Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having some trouble understanding the output of Ntop.

I'm receiving high bandwidth warnings for one my (debian) servers from my network provider. Because the server runs only a few low traffic sites, and I couldn't find anything being too busy, I have installed NTOP.

In Ntop I can see there is some weird traffic going on but it is hard too understand.

  • On trafficStats -> application protocols, I have a high 10gb of Mail_POP traffic. I don't use POP on the server though. Only HTTPS/HTTP and SSH are open.

  • On trafficStats -> eth0 report, I find this 10gb under "non-ip traffic", with only 1gb ip traffic.

  • On hosts -> traffic, Only the server itself has a little traffic 1.5 gb but the 10gb Mail_POP traffic does not show anywhere.

  • Ntop uptime is 6 days but the server itself is first seen yesterday.

Can anyone help to understand these readings? What is Mail_POP What could be causing the high traffic spikes? Do I need to provide more information?

share|improve this question

Your "huge amounts of Mail_POP traffic" issue is probably related to a bug the existed in some old (circa early-2012) releases of ntop. It was mistakenly categorising HTTPS traffic as POP.

There's a discussion that touches on it here..

Moreover, port 443 is mapped to POP rather than HTTPS..

And some mention of it here too..

.. there was a report back in March of HTTPS traffic being classified as mail_POP.

Can't shed any light on your other issues but my experience with ntop so far indicates it can generally be a bit flaky.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.