NTopng主要特性
多協(xié)議網(wǎng)絡(luò)流量；IPv4/IPv6活躍主機(jī)
網(wǎng)絡(luò)流量監(jiān)控（RRD存儲(chǔ)格式）；基于nDPI實(shí)現(xiàn)應(yīng)用協(xié)議發(fā)現(xiàn)
作為?NetFlow/sFlow? 采集器?(Cisco/ Juniper 路由器) ?；交換機(jī)配合?nProbe.
效果圖
Ntopng 架構(gòu)圖
Libpcap
網(wǎng)絡(luò)數(shù)據(jù)包捕獲函數(shù)包
Sqlite
輕型數(shù)據(jù)庫，多語言支持（ntopng中應(yīng)該是和python結(jié)合），很多嵌入式系統(tǒng)也用到它
Gdbm：DBM的GNU版本，使用hash存儲(chǔ)非結(jié)構(gòu)化數(shù)據(jù)
?Python
autoconf、automake、pkg-config、libtool（提供通用的庫編譯支持）
Gettext、icu4c：國際化(I18N)和本地化(L10N)，多語言支持
libffi：“FFI” 的全名是 Foreign Function Interface，通常指的是允許以一種語言編寫的代碼調(diào)用另一種語言的代碼。而 “Libffi” 庫只提供了最底層的、與架構(gòu)相關(guān)的、完整的”FFI”，因此在它之上必須有一層來負(fù)責(zé)管理兩種語言之間參數(shù)的格式轉(zhuǎn)換
Gobject-introspection：（簡(jiǎn)稱 GI）用于產(chǎn)生與解析 C 程序庫 API 元信息，以便于動(dòng)態(tài)語言（或托管語言）綁定基于 C + GObject 的程序庫
json-glib、json-c、openssl、glib
ZeroMQ
號(hào)稱最快的消息庫，協(xié)議級(jí)，目標(biāo)是成為L(zhǎng)inux的一部分。
libtasn1：用于開發(fā) ASN.1 (Abstract Syntax Notation One) 結(jié)構(gòu)管理的 C 庫
gmp
Nettle：a low-level cryptographic library （加密）
Gnutls：（加密）
libpng：the official PNG reference library （圖形）
pixman：像素管理（圖形）
Cairo：a2Dgraphicslibrarywithsupportformultipleoutputdevices.
Freetype：FreeType庫是一個(gè)完全免費(fèi)（開源）的、高質(zhì)量的且可移植的字體引擎，它提供統(tǒng)一的接口來訪問多種字體格式文件，包括TrueType,OpenType, Type1, CID,CFF, Windows FON/FNT, X11 PCF等
fontconfig：字體庫管理
Pango
Pango（Παν語）是一個(gè)開放源代碼的自由函數(shù)庫，用于高質(zhì)量地渲染國際化的文字。Pango可以使用不同的后端字體，并提供了跨平臺(tái)支持。依賴Harfbuzz ：一個(gè)開源的text opentype layout 引擎。
RRDtool
源自MRTG（多路由器流量繪圖器）。MRTG是有一個(gè)大學(xué)連接到互聯(lián)網(wǎng)鏈路的使用率的小腳本開始的。MRTG后來被當(dāng)作繪制其他數(shù)據(jù)源的工具使用，包括溫度、速度、電壓、輸出量等等。
luajit
C語言寫的Lua的解釋器
Geoip：IP GIS圖形
Redis
Redis是一個(gè)開源的使用ANSIC語言編寫、支持網(wǎng)絡(luò)、可基于內(nèi)存亦可持久化的日志型、Key-Value數(shù)據(jù)庫，并提供多種語言的API。Ntopng的Redis數(shù)據(jù)結(jié)構(gòu)如下：
Brew快速安裝
yanruideMacBook-Pro:~ yanrui$ ruby -v
ruby 2.0.0p481 (2014-05-08 revision 45883) [universal.x86_64-darwin14]
yanruideMacBook-Pro:~ yanrui$ ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
==> This script will install:
/usr/local/bin/brew
/usr/local/Library/...
