How To Install Ntopng on Rocky Linux 10

Network monitoring has become an essential component of modern IT infrastructure management. As organizations increasingly rely on digital communications and data transfer, the ability to monitor network traffic in real-time provides invaluable insights into system performance, security threats, and resource utilization. Ntopng stands as one of the most powerful and versatile network monitoring solutions available today, offering comprehensive traffic analysis capabilities that help administrators maintain optimal network performance.

Rocky Linux 10, with its enterprise-grade stability and robust architecture, provides an excellent foundation for deploying ntopng. This distribution offers the reliability needed for continuous network monitoring while maintaining compatibility with enterprise software requirements. The combination of ntopng and Rocky Linux 10 creates a formidable network monitoring platform that can handle everything from small office environments to large-scale enterprise deployments.

This comprehensive guide will walk you through every step of installing ntopng on Rocky Linux 10, from initial system preparation to advanced configuration options. You’ll learn how to configure repositories, manage services, implement security best practices, and troubleshoot common installation issues. By the end of this tutorial, you’ll have a fully functional ntopng installation capable of monitoring your network infrastructure with professional-grade accuracy and reliability.

What is Ntopng and Why Choose It for Network Monitoring

Ntopng represents the next generation of network monitoring applications, building upon the proven foundation of its predecessor, ntop. This high-performance, web-based network traffic monitoring application provides real-time visibility into network activity through an intuitive browser interface. Unlike traditional command-line monitoring tools, ntopng offers a sophisticated graphical interface that makes complex network analysis accessible to administrators of all skill levels.

The application operates as a passive network monitoring tool, capturing and analyzing network packets without interfering with normal traffic flow. This approach ensures that monitoring activities don’t impact network performance while providing comprehensive insights into data flows, protocol usage, and potential security threats. Ntopng excels at identifying network bottlenecks, unusual traffic patterns, and performance degradation issues that might otherwise go unnoticed.

Rocky Linux 10 provides an ideal platform for ntopng deployment due to its enterprise-grade stability and extensive package management capabilities. The distribution’s focus on security, long-term support, and compatibility with enterprise environments makes it particularly well-suited for production network monitoring scenarios. Additionally, Rocky Linux’s robust package management system simplifies the installation and maintenance of ntopng and its dependencies.

The real-time analytics capabilities of ntopng enable administrators to respond quickly to network issues, implement proactive security measures, and optimize resource allocation based on actual usage patterns. These features make ntopng an invaluable tool for maintaining network health and ensuring optimal performance across complex IT infrastructures.

Prerequisites and System Requirements for Ntopng Installation

Before proceeding with the ntopng installation, ensure your Rocky Linux 10 system meets the necessary requirements for optimal performance. System specifications play a crucial role in ntopng’s ability to process network traffic effectively, particularly in high-volume environments where large amounts of data require real-time analysis.

Minimum Hardware Specifications

Your Rocky Linux 10 system should include at least 2GB of RAM, though 4GB or more is recommended for production environments handling significant network traffic. CPU requirements vary based on monitoring scope, but a modern multi-core processor provides better performance for packet analysis and web interface responsiveness. Storage requirements depend on data retention policies, with SSD storage recommended for improved I/O performance during peak traffic analysis periods.

Network interface requirements include at least one monitoring interface capable of capturing traffic from the network segments you wish to analyze. Multiple network interfaces may be necessary for comprehensive monitoring in complex network topologies. Ensure that network interfaces support promiscuous mode for effective packet capture capabilities.

User Privileges and Access Requirements

Administrative access through root privileges or sudo capabilities is essential for ntopng installation and configuration. The installation process requires system-level modifications including repository additions, package installations, and service configurations that demand elevated permissions. Ensure your user account has appropriate sudo access or plan to perform installation tasks as the root user.

SSH access proves invaluable for remote installation and management scenarios, particularly in server environments where direct console access may be limited. Configure SSH key-based authentication for enhanced security when managing ntopng installations remotely. Additionally, ensure that firewall configurations allow necessary network traffic for both monitoring activities and web interface access.

Pre-installation System Verification

Verify that your Rocky Linux 10 system includes current updates by running system update commands before beginning the ntopng installation process. Check available disk space to ensure sufficient storage for ntopng packages and future monitoring data. Network connectivity verification ensures that package repositories remain accessible throughout the installation process.

