OpenWrt Forum Archive

Topic: ntop on OpenWRT?

The content of this topic has been archived on 5 May 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Has anyone tried getting ntop to run successfully on OpenWRT, or would it be too heavy?

I'm running it on my desktop machine, but it would be much nicer to have it on the router, and monitor the traffic there, as it provides a lot of useful stats and information.

Before starting to mess with building my own package, I just wanted to ask if someone else has already though of or tried this, or if it would slow the router (an Archer C5 in my case) to a crawl.

fenris wrote:

Has anyone tried getting ntop to run successfully on OpenWRT, or would it be too heavy?

I'm running it on my desktop machine, but it would be much nicer to have it on the router, and monitor the traffic there, as it provides a lot of useful stats and information.

Before starting to mess with building my own package, I just wanted to ask if someone else has already though of or tried this, or if it would slow the router (an Archer C5 in my case) to a crawl.

It's certainly true that ntop would give you a ton of interesting info about what's happening on your network - who's sending traffic to whom, how much they're sending, who's hogging your WAN link, etc.

My glib answer is to go for it. The Archer C5 has a pretty capable CPU, it has plenty of RAM, and the amount of traffic (at your home?) will likely be pretty moderate. (Besides - what else does your router have to do except make you happy? :-)

richbhanover wrote:

It's certainly true that ntop would give you a ton of interesting info about what's happening on your network - who's sending traffic to whom, how much they're sending, who's hogging your WAN link, etc.

My glib answer is to go for it. The Archer C5 has a pretty capable CPU, it has plenty of RAM, and the amount of traffic (at your home?) will likely be pretty moderate. (Besides - what else does your router have to do except make you happy? :-)

Yes, it would be helpful to have it on the router. It would be a great way to get info on rogue apps on my Android devices who communicate with the outside, for instance. The statistics are also quite thorough.

What I'm a bit concerned about is that I'm intending to set up QoS, and probably also OpenVPN or StrongSwan. Together with ntop, this might be too much on a 50/10 link. Has anyone got any thoughts on this?

Also, if I *am* going to get ntop going on the router, it might not be too much extra work to just make a package for OpenWRT, so that others can easily use it also. I assume there is info on the wiki on how to do this. Frankly, I was a little surprised that there isn't already a package available since it seems it could obviously be useful, and assumed that was because it might be too heavy or have too many dependencies. Would there be any interest in getting a package for OpenWRT for anyone else, or would few/nobody be able to use it?

I do agree that the router is there to make me happy smile It's just that there is obviously a limit as to how much it can reasonably do, and it is hard to know how much of a load ntop would place on the router based on the load it places on my desktop machines.

Thoughts/advice/input?

One alternative is to run softflowd on the router and send the data to ntop running on an external server.

arokh wrote:

One alternative is to run softflowd on the router and send the data to ntop running on an external server.

Yes, there are a number of NetFlow exporters: softflowd, nprobe, fprobe that could send the traffic summaries to a NetFlow collector. (OP was asking whether to set up ntop as a NetFlow collector running on OpenWrt itself...)

But... I see both two "netflow collector" packages that are already in BB:

- flow-tools (https://code.google.com/p/flow-tools/)
- pmacctd (http://www.pmacct.net/)

Are either of these working/valuable/maintained?

The way I'm reading it he wants to run it on the router in order to see traffic from his Android devices as well (running it on his desktop doesn't allow that). Of course you could do that, but it would require packaging ntop for OpenWrt. Good luck with getting all the dependencies on there.

He's asking for advice/thoughts, and I'd say running a NetFlow collector on the router is all he needs. He's already got ntop on his desktop, just feed it data from the router and voila. softflowd is already packaged and available in the repos.

arokh wrote:

The way I'm reading it he wants to run it on the router in order to see traffic from his Android devices as well (running it on his desktop doesn't allow that). Of course you could do that, but it would require packaging ntop for OpenWrt. Good luck with getting all the dependencies on there.

He's asking for advice/thoughts, and I'd say running a NetFlow collector on the router is all he needs. He's already got ntop on his desktop, just feed it data from the router and voila. softflowd is already packaged and available in the repos.

Yeah, I'm starting to think getting the dependencies on the router is going to be too much of a hassle. I tried to set up softflowd to collect data for ntop running on the desktop, but haven't gotten them working together yet. Will try again later today.

It is probably the best way to do it, though, and I really appreciate the suggestion - I wasn't aware of it.

Thanks again.

This is odd.

I've managed to set up softflowd to collect data for ntop, but it seems ntop only gets a small fraction of the relevant data. There are no errors, so I would guess softflowd simply doesn't collect everything it should. Here's my config:

root@router:/etc/config# cat softflowd
config softflowd
    option enabled        '1'
    option interface      'br-lan'
    option pcap_file      ''
    option timeout        ''
    option max_flows      '8192'
    option host_port      '192.168.0.105:2055'
    option pid_file       '/var/run/softflowd.pid'
    option control_socket '/var/run/softflowd.ctl'
    option export_version '5'
    option hoplimit       ''
    option tracking_level 'full'
    option track_ipv6     '1'
    option sampling_rate  '100'

Is there anything obvious I'm missing? Sometimes it's a real shame that man pages aren't installed smile I've read the online docs, though, and can't see anything obvious.

Also, what's the difference between NetFlow and sFlow? Should I try something like hsflowd instead, and set up the sFlow plugin in ntop to collect from that?

I had the same issue, searched for an alternative and found ipcad in oldpackages. It compiles and runs fine, except there is no UCI and init script.

Here's my ipcad.conf:

interface "br-lan";
netflow export destination 1.2.3.4 2055;

Run it like this: ipcad -c /path/to/ipad.conf -d

It works great I can see all the flows in ntop.

The discussion might have continued from here.