How to Install the ntopng Traffic Analysis Tool on Ubuntu Server

ntopng (ntop next generation) is a high-speed, web-based network traffic analysis and flow collection tool. It provides real-time monitoring of resource utilization, network flows, and active protocol behaviors. This guide demonstrates how to install and configure ntopng on an Ubuntu server, restrict unauthorized access, and interpret deep packet inspection (DPI) metrics.

ntopng Features

• Real-Time Monitoring: Intuitive web user interface showcasing live operational performance and network throughput statistics.
• Deep Packet Inspection (DPI): Advanced encrypted payload analysis utilizing the integrated nDPI engine wrapper.
• Application Protocol Detection: Native visibility for thousands of distinct application layers, protocols, and services.
• Security Auditing: TLS fingerprinting implementations to detect and analyze anomalous or malicious traffic arrays.
• Traffic Capture: Flexible recording configurations to store or replay structural packet streams.

Prerequisites

• An Ubuntu server. Because deep packet inspection is computationally intensive, a system with at least 4 CPU cores is recommended.
• Root or sudo administrative access.
• An active domain or subdomain with a configured DNS A record mapping to your server's IP address (required if configuring a reverse proxy).

Step 1: Install ntopng on Ubuntu Server

To acquire the latest upstream release package infrastructure, configure the vendor's stable package repository mirroring trees on your host:

sudo apt install software-properties-common wget
sudo add-apt-repository universe

# For compatible Ubuntu Server LTS environments, fetch the official repository target registry installer:
wget https://packages.ntop.org/apt-stable/all/apt-ntop-stable.deb
sudo apt install ./apt-ntop-stable.deb

Update your local indexing parameters and provision the required performance metrics monitoring and classification binaries:

sudo apt update
sudo apt install pfring-dkms ndpi nprobe ntopng n2disk cento

Verify that the underlying data ingestion engines and processing daemons have initialized successfully:

sudo systemctl status nprobe cento ntopng pf_ring

Note: If any dependent utility returns an inactive state, force a process renewal using sudo systemctl restart <service_name>.

By default, the web instance binds to network socket interface port 3000. Ensure your internal server firewall allows active connections on this port if accessing the interface directly via an IP address:

# For environments utilizing UFW
sudo ufw allow 3000/tcp

Step 2: Configure a Reverse Proxy

Deploying a reverse proxy isolates your analytical processes, routes traffic over a standard web interface, and streamlines your transport security layer configurations.

Option A: Nginx Proxy Configuration

Install the proxy engine package and generate a new site rule configuration map block:

sudo apt install nginx
sudo nano /etc/nginx/conf.d/ntopng.conf

Populate the file configuration space with the tracking parameters below, replacing ntopng.example.com with your target canonical domain mapping:

server {
      listen 80;
      listen [::]:80;
      server_name ntopng.example.com;

      access_log /var/log/nginx/ntopng.access;
      error_log /var/log/nginx/ntopng.error;

      location / {
          proxy_pass http://127.0.0.1:3000;
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_set_header X-Forwarded-Protocol $scheme;
          proxy_set_header X-Forwarded-Host $http_host;
      }
}

Validate the deployment logic syntax, then reload the engine properties daemon:

sudo nginx -t
sudo systemctl reload nginx

Option B: Apache Proxy Configuration

Install the web application container engine along with core HTTP extension module properties:

sudo apt install apache2
sudo a2enmod proxy proxy_http headers proxy_wstunnel

Generate a dedicated host definition path configuration file:

sudo nano /etc/apache2/sites-available/ntopng.conf

Populate the server parameters configuration tree, enabling proxy handlers for both standard request states and background websocket notification streams:

<VirtualHost *:80>
   ServerName ntopng.example.com
   ErrorDocument 404 /404.html

   ProxyPass / http://localhost:3000/
   ProxyPassReverse / http://localhost:3000/

   SSLProxyEngine on
   <Location /:/websockets/notifications>
        ProxyPass wss://localhost:3000/:/websockets/notifications
        ProxyPassReverse wss://localhost:3000/:/websockets/notifications
   </Location>

   Header always unset X-Frame-Options
</VirtualHost>

Register the site profile settings mapping layer and execute an application service cycle restart:

sudo a2ensite ntopng.conf
sudo systemctl restart apache2

Step 3: Enable HTTPS Transport Security

To encrypt authentication tokens and tracking dashboard visualization maps, automate an SSL/TLS deployment sequence via the Certbot Let's Encrypt client wrapper toolset:

sudo apt install certbot

# For Nginx Proxies
sudo apt install python3-certbot-nginx
sudo certbot --nginx --agree-tos --redirect --hsts --staple-ocsp --email [email protected] -d ntopng.example.com

# For Apache Proxies
sudo apt install python3-certbot-apache
sudo certbot --apache --agree-tos --redirect --hsts --staple-ocsp --email [email protected] -d ntopng.example.com

Traffic Flow Analysis and Protocol Classification

Access your analytics space via https://ntopng.example.com. Navigate to the Flows tab configuration panel and select your primary working network communication interface (e.g., eth0) to evaluate structural behaviors.

Deep Packet Inspection (nDPI Tracking Matrix)

ntopng integrates the open-source nDPI packet inspection utility toolkit, inspecting payloads past standard network header fields. This mechanism tracks and breaks down metadata states even within secure streams:

• TLS Header SNI Parsing: Accurately differentiates underlying web app origins (such as differentiating streaming networks from general enterprise application engines) by evaluating Server Name Indication data.
• VPN Inspection Resiliency: Pinpoints encapsulated connection layouts like WireGuard, OpenVPN, and IPSec. Standard HTTPS-based encapsulated configurations (like an OpenConnect protocol) map directly out as standard secure TLS streams, remaining concealed from deep packet blocking criteria.

Managing Policy Enforcement States (ntopng-edge)

While the standard community configuration allows for real-time traffic visualization and metric accumulation, active policy regulation and protocol throttling require an edge management utility configuration (ntopng-edge). Note that data telemetry analysis and edge policing engines cannot execute on the same target environment simultaneously.

To exchange tracking frameworks for policy enforcement states:

# Remove the tracking suite framework asset
sudo apt remove ntopng

# Install the policy enforcement toolkit variant from the vendor repository
sudo apt install nedge

Access the management console at interface port 3000, locate the Protocol Policies dashboard view, and configure structural operational parameters to limit or throttle unwanted traffic flows.