Confirm that your system’s hostname resolution works correctly, as ntopng may require proper DNS functionality for certain features. Test network interface configurations to ensure that monitoring interfaces are properly configured and accessible to the ntopng application.

Understanding Ntopng Versions and Licensing Options

Ntopng offers multiple editions designed to meet diverse monitoring requirements and budget constraints. Understanding these options helps you select the appropriate version for your specific network monitoring needs while ensuring compliance with licensing requirements.

Ntopng Edition Overview

The Community Edition provides comprehensive network monitoring capabilities at no cost, making it an excellent choice for small to medium-sized deployments. This version includes essential monitoring features such as real-time traffic analysis, protocol identification, network statistics, and basic alerting capabilities. The Community Edition supports standard network protocols and provides sufficient functionality for most basic monitoring scenarios.

Professional Edition extends Community Edition capabilities with advanced features including enhanced reporting, extended data retention, and additional protocol analyzers. This version targets organizations requiring more sophisticated monitoring capabilities while maintaining cost-effectiveness. The Professional Edition includes features like historical data analysis, custom report generation, and advanced alerting mechanisms.

Enterprise M and Enterprise L editions provide comprehensive solutions for large-scale network monitoring deployments. These versions include advanced features such as flow collection, deep packet inspection, network behavior analysis, and integration capabilities with security information and event management (SIEM) systems. Enterprise editions support high-throughput network environments and include professional support services.

The Enterprise L Bundle represents the most comprehensive ntopng solution, incorporating all available features plus additional tools for comprehensive network analysis. This bundle includes specialized components for specific monitoring scenarios and provides the highest level of functionality available in the ntopng product line.

Licensing and Component Requirements

Several ntopng components require separate licensing for full functionality. PF_RING ZC user-space libraries enhance packet capture performance but require appropriate licensing for production use. These libraries provide zero-copy packet capture capabilities that significantly improve performance in high-traffic environments.

nProbe, the NetFlow and IPFIX probe component, requires licensing for production deployments. This tool enables flow-based monitoring and integration with network devices that support flow export protocols. nProbe licensing becomes essential when implementing comprehensive flow-based network monitoring solutions.

n2disk, the packet-to-disk application, provides high-performance packet capture and storage capabilities. This component requires licensing for production use and proves particularly valuable in environments requiring packet-level forensic analysis capabilities.

Repository Setup and Configuration Process

Proper repository configuration forms the foundation of successful ntopng installation on Rocky Linux 10. The process involves adding multiple repositories that provide ntopng packages and their dependencies, ensuring access to current software versions and security updates.

Adding the Official Ntop Repository

The official ntop repository provides the most current and stable ntopng packages specifically compiled for Rocky Linux environments. This repository ensures compatibility and access to official support resources. Execute the following command to add the ntop repository to your system:

curl https://packages.ntop.org/centos/ntop.repo > /etc/yum.repos.d/ntop.repo

This command downloads the repository configuration file directly from the official ntop package distribution server and places it in the appropriate directory for DNF package manager access. Verify successful repository addition by checking the contents of the newly created repository file and ensuring that repository URLs are accessible from your system.

Installing EPEL Repository

The Extra Packages for Enterprise Linux (EPEL) repository provides additional packages required for ntopng functionality that are not included in the standard Rocky Linux package sets. EPEL packages undergo rigorous testing to ensure compatibility with Enterprise Linux distributions while providing access to a broader range of software components.

Install the EPEL repository using either of the following methods:

dnf install epel-release -y

Alternatively, you can install EPEL directly from the Fedora project repository:

dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm

Both methods achieve the same result, with the first approach typically preferred for its simplicity and integration with the existing package management system.

Installing REMI Repository

The REMI repository provides additional PHP packages and libraries that may be required for certain ntopng features and web interface functionality. This repository ensures access to current PHP versions and related components that enhance ntopng’s web-based management capabilities.

Add the REMI repository to your system using the following command:

rpm -ivh http://rpms.remirepo.net/enterprise/remi-release-9.rpm

This command downloads and installs the REMI repository configuration package, enabling access to additional software components that complement ntopng functionality.

