question about ntop [INACTIVE]

[fw_user]

Hi all,

Does anyone have success with ntop on BW? I am using BW 2.29 currently; I compiled the ntop on the 2.27 build tree; everything worked out fine and I can have the ntop run in the 2.27 build tree environment.

Then I copied the ntop and the related libraries to 2.29 BW. However, when I run the program, it gave me "segmentation error".

Can anyone give me some help? Thanks a lot.

Jiang

[fw_user]

Forgot to mention, I am using CentOS 3.7.

[Juanillo]

Download 2.29 build tree.

Regards

[fw_user]

Thanks, Juanillo.

Yes you are right. I downloaded the 2.29 build tree and re-compiled the ntop. Then copy the ntop and its libraries to the brazilFW box. And it is running!!

It is quite a learning experience. Maybe somebody else has similar problems, and here are the steps that I followed:

1. get 2.29 build tree and unzip to a linux box, in my case I am using centos 3.7;
2. download the necessary packages, which are:
a. freetype-2.1.10
b. gd-2.0.33, make sure "./configure --with-png"
c. gdbm-1.8.3
d. libart_lgpl-2.3.17
e. libpcap-0.9.5
f. libpng-1.2.14
g. rrdtool-1.2.15
h. ntop

3. go to the brazilFW build tree directory and run ./setlevel.sh

4. unzip each package; go to each directory, run "./configure; make; make install"

there may be some tweaks when compiling rrdtool and ntop; pay attention to the error reported by "./configure" and change the directory for specific libraries;

5. ldd ntop to find the library dependencies; create a tgz file based on that information; here is the tar command I use:

tar zcvf ntop.tgz /usr/local/lib/libntopreport-3.2.3 \
/usr/local/lib/libntop-3.2.3 /lib/libc.so.0 /lib/libuClibc-0.9.26.so \
/lib/libcrypt.so.0 /lib/libcrypt-0.9.26.so /usr/lib/libssl.so.0.9.7 \
/lib/libresolv.so.0 /lib/libresolv-0.9.26.so /lib/libnsl.so.0 \
/lib/libnsl-0.9.26.so /usr/local/lib/libgdbm.so.3* /usr/local/lib/libgd.so.2* \
/usr/local/rrdtool-1.2.15/lib/librrd_th.so.2* /lib/libpthread.so.0 \
/lib/libpthread-0.9.26.so /usr/local/lib/libfreetype.so.6* /usr/local/lib/libpng12.so.0* \
/usr/lib/libz.so /lib/libz.so.1* /usr/local/lib/libart_lgpl_2.so.2* \
/lib/libm.so.0 /lib/libm-0.9.26.so /lib/libdl.so.0 /lib/libdl-0.9.26.so \
/lib/ld-uClibc.so.0 /lib/ld-uClibc-0.9.26.so /usr/local/share/ntop /usr/local/bin/ntop \
/usr/local/etc/ntop/ /usr/local/lib/ntop /usr/local/var/ntop

6. now copy the ntop.tgz through scp to the brazilfw box and run it. If you are lucky enough, you will have it up and running!!

[nachazo]

give the thanks to CLaudio...

I was forget ntop long time ago because in previus versions of brazilfw it didn´t run....

But maybe you can post your results....

Ntop burn a lot of machine resources...

Wich machine are you using for run ntop?

regards.

[fw_user]

I am using a pentium 4 machine with 512 MB memory.

I do find a problem though: when I run the ntop (ntop -P /usr/local/var/ntop -u root), the ntop only captures the first couple of packets and then it stops reading/updating the web pages, i.e. it stays static no matter how many packets passing by.

I don't know what causes this problem. The BrazilFW box is set as a bridge and I am wondering whether that causes the problem.

Anyone has similar experience?

Thanks

[nachazo]

Maybe you need change the listen interface to br0...

regards.

[fw_user]

Yes the ntop is listening the br0. I compiled the ntop based on the same packages on a CentOS linux and tested the program. It worked fine.

On BrazilFW, when running the ntop, I can see that lots of packets are dropped by libpcap; and the ntop doesn't read any packets except the packets read in at the initialization.

Now I am thinking it might be related some setup in BrazilFW that caused the problem.

[nachazo]

maybe you need recompile libpcap

regards.

[fw_user]

Finally I got the ntop working on my BW box and here is what I learned:

1. use V3.2 source code from sourceforge.org; I have been playing with the CVS code but couldn't get it work; but by using the V3.2, I was able to get everything together.

2. follow the steps I listed in previous post.

That's it!

I can upload the ntop.tgz if anyone is interested in this ...

[ramindia]

Hi

iam also look
why dont u upload

Ram

[fw_user]

Can anyone tell me how to upload the ntop addon?

I browsed the website but didn't figure out how to do that.

[Claudio]

Marcelo - Brazil takes care of ftp accounts for add-ons developers. But he's on a vacation this week.

Just send it to me and i will upload to you.
Then, on next week you will have your own ftp account.

[fw_user]

Hi Claudio,

what is your email address?

Thanks

[Claudio]

Just click the e-mail button:

[Claudio]

I've uploaded ntop add-on to:

http://www.brazilfw.com.br/users/fw_user/ntop.tgz

There are some libs conflicts we need to solve.

[Claudio]

What a great tool!!!!!!

I just put ntop to work for the first time. Very Impressive.

There are a few adjusts we need to do:
- ntop.tgz fails to backup because there's no ntop.list file
- Brazilfw has some of that libs, then we might to remove a few.
- There are some libs conflicting widh another add-ons (libssl, libcrypt) maybe we need to build a separated package to them.
- ntop fails to start due lack of /usr/local/var/ntop folder. Just add it to the package.
- It would be nice if it auto-start. This is done creating a file called /etc/rc.d/pkgs/rc.ntop
- Can it run on background and not flood the console with messages?

Did you know the strip command?
Strip removes some free spaces from binaries and turns then a lot smaller

[fw_user]

Thanks for the testing and good points.

Yes, the backup is a problem. I did some modification to one of the scripts to enable that. You can specify the directory in which the ntop will be based on through "-P" option.

I will polish the addon recently to make it working smoothly.

This program still needs lots of work, and it has a big problem: after the ntop runs for couple of hours, it will crash, some kind of segmentation error. I haven't figured out the source yet. But I suspect that it is related to how the ntop takes logs.

So if anyone figures out what causes the crash, please let me know.

Thanks.

[nachazo]

the crash could be insufficient space, or a exesive work for the cpu so the kernel kill the daemon...

I have this behavior in debian distro with small pcs... You need a least a pentium 3 with 256 mb in ram to do the job...

Regards.

[fw_user]

I am using a P4 and 384MB memory machine to run the program.

Yes, insufficient space might be the case, if lots of logs are saved in the memory.

I am wondering if I can setup the syslog function to log to the hard drive instead of through network to other computers. This might tell me whether it is because of the space problem.

[nachazo]

This kind of softs needs be in the hd....

You can compole again settings the correct flags to put the program in /partition/ntop as the home directory...

Regards.

[Marcelo - Brazil]

fw_user,

Send me a desirre password to my e-mail or pm, ok ?
Account ready on 01/03/2007 5 pm.

[Marcelo - Brazil]

password sent by mp and e-mail.

[fw_user]

Got it. Thanks.