use this parameter to request logging and to specify the location of the file where these HTTP requests are logged. Each log entry is in Apache-like style. The only difference between Apache and nnttoopp logs is that an additional column has been added which has the time (in milliseconds) that nnttoopp needed to serve the request. Log entries look like this: 192.168.1.1 - - [04/Sep/2003:20:38:55 -0500] - "GET / HTTP/1.1" 200 1489 4 192.168.1.1 - - [04/Sep/2003:20:38:55 -0500] - "GET /index_top.html HTTP/1.1" 200 1854 4 192.168.1.1 - - [04/Sep/2003:20:38:55 -0500] - "GET /index_inner.html HTTP/1.1" 200 1441 7 192.168.1.1 - - [04/Sep/2003:20:38:56 -0500] - "GET /index_left.html HTTP/1.1" 200 1356 4 192.168.1.1 - - [04/Sep/2003:20:38:56 -0500] - "GET /home_.html HTTP/1.1" 200 154/617 9 192.168.1.1 - - [04/Sep/2003:20:38:56 -0500] - "GET /home.html HTTP/1.1" 200 1100/3195 10 192.168.1.1 - - [04/Sep/2003:20:38:56 -0500] - "GET /About.html HTTP/1.1" 200 2010 10 This parameter is the complete file name of the access log. In prior releases it was erroneously called --access-log-path. --bb || ----ddiissaabbllee--ddeeccooddeerrss This parameter disables protocol decoders. Protocol decoders examine and collect information about layer 2 proto- cols such as NetBIOS or Netware SAP, as well as about specific tcp/ip (layer 3) protocols, such as DNS, http and ftp. This support is specifically coded for each protocol and is different from the capability to count raw information (packets and bytes) by protocol specified by the -p | --protocols parameter