Enabling Additional Repositories

Complete repository setup requires enabling additional package sources and updating package management plugins. Install DNF plugins that provide enhanced repository management capabilities:

dnf install dnf-plugins-core -y

Enable the PowerTools repository (also known as CRB in some contexts) to access additional development and system libraries:

/usr/bin/crb enable

Enable the REMI repository for active use:

dnf config-manager --set-enabled remi

Complete the repository configuration process by updating your system’s package database:

dnf update -y

This command ensures that all repository metadata is current and that your system has access to the latest package versions from all configured sources.

Step-by-Step Ntopng Installation Process

The ntopng installation process involves installing multiple related packages that provide core functionality and optional performance enhancements. This comprehensive approach ensures that all necessary components are available for optimal network monitoring performance.

Installing Core Ntopng Packages

Execute the main installation command that includes all essential ntopng components and related tools:

dnf install pfring-dkms n2disk nprobe ntopng cento -y

This command installs several critical components:

pfring-dkms provides the PF_RING kernel module that enables high-performance packet capture capabilities. This component is essential for efficient network traffic analysis, particularly in high-throughput environments where standard packet capture methods may prove inadequate.

n2disk offers packet-to-disk functionality for scenarios requiring packet-level storage and forensic analysis capabilities. This tool captures network traffic directly to disk storage with minimal performance impact, enabling detailed post-incident analysis and compliance requirements.

nprobe provides NetFlow and IPFIX probe functionality that enables integration with network devices supporting flow export protocols. This component extends ntopng’s monitoring capabilities to include flow-based analysis from routers, switches, and other network infrastructure devices.

ntopng represents the core network monitoring application that provides the web interface and primary analysis capabilities. This package includes all essential monitoring features and forms the foundation of your network monitoring solution.

cento provides additional utilities and support tools that enhance ntopng functionality and integration capabilities with other system components.

Monitor the installation process for any error messages or dependency conflicts that may require resolution. The installation process typically completes successfully on properly configured systems, but network connectivity issues or repository access problems may occasionally interrupt the process.

Optional PF_RING ZC Drivers Installation

PF_RING Zero Copy (ZC) drivers provide enhanced packet capture performance for high-throughput network monitoring scenarios. These drivers are particularly beneficial in environments processing large volumes of network traffic where standard packet capture methods may introduce latency or packet loss.

Install PF_RING ZC drivers using the following command:

dnf install pfring-drivers-zc-dkms -y

Consider installing ZC drivers in the following scenarios:

• High-traffic network environments requiring capture rates exceeding 1Gbps
• Scenarios where packet loss during capture must be minimized
• Environments requiring precise timestamp accuracy for traffic analysis
• Situations where multiple applications require simultaneous packet access

Performance considerations include increased memory usage and potential compatibility requirements with specific network interface cards. Evaluate your specific monitoring requirements before implementing ZC drivers, as they may not provide benefits in low to moderate traffic environments.

Installation Verification and Package Confirmation

Verify successful installation by checking installed packages and versions:

rpm -qa | grep ntopng
rpm -qa | grep pfring
rpm -qa | grep nprobe

These commands display installed package versions and confirm successful installation of all ntopng components. Version information proves valuable for troubleshooting and support purposes, particularly when seeking assistance from ntopng community resources or professional support services.

Check installation logs for any warning messages or configuration notes that may require attention:

less /var/log/dnf.log

Review recent log entries to identify any post-installation configuration recommendations or potential issues that may affect ntopng functionality.

Ntopng Configuration and Setup Procedures

Proper configuration ensures optimal ntopng performance and functionality tailored to your specific network monitoring requirements. The configuration process involves modifying settings files, enabling appropriate features, and establishing network interface monitoring parameters.

Understanding Configuration File Structure

Ntopng configuration resides primarily in the main configuration file located at /etc/ntopng/ntopng.conf. This file controls all essential ntopng operational parameters including network interfaces, web interface settings, data storage options, and monitoring behavior.

Create a backup of the default configuration before making modifications:

cp /etc/ntopng/ntopng.conf /etc/ntopng/ntopng.conf.backup

Configuration file syntax follows a simple parameter format where each line represents a specific setting or command-line option. Comments begin with hash symbols (#) and provide documentation for various configuration options.