/usr/local/share/man/man1/brew.1
Press RETURN to continue or any other key to abort
==> Downloading and installing Homebrew...
remote: Counting objects: 237423, done.
remote: Compressing objects: 100% (1040/1040), done.
remote: Total 237423 (delta 711), reused 0 (delta 0), pack-reused 236381
Receiving objects: 100% (237423/237423), 32.52 MiB | 1.01 MiB/s, done.
Resolving deltas: 100% (176649/176649), done.
From https://github.com/Homebrew/homebrew
* [new branch] ? ? ?master ? ? -> origin/master
HEAD is now at 0faf905 Return early for the == case in Version#<=>
==> Installation successful!
==> Next steps
Run `brew doctor` before you install anything
Run `brew help` to get started
yanruideMacBook-Pro:~ yanrui$brew install ntopng
cairo: XQuartz is required to install this formula.
You can install with Homebrew Cask:
brew install Caskroom/cask/xquartz
You can download from:
https://xquartz.macosforge.org
pango: XQuartz is required to install this formula.
You can install with Homebrew Cask:
brew install Caskroom/cask/xquartz
You can download from:
https://xquartz.macosforge.org
Error: Unsatisified requirements failed this build.
yanruideMacBook-Pro:~ yanrui$ brew install Caskroom/cask/xquartz
Cloning into '/usr/local/Library/Taps/caskroom/homebrew-cask'...
remote: Counting objects: 128670, done.
remote: Compressing objects: 100% (12/12), done.
remote: Total 128670 (delta 4), reused 0 (delta 0), pack-reused 128658
Receiving objects: 100% (128670/128670), 37.17 MiB | 6.00 KiB/s, done.
Resolving deltas: 100% (85113/85113), done.
Checking connectivity... done.
Ntopng 服務(wù)啟動(dòng)
yanruideMacBook-Pro:~ yanrui$ sudo ntopng
19/Mar/2015 11:51:40 [Ntop.cpp:586] Setting local networks to 192.168.1.0/24,0.0.0.0/32,224.0.0.0/8,239.0.0.0/8,255.255.255.255/32,127.0.0.0/8
19/Mar/2015 11:51:40 [Redis.cpp:74] Successfully connected to Redis 127.0.0.1:6379
19/Mar/2015 11:51:40 [PcapInterface.cpp:81] Reading packets from interface en0...
19/Mar/2015 11:51:40 [Ntop.cpp:710] Registered interface en0 [id: 0]
19/Mar/2015 11:51:40 [PcapInterface.cpp:81] Reading packets from interface awdl0...
19/Mar/2015 11:51:40 [Ntop.cpp:710] Registered interface awdl0 [id: 1]
19/Mar/2015 11:51:40 [PcapInterface.cpp:81] Reading packets from interface en1...
19/Mar/2015 11:51:40 [Ntop.cpp:710] Registered interface en1 [id: 2]
19/Mar/2015 11:51:40 [PcapInterface.cpp:81] Reading packets from interface en2...
19/Mar/2015 11:51:40 [Ntop.cpp:710] Registered interface en2 [id: 3]
19/Mar/2015 11:51:40 [PcapInterface.cpp:81] Reading packets from interface p2p0...
19/Mar/2015 11:51:40 [Ntop.cpp:710] Registered interface p2p0 [id: 4]
19/Mar/2015 11:51:40 [PcapInterface.cpp:81] Reading packets from interface lo0...
19/Mar/2015 11:51:40 [Ntop.cpp:710] Registered interface lo0 [id: 5]
19/Mar/2015 11:51:40 [Utils.cpp:251] User changed to nobody
19/Mar/2015 11:51:40 [main.cpp:184] PID stored in file /var/tmp/ntopng.pid
19/Mar/2015 11:51:40 [HTTPserver.cpp:392] HTTP server listening on port 3000
P2P演示案例
演示案例：
A－>B通過QQ傳遞一個(gè)文件，在B端開啟監(jiān)測(cè)服務(wù)。
在NTopng WEB 控制臺(tái)可以實(shí)時(shí)觀測(cè)到B端主機(jī)的當(dāng)前流量變化、目標(biāo)IP地址、協(xié)議等。
歡迎交流指正！
預(yù)備話題
以下話題構(gòu)思準(zhǔn)備中，請(qǐng)關(guān)注
1.NTop在服務(wù)器集群中的多點(diǎn)探測(cè)部署
2.插件：支持NetFlow
