How to Monitor Network Traffic with ntopng and Vigilmon

Network traffic monitoring is one of those disciplines that seems optional — right up until a DDoS attack saturates your uplink, a misbehaving internal host floods your switches, or a compromised server starts exfiltrating data at 3 AM. ntopng is an open-source network traffic analysis tool that gives you deep visibility into flows, protocols, and hosts on your network. Combined with Vigilmon for external uptime checks and alerting, you get a complete picture: ntopng watches what's happening inside the network, Vigilmon confirms that your services are reachable from the outside.

This tutorial walks you through deploying ntopng, configuring it to monitor your network interfaces, and integrating it with Vigilmon for proactive alerting on service degradation.

Why network traffic monitoring matters

Most infrastructure teams monitor CPU, memory, and disk — but network traffic is often the earliest signal of a problem:

• Bandwidth saturation — a single host consuming 90% of your uplink degrades every service behind it
• Unusual outbound connections — compromised hosts reach out to command-and-control servers; ntopng catches these flows
• Protocol anomalies — unexpected DNS query spikes, ARP floods, or ICMP storms indicate misconfigurations or attacks
• Service connectivity — knowing a service's traffic dropped to zero is often faster than waiting for a health check to time out

ntopng runs as a daemon on any Linux host with access to a network interface (physical, virtual, or a mirror/SPAN port), and exposes a web UI and REST API for querying traffic data.

What you'll need

• A Linux host (Ubuntu 22.04 or Debian 12 recommended) with root access
• Network interface access — either the server's own interface or a mirrored port from a managed switch
• A free Vigilmon account

Step 1: Install ntopng

ntopng is maintained by ntop and available from their official package repository.

# Add the ntop repository
wget https://packages.ntop.org/apt/24.04/all/apt-ntop-stable.deb
apt install ./apt-ntop-stable.deb

# Update and install
apt update
apt install ntopng

On CentOS/RHEL:

yum install https://packages.ntop.org/centos8/x86_64/ntopng-stable-repo.rpm
yum install ntopng

After installation, verify the service is available:

ntopng --version

Step 2: Configure ntopng

ntopng's configuration file lives at /etc/ntopng/ntopng.conf. Here's a production-ready starting configuration:

# /etc/ntopng/ntopng.conf

# Interface to monitor — use your primary interface
-i=eth0

# Web UI port
-w=3000

# Data directory
-d=/var/lib/ntopng

# Enable local network definition (adjust to your subnet)
-m=192.168.1.0/24,10.0.0.0/8

# Redis connection for caching (ntopng uses Redis for flow storage)
-r=@127.0.0.1

# Log level (0=error, 6=debug)
-l=4

# Disable telemetry
--dont-change-user

Install Redis if not already present:

apt install redis-server
systemctl enable redis-server
systemctl start redis-server

Start ntopng:

systemctl enable ntopng
systemctl start ntopng

Access the web UI at http://your-server:3000. Default credentials are admin / admin — change these immediately.

Step 3: Monitor specific interfaces and flows

ntopng can monitor multiple interfaces simultaneously. For a server with both a public-facing and private interface:

# Monitor both interfaces
-i=eth0
-i=eth1

For monitoring traffic from a managed switch (SPAN/mirror port), configure ntopng to listen on a dedicated capture interface:

# Create a dedicated capture interface (no IP needed)
ip link set eth2 up
ip link set eth2 promisc on

Then add -i=eth2 to your ntopng config.

Setting up flow export with nProbe

For high-traffic environments (>1 Gbps), use nProbe to export NetFlow/IPFIX records to ntopng rather than capturing packets directly:

apt install nprobe

# Export flows from eth0 to ntopng
nprobe -i eth0 -n none --zmq "tcp://*:5556" -b 2

Add the ZMQ source to ntopng:

-i=tcp://127.0.0.1:5556

This decouples packet capture from analysis and scales to multi-gigabit traffic.

Step 4: Configure alerts in ntopng

ntopng has a built-in alert engine. Navigate to Alerts → Alert Configurations in the web UI to set up threshold-based alerting:

Threshold alerts worth configuring:

| Alert | Condition | Recommended threshold | |-------|-----------|----------------------| | Bandwidth | Host sends > N Mbps | 80% of uplink capacity | | Flows | Host opens > N flows/min | 10,000 flows/min | | DNS | DNS queries per second | > 1,000 qps from single host | | Port scan | Host probes > N hosts | > 50 unique IPs in 60s | | Blacklisted host | Any communication | Always on |

Configuring webhook alerts

ntopng Enterprise supports webhooks natively. For the community edition, use the script-based alert endpoint:

# /etc/ntopng/alert_webhook.sh
#!/bin/bash
# ntopng calls this script with alert data via stdin
ALERT_DATA=$(cat)
curl -s -X POST https://your-webhook-endpoint/alerts \
  -H "Content-Type: application/json" \
  -d "$ALERT_DATA"

Configure the endpoint in ntopng under Preferences → Notifications.