Review the default configuration file to understand available options:

cat /etc/ntopng/ntopng.conf

Community Version Configuration

Enable community mode for free ntopng functionality by modifying the configuration file to include community edition parameters:

sed -i 's#-G=/var/run/ntopng.pid#-G=/var/run/ntopng.pid \\n--community#' /etc/ntopng/ntopng.conf

This command adds the --community parameter to the configuration file, ensuring that ntopng operates in community mode without requiring commercial licensing. Community mode provides comprehensive monitoring capabilities suitable for most network monitoring scenarios while maintaining cost-effectiveness.

Alternatively, manually edit the configuration file to add community mode settings:

echo "--community" >> /etc/ntopng/ntopng.conf

Network Interface Configuration

Configure network interfaces for monitoring by specifying the interfaces ntopng should analyze. Identify available network interfaces on your system:

ip link show

This command displays all network interfaces available for monitoring. Select interfaces that carry the traffic you wish to analyze, which may include physical network interfaces, virtual interfaces, or bridge interfaces depending on your network topology.

Add interface specifications to the ntopng configuration file. For monitoring a single interface:

echo "-i=eth0" >> /etc/ntopng/ntopng.conf

For monitoring multiple interfaces:

echo "-i=eth0,eth1,eth2" >> /etc/ntopng/ntopng.conf

Configure additional interface-specific parameters as needed for your monitoring requirements. VLAN support may require additional configuration depending on your network infrastructure and monitoring objectives.

Service Management and System Integration

Proper service management ensures reliable ntopng operation and automatic startup capabilities. Rocky Linux 10 uses systemd for service management, providing robust control over ntopng service lifecycle and integration with system logging and monitoring capabilities.

Starting and Enabling Ntopng Service

Start the ntopng service using systemd commands:

systemctl start ntopng

Enable automatic startup to ensure ntopng starts automatically after system reboots:

systemctl enable ntopng

Verify service status and confirm successful startup:

systemctl status ntopng

This command displays comprehensive service status information including current operational state, recent log entries, and any error messages that may require attention. Successful startup should show active (running) status with no critical error messages in the service logs.

Service Management Best Practices

Configure service restart policies to ensure continuous monitoring capabilities even during temporary service interruptions. Systemd provides automatic restart capabilities that can be configured through service file modifications.

Review the systemd service file for ntopng:

cat /etc/systemd/system/multi-user.target.wants/ntopng.service

Implement log rotation to manage disk space usage for ntopng log files. Configure logrotate settings to maintain historical log data while preventing excessive disk usage:

cat > /etc/logrotate.d/ntopng << 'EOF'
/var/log/ntopng/*.log {
    weekly
    rotate 12
    compress
    delaycompress
    missingok
    notifempty
    create 644 ntopng ntopng
    postrotate
        systemctl reload ntopng
    endscript
}
EOF

Process Verification and System Integration

Verify that ntopng processes are running correctly and listening on expected network ports:

ps aux | grep ntopng
ss -altnp | grep 3000

The first command shows running ntopng processes with resource usage information. The second command confirms that ntopng is listening on port 3000, which is the default web interface port.

Check system resource usage to ensure ntopng operates within acceptable parameters:

top -p $(pgrep ntopng)

Monitor memory and CPU usage patterns to identify any performance issues or resource constraints that may affect monitoring capabilities.

Firewall Configuration and Network Security

Proper firewall configuration balances security requirements with ntopng accessibility needs. Rocky Linux 10 typically uses firewalld for firewall management, requiring specific configuration to allow web interface access while maintaining system security.

Firewalld Configuration for Ntopng Access

Open the necessary port for ntopng web interface access:

firewall-cmd --permanent --add-port=3000/tcp

Apply firewall changes by reloading the firewall configuration:

firewall-cmd --reload

Verify that the port is properly opened:

firewall-cmd --list-ports

This command should display port 3000/tcp among the allowed ports. Consider implementing IP address restrictions for enhanced security in production environments where web interface access should be limited to specific management networks or IP ranges.

