Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been trying to use ntop at my organization for a while and have had nothing but problems with it. The system I run it on is a fairly vanilla Redhat 5 system (Sun X4140) and ntop seems to run for a couple of days and then crashes. We've had to script automatic restarts of ntop, but when the crashes combine with the fact that ntop doesn't persist most of its metrics it becomes a dealbreaker for us.

What are the big competitors for ntop? I've played with a few of the other open source tools, and most seem to not match the features (and the majority seem to have not been updated in a long time). Are there any commercial replacements for ntop, or even hardware devices that can provide the same functionality?

share|improve this question
add comment

2 Answers 2

You can use an RMON2 probe and setup your switch to mirror all the traffic to some (free) port. This can be done in hardware or software (appliance/roll your own). This way you see what's really happening across your whole network, not only locally. Different approach than ntop, but may help anyways.

share|improve this answer
    
I'm currently using ntop on a trunk switch mirror port, so that's already there but do you have relevant links to RMON2 probes? Is that a standard that some software implements, or is that the actual tools name? –  Luke Jan 14 '10 at 15:20
    
You could buy one of Cisco's NetFlow devices, or just compile the RMON2 MIBs and roll your own thing with net-snmp on RHEL. There should be some vendors selling dedicated "RMON probes" for good bucks. –  pfo Jan 14 '10 at 15:51
add comment

I went with a combination of fprobe, nfdump, and nfsen -- mostly because ntop didn't give me the information I wanted. My issue seemed to be that the quantity of traffic overwhelmed ntop, with the result that the web interface would generate garbage links into itself that didn't work.

share|improve this answer
    
Would you mind sharing the details of that configuration with the public? I'm personally quite interested on how you deployed this. –  Seanny123 Aug 15 '12 at 4:17
    
Always happy to, see the details on wiki.xdroop.com/space/Linux/Installing+nfsen –  David Mackintosh Aug 20 '12 at 15:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.