Step 5: Expose a health endpoint for external monitoring

ntopng exposes a REST API that you can use as a health check target for Vigilmon:

# Test the API (requires authentication)
curl -u admin:your-password http://localhost:3000/lua/rest/v2/get/ntopng/info.lua

Expected response:

{
  "rc": 0,
  "rc_str": "OK",
  "rsp": {
    "version": "6.x",
    "uptime": 86400,
    "packets_processed": 1234567
  }
}

A non-zero rc value indicates ntopng has encountered an error. Wrap this in a thin health proxy if you want to expose it without credentials:

# health_proxy.py — Flask wrapper for ntopng health
from flask import Flask, jsonify
import requests

app = Flask(__name__)

NTOPNG_URL = "http://localhost:3000"
NTOPNG_AUTH = ("admin", "your-password")

@app.route("/health")
def health():
    try:
        r = requests.get(
            f"{NTOPNG_URL}/lua/rest/v2/get/ntopng/info.lua",
            auth=NTOPNG_AUTH,
            timeout=5
        )
        data = r.json()
        if data.get("rc") == 0:
            return jsonify({"status": "ok", "ntopng": "up"}), 200
        return jsonify({"status": "error", "detail": data}), 503
    except Exception as e:
        return jsonify({"status": "error", "detail": str(e)}), 503

if __name__ == "__main__":
    app.run(host="0.0.0.0", port=9090)

Run it as a systemd service and expose it on port 9090.

Step 6: Integrate with Vigilmon

Now you have a health endpoint Vigilmon can probe. Set up monitors for ntopng and for the services ntopng is protecting.

Monitor 1: ntopng health endpoint

1. Log in to vigilmon.online and go to Monitors → New Monitor
2. Choose HTTP / HTTPS
3. URL: https://your-server.example.com:9090/health
4. Expected status code: 200
5. Check interval: 1 minute
6. Save the monitor

If ntopng crashes or the health proxy goes down, you'll get an alert within 60 seconds.

Monitor 2: ntopng web UI availability

Monitor the web interface itself so you know when the dashboard goes unreachable:

1. New Monitor → HTTP / HTTPS
2. URL: http://your-server.example.com:3000
3. Expected status code: 200
4. Save

Monitor 3: TCP port check on the capture host

Type: TCP Port
Host: your-server.example.com
Port: 3000

This confirms the port is reachable even if the HTTP response starts returning errors.

Set up alert channels

1. Go to Alert Channels → Add Channel
2. Configure a Slack webhook, email, or PagerDuty integration
3. Assign channels to all three monitors

Step 7: Build a dashboard combining ntopng and Vigilmon data

For a unified operational view, use Grafana with two data sources:

ntopng data via InfluxDB export:

ntopng can export time-series data to InfluxDB:

# Add to ntopng.conf
--influxdb=http://localhost:8086;ntopng;admin;password

Vigilmon data via API:

Pull uptime metrics from the Vigilmon API and push to InfluxDB:

import requests
import time
from influxdb_client import InfluxDBClient, Point

VIGILMON_API_KEY = "your-api-key"
INFLUX_URL = "http://localhost:8086"

def sync_vigilmon_to_influx():
    monitors = requests.get(
        "https://vigilmon.online/api/v1/monitors",
        headers={"Authorization": f"Bearer {VIGILMON_API_KEY}"}
    ).json()
    
    client = InfluxDBClient(url=INFLUX_URL, token="your-influx-token", org="your-org")
    write_api = client.write_api()
    
    for monitor in monitors["data"]:
        point = (
            Point("uptime")
            .tag("monitor", monitor["name"])
            .field("up", 1 if monitor["status"] == "up" else 0)
            .field("response_time_ms", monitor.get("last_response_time_ms", 0))
        )
        write_api.write(bucket="vigilmon", record=point)

while True:
    sync_vigilmon_to_influx()
    time.sleep(60)

With both data sources in Grafana, you can correlate ntopng's bandwidth spikes with Vigilmon's response time increases — a bandwidth spike that corresponds to response time degradation points directly to a congestion event.

Step 8: Create a public status page

If ntopng is protecting a set of externally-accessible services, create a public status page in Vigilmon:

1. Status Pages → New Status Page
2. Add all your service monitors (not the ntopng internal monitors)
3. Give it a name your users will recognize
4. Publish and share the URL

This separates your operational monitoring (ntopng + Vigilmon internals) from your customer-facing transparency (the public status page).

Common ntopng operational issues

ntopng not seeing traffic:

• Verify the interface is in promiscuous mode: ip link show eth0 | grep PROMISC
• Check that Redis is running: systemctl status redis-server
• Look at ntopng logs: journalctl -u ntopng -f

High memory usage:

• ntopng uses memory proportional to active flows; reduce retention with --max-num-flows=100000
• Use nProbe for packet capture and let ntopng process only exported flows

Web UI unreachable:

• Check the firewall: ufw allow 3000/tcp
• Verify ntopng is bound to the right address: ss -tlnp | grep 3000

Redis connection errors:

• Confirm Redis is listening: redis-cli ping should return PONG
• Check Redis socket permissions if using a Unix socket

Summary

You've deployed ntopng to capture and analyze network traffic, configured threshold-based alerts for bandwidth and anomalous flow patterns, exposed a health endpoint, and integrated everything with Vigilmon for external uptime monitoring and alerting.

The combination gives you two complementary monitoring layers: ntopng sees traffic patterns at the packet and flow level from inside the network; Vigilmon confirms your services are reachable and responsive from the outside world. When something goes wrong, you'll have both the alert and the traffic context to diagnose it fast.

Start with a free Vigilmon account and get your first monitor running in under two minutes.