Advanced Security Configuration

Implement source IP restrictions for enhanced security:

firewall-cmd --permanent --add-rich-rule="rule family='ipv4' source address='192.168.1.0/24' port protocol='tcp' port='3000' accept"

This example restricts access to the ntopng web interface to clients within the 192.168.1.0/24 network range. Adjust the IP range to match your management network requirements and security policies.

Consider implementing SSL/TLS encryption for web interface access in production environments. SSL configuration requires additional certificate management but provides essential security for sensitive network monitoring data transmitted over potentially untrusted networks.

Configure iptables rules for additional security layers if required by your organization’s security policies:

iptables -A INPUT -p tcp --dport 3000 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP

These rules provide granular control over ntopng access while maintaining compatibility with firewalld configurations.

Initial Web Interface Access and Configuration

Accessing the ntopng web interface represents the culmination of the installation process and provides your first opportunity to interact with the monitoring system. The web interface serves as the primary management and monitoring console for all ntopng functionality.

Accessing the Web Interface

Open your web browser and navigate to the ntopng web interface using the server’s IP address:

http://server-IP:3000

Replace “server-IP” with your Rocky Linux 10 system’s actual IP address. The default port 3000 provides access to the web interface unless modified during configuration.

Use the default credentials for initial login:

• Username: admin
• Password: admin

Immediately change the default password after first login to prevent unauthorized access to your network monitoring system. The web interface will typically prompt for password change during initial setup.

Initial Configuration Wizard

The first login initiates a configuration wizard that guides you through essential setup tasks including password changes, interface selection, and basic monitoring parameters. Complete each wizard step carefully to ensure optimal initial configuration.

Configure data retention policies based on your monitoring requirements and available storage capacity. Longer retention periods provide more comprehensive historical analysis but require additional disk space and may impact system performance during data queries.

Select network interfaces for monitoring from the available interface list. The wizard displays detected network interfaces and allows you to specify which interfaces should be monitored by ntopng.

Web Interface Navigation

The ntopng dashboard provides comprehensive network monitoring information organized into logical sections including traffic statistics, host information, flow analysis, and alert management. Familiarize yourself with the main navigation menu to efficiently access different monitoring features.

Key dashboard sections include:

• Traffic Dashboard: Real-time network traffic statistics and trending information
• Hosts: Individual host activity analysis and detailed statistics
• Interfaces: Per-interface traffic analysis and performance metrics
• Flows: Network flow analysis and connection tracking
• Alerts: Security alerts and anomaly detection notifications

Customize dashboard views to match your specific monitoring requirements and organizational preferences. The web interface provides extensive customization options for data presentation and analysis focus areas.

Testing and Performance Verification

Comprehensive testing ensures that your ntopng installation functions correctly and provides accurate network monitoring data. Testing procedures should validate both basic functionality and performance characteristics under expected operational conditions.

Functionality Testing

Verify traffic monitoring accuracy by generating known network traffic patterns and confirming that ntopng correctly identifies and analyzes the traffic. Simple tests include web browsing, file transfers, and network pings that should appear in ntopng monitoring displays.

Test alert system functionality by configuring basic alert thresholds and triggering conditions through controlled network activity. Successful alert generation confirms that monitoring and notification systems operate correctly.

Verify dashboard responsiveness and data update rates by monitoring the web interface during various network activity levels. Real-time monitoring displays should update consistently without significant delays or data gaps.

Performance Validation and System Impact

Analyze system resource usage during ntopng operation to ensure that monitoring activities don’t negatively impact system performance:

vmstat 1 10
iostat -x 1 10
free -h

These commands provide insights into CPU usage, memory consumption, and disk I/O patterns during ntopng operation. Monitor resource usage patterns over extended periods to identify any performance trends or resource constraints.

Test monitoring accuracy under various network load conditions to ensure that packet capture and analysis remain reliable during peak traffic periods. High network loads may require configuration adjustments to maintain monitoring accuracy and prevent packet loss.

Validate network monitoring accuracy by comparing ntopng data with other monitoring tools or network device statistics. Cross-verification ensures data accuracy and identifies any configuration issues that may affect monitoring reliability.

Troubleshooting Common Installation and Configuration Issues

Successful ntopng deployment occasionally encounters challenges that require systematic troubleshooting approaches. Understanding common issues and their solutions helps maintain reliable monitoring operations and reduces system downtime.

