ntopng Network Traffic Monitoring on AWS User Guide

Overview

This image delivers ntopng, the open source, web-based network traffic monitoring and flow-analysis tool - the next generation of the original ntop. ntopng gives you real-time and historical visibility into every host and flow on your network, deep Layer-7 application and protocol detection through nDPI, flow collection for NetFlow, sFlow and IPFIX, alerting, and a rich interactive dashboard served on port 3000.

The image ships the GPLv3 community edition of ntopng, run with the --community flag and no license key. It is installed from the official ntop apt-stable repository and pre-configured behind its mandatory redis backing store. Both run as systemd services; ntopng is ordered to start after redis. ntopng's data directory - RRD/timeseries, flow and host history - lives on a dedicated, independently-resizable EBS volume mounted at /var/lib/ntopng, separate from the operating system disk.

Secure by default - no shipped credentials

A stock ntopng ships with the well-known default administrator admin / admin. This image locks that out: the shipped AMI has no working default login. On its first boot, each instance generates a unique administrator password, stores its hash in redis and writes the plaintext to a root-only credentials file at /root/ntopng-credentials.txt. No shared password exists in the image, and admin/admin is rejected.

Connecting to your instance

Connect over SSH on port 22 using the default login user for your operating system variant and the EC2 key pair you launched with.

Replace <instance-public-ip> with your instance's public IPv4 address (or its private address if you reach it over a VPN or Direct Connect).

Open these ports in the instance's security group:

For production, restrict port 3000 to trusted source ranges and put the UI behind TLS (see Putting the UI behind HTTPS).

Retrieve your administrator password

The unique per-instance password is written to a root-only file. Read it over SSH:

sudo cat /root/ntopng-credentials.txt

You will see something like:

# ntopng community — Per-instance Credentials
ADMIN_USER=admin
ADMIN_PASSWORD=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
PORT=3000
NTOPNG_URL=http://<instance-public-ip>:3000

Copy the ADMIN_PASSWORD value - you will use it to sign in.

First sign-in

Open the ntopng web UI in your browser:

http://<instance-public-ip>:3000/

You are taken to the ntopng login page. Sign in as admin with the password from the credentials file.

After signing in, we recommend changing the administrator password again from Settings → Preferences → Manage Users, and creating additional per-user accounts rather than sharing the admin login.

The traffic dashboard

The dashboard opens on the Traffic view, summarising the monitored interface in real time - top flow talkers, top hosts (local and remote), top applications and a traffic classification breakdown.

The interface selector at the top left shows which NIC ntopng is monitoring (the instance's primary interface is selected automatically on first boot), along with live throughput.

Hosts

The Hosts view lists every active host ntopng has seen, with flow counts, alert scores, geolocation, a sent/received traffic breakdown and throughput. Click any host to drill into its ports, peers, protocols and historical activity.

Flows and Layer-7 detection

The Flows view shows live flows with their source and destination, ports, and - crucially - the nDPI Layer-7 application/protocol label for each flow (HTTP, TLS, GitHub, and hundreds more). This classifies traffic by the actual application, not just the port number.

Use the filters at the top to narrow flows by protocol, application, host, status or AS number.

Collecting NetFlow, sFlow and IPFIX

Beyond monitoring its own interface, ntopng can aggregate flows exported by your routers, switches and firewalls. Point your exporters at the instance and add a flow-collection interface. A common pattern uses ntop's nprobe collector feeding ntopng over ZMQ; for a quick start, ntopng can also open a collector interface directly - see the ntopng documentation for the collector setup matching your exporter. Remember to open the exporter's UDP port in the security group and restrict it to your network devices.

Managing the services

Two systemd units run the stack:

# Check status
systemctl status ntopng redis-server

# Which ports are listening (3000 = ntopng UI, 6379 = redis on loopback)
sudo ss -tlnp | grep -E ':3000|:6379'

# Restart ntopng (or redis)
sudo systemctl restart ntopng
sudo systemctl restart redis-server

ntopng depends on redis; a systemd drop-in orders ntopng.service to start after redis-server.service. redis binds only to the loopback interface (127.0.0.1:6379) and is not reachable from the network.

The monitored interface and web port are configured in /etc/ntopng/ntopng.conf. To monitor a different interface or change the port, edit that file and restart ntopng.

The data volume

ntopng's data directory is a dedicated EBS volume mounted at /var/lib/ntopng, separate from the operating system disk:

df -h /var/lib/ntopng

Because it is a separate volume you can snapshot it, encrypt it with EBS encryption at rest, and resize it independently of the root volume. The mount is recorded in /etc/fstab by filesystem UUID, so it survives reboots and re-launches.

Putting the UI behind HTTPS

ntopng serves plain HTTP on port 3000. For production, terminate TLS in front of it with a reverse proxy. A minimal nginx example:

server {
    listen 443 ssl;
    server_name your-domain.example.com;

    ssl_certificate     /etc/letsencrypt/live/your-domain.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/your-domain.example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

Install nginx and certbot, obtain a certificate with certbot --nginx -d your-domain.example.com, then restrict port 3000 to loopback (bind ntopng with -w=127.0.0.1:3000 in /etc/ntopng/ntopng.conf) and expose only 443 in the security group.

Upgrading ntopng

ntopng is installed from the official ntop apt-stable repository, so it upgrades with the rest of the system:

sudo apt-get update
sudo apt-get upgrade ntopng ntopng-data
sudo systemctl restart ntopng

Support

This image is published by cloudimg with 24/7 technical support by email and live chat, covering deployment, upgrades, reverse-proxy and TLS termination, and flow-collector configuration.

• Email: support@cloudimg.co.uk
• Live chat: available 24/7

ntopng is released under the GNU General Public License v3 (GPLv3) and is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.