ntopng - Network Traffic Monitoring

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## ntopng - Network Traffic Monitoring on AWS

ntopng is a high-speed, web-based network traffic monitoring and flow-analysis tool - the next generation of the original ntop. It gives you real-time and historical visibility into every host and flow on your network, deep Layer-7 application and protocol detection through nDPI, flow collection for NetFlow, sFlow and IPFIX, alerting, and a rich interactive dashboard. This AMI delivers the GPL community edition fully installed, ordered behind its mandatory redis backing store, and serving its web UI on port 3000 - operational within minutes of launch, with no manual package installation or dependency troubleshooting.

## Why This AMI Over a Manual Install

Unlike a bare ntopng deployment, this image ships with:

• redis backing store pre-configured - ntopng's required in-memory store is installed, ordered before ntopng and bound to loopback
• Dedicated data volume - ntopng's RRD/timeseries and flow history live on a separately resizable EBS disk, not the root volume, so you can snapshot and scale storage independently
• No default credentials - a stock ntopng ships with admin/admin; this image locks that out and mints a unique administrator password on first boot, written to a root-only credentials file on the instance
• systemd service management - automatic restarts, clean logging and standard Linux service controls for both redis and ntopng
• 24/7 cloudimg support included for deployment, upgrades, reverse-proxy/TLS termination and flow-collector configuration

## Use Case: Network Team Investigating Traffic Anomalies

An operations team needs to see what is actually talking on their VPC and spot unexpected traffic. With this AMI they launch a single instance, open the dashboard, and immediately see per-host and per-flow breakdowns with Layer-7 application labels - identifying top talkers, unusual destinations and protocol mixes without deploying agents on every host. They can point NetFlow/sFlow exporters at the instance to aggregate flows from routers and switches into one searchable view.

## Monitoring Capabilities

• Real-time dashboards: live per-host and per-flow traffic, top talkers and protocol breakdowns
• Layer-7 detection: nDPI classifies applications and protocols, not just ports
• Flow collection: ingest NetFlow, sFlow and IPFIX from routers, switches and firewalls
• Historical analysis: RRD/timeseries retention for traffic trends over time
• Alerting: thresholds and behavioural alerts on hosts, flows and interfaces

## Application Stack

ntopng is a compiled C++ daemon backed by redis for its in-memory state. Both run as systemd services; ntopng is ordered to start after redis. The web UI is served directly on port 3000 over HTTP - for production, front it with a reverse proxy terminating TLS (the user guide covers nginx + Let's Encrypt). Persistent data resides on a dedicated EBS volume you can encrypt with EBS encryption at rest and resize independently of the root volume.

## Security Posture

• No default administrator - the shipped image has no working admin/admin login; a unique password is generated per instance on first boot
• redis binds only to loopback
• Data volume supports EBS encryption at rest
• Ready for TLS termination via a reverse proxy - supply your certificate or use AWS Certificate Manager with a load balancer

## Getting Started

1. Launch the AMI on a supported instance (m5.large or larger recommended)

2. Open port 3000 (and 22 for SSH) in your security group

3. Retrieve the first-boot administrator password from /root/ntopng-credentials.txt over SSH

4. Browse to http://:3000/ and sign in as admin with that password

5. Explore hosts and flows; point flow exporters at the instance to aggregate network-wide traffic

## cloudimg Support

24/7 technical support by email and live chat covers deployment, upgrades, reverse-proxy and TLS termination, and flow-collector integration. Critical issues receive a one-hour average response.

This is a repackaged open source software product with additional charges for cloudimg support services. ntopng is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.