Repository and Installation Problems

Repository access issues frequently cause installation failures due to network connectivity problems or repository configuration errors. Verify repository accessibility:

dnf repolist
dnf clean all
dnf makecache

These commands refresh repository metadata and identify any repository access problems. Network connectivity issues may require proxy configuration or alternative repository mirrors for successful package downloads.

Dependency conflicts occasionally occur when existing system packages conflict with ntopng requirements. Resolve conflicts by updating conflicting packages or using DNF’s conflict resolution capabilities:

dnf upgrade --best --allowerasing

Package download failures may indicate insufficient disk space or network connectivity issues. Verify available disk space in /var/cache/dnf and ensure stable internet connectivity throughout the installation process.

Service Startup and Configuration Issues

Service startup failures typically result from configuration errors or missing dependencies. Check systemd service status for detailed error information:

journalctl -u ntopng -f

This command displays real-time log entries from the ntopng service, helping identify specific configuration problems or dependency issues.

Configuration file syntax errors prevent successful service startup. Validate configuration file syntax by reviewing the backup configuration and comparing it with your modifications:

diff /etc/ntopng/ntopng.conf.backup /etc/ntopng/ntopng.conf

Port binding problems occur when other applications use the same network ports required by ntopng. Identify port conflicts using netstat or ss commands:

ss -tlnp | grep :3000

Interface detection issues may prevent network monitoring functionality. Verify that specified network interfaces exist and are accessible:

ip link show
ifconfig -a

Ensure that interface names in the ntopng configuration file match actual system interface names.

Performance and Resource Issues

Memory allocation problems may occur in resource-constrained environments. Monitor system memory usage and adjust ntopng configuration parameters to optimize memory consumption:

echo "vm.swappiness=10" >> /etc/sysctl.conf
sysctl -p

CPU usage optimization requires balancing monitoring accuracy with system performance. Adjust monitoring intervals and analysis depth based on available processing capacity and monitoring requirements.

Network buffer tuning may be necessary for high-throughput monitoring scenarios. Configure kernel network parameters for optimal packet capture performance:

echo 'net.core.rmem_default = 262144' >> /etc/sysctl.conf
echo 'net.core.rmem_max = 16777216' >> /etc/sysctl.conf
echo 'net.core.netdev_max_backlog = 5000' >> /etc/sysctl.conf
sysctl -p

Maintenance, Updates, and Long-term Management

Regular maintenance ensures continued ntopng reliability and performance while preventing issues that could compromise network monitoring capabilities. Establishing maintenance procedures provides a framework for long-term system management and optimization.

Regular Maintenance Tasks

Implement systematic log file management to prevent excessive disk usage while maintaining sufficient historical data for analysis and troubleshooting:

find /var/log/ntopng -name "*.log" -mtime +30 -delete

Database cleanup procedures help maintain optimal performance by removing outdated monitoring data based on retention policies. Configure automatic cleanup tasks through cron jobs:

crontab -e

Add the following entry for weekly database maintenance:

0 2 * * 0 /usr/bin/find /var/lib/ntopng -name "*.rrd" -mtime +90 -delete

Configuration backup strategies protect against accidental configuration loss and provide rollback capabilities for configuration changes:

tar -czf /backup/ntopng-config-$(date +%Y%m%d).tar.gz /etc/ntopng/

Update Procedures and Version Management

Maintain current ntopng versions through regular system updates while ensuring configuration compatibility:

dnf update ntopng

Preserve custom configurations during updates by maintaining separate backup copies of configuration files before performing updates. Test updated versions in non-production environments when possible to identify any compatibility issues.

Version compatibility checks ensure that ntopng updates don’t introduce breaking changes to existing configurations or monitoring functionality. Review update changelogs and documentation before implementing updates in production environments.

Implement rollback procedures for failed updates:

dnf history list ntopng
dnf history undo last

These commands provide update history and rollback capabilities for situations where updates introduce unexpected issues or compatibility problems.

Congratulations! You have successfully installed Ntopng. Thanks for using this tutorial for installing Ntopng open-source network traffic monitoring and analysis tool on Rocky Linux 10 system. For additional help or useful information, we recommend you check the official Ntopng website.