HowTo Geolocate ntop Data - Revision history

Paul Blankenbaker: /* Setting The ntop Host Collection Window Size */

2010-11-17T12:44:59Z

Setting The ntop Host Collection Window Size

← Older revision		Revision as of 08:44, 17 November 2010
Line 110:		Line 110:

	== '''Setting The ntop Host Collection Window Size''' ==		== '''Setting The ntop Host Collection Window Size''' ==
	There are preference settings in '''[http://www.ntop.org ntop]''' which allows for how long '''[http://www.ntop.org ntop]''' maintains information about a particular host prior to purging it from its internal buffers. These settings control how many hosts will be collected when the '''[http://nst.sourceforge.net/nst/docs/scripts/nstgeolocate.html nstgeolocate]''' script interrogates the '''[http://www.ntop.org ntop]''' session. This in turn will determine how many hosts get geolocated and rendered on a map. Generating a '''[[HowTo_Geolocate_ntop_Data#KML_Document \| KML Document]]''' takes ~~considerable amount of~~ more time to produce than ~~generating~~ a '''[[HowTo_Geolocate_ntop_Data#Mercator_World_Map \| Mercator World Map]]'''. One needs to tweak these parameters and tailor them to the type of network traffic being monitored so that excessive processing does not occur when geolocating to many hosts at one time. As a rule of thumb, for low volume traffic, open up the collection window size and for high volume traffic, be more conservative on the time interval for the collection window. When auto-generating a '''[[HowTo_Geolocate_ntop_Data#Mercator_World_Map \| Mercator World Map]]''', there are other controls that allow for host geolocation rendering to occur for a long duration (i.e., 1 day, 1 week, 1 month or a year). This allows one to maintain a short '''[http://www.ntop.org ntop]''' collection time window size and still generate a map using a long time period for host geolocations. See section '''[[HowTo_Geolocate_ntop_Data#Auto-Generated_ntop_Hosts_Geolocations \| Auto-Generated ntop Hosts Geolocations]]''' for details.		There are preference settings in '''[http://www.ntop.org ntop]''' which allows for how long '''[http://www.ntop.org ntop]''' maintains information about a particular host prior to purging it from its internal buffers. These settings control how many hosts will be collected when the '''[http://nst.sourceforge.net/nst/docs/scripts/nstgeolocate.html nstgeolocate]''' script interrogates the '''[http://www.ntop.org ntop]''' session. This in turn will determine how many hosts get geolocated and rendered on a map. Generating a '''[[HowTo_Geolocate_ntop_Data#KML_Document \| KML Document]]''' takes considerably more time to produce than a '''[[HowTo_Geolocate_ntop_Data#Mercator_World_Map \| Mercator World Map]]'''. One needs to tweak these parameters and tailor them to the type of network traffic being monitored so that excessive processing does not occur when geolocating too many hosts at one time. As a rule of thumb, for low volume traffic, open up the collection window size and for high volume traffic, be more conservative on the time interval for the collection window. When auto-generating a '''[[HowTo_Geolocate_ntop_Data#Mercator_World_Map \| Mercator World Map]]''', there are other controls that allow for host geolocation rendering to occur for a long duration (i.e., 1 day, 1 week, 1 month or a year). This allows one to maintain a short '''[http://www.ntop.org ntop]''' collection time window size and still generate a map using a long time period for host geolocations. See section '''[[HowTo_Geolocate_ntop_Data#Auto-Generated_ntop_Hosts_Geolocations \| Auto-Generated ntop Hosts Geolocations]]''' for details.

	Editing '''[http://www.ntop.org ntop]''' preference settings can be found using the menu shown below. You will need to log in as user: ''''admin'''' and then use the password for the NST ''''root'''' user. The '''[http://www.ntop.org ntop]''' ''''admin'''' password is set when the NST script: '''[http://nst.sourceforge.net/nst/docs/scripts/nstpasswd.html nstpasswd]''' is run.		Editing '''[http://www.ntop.org ntop]''' preference settings can be found using the menu shown below. You will need to log in as user: ''''admin'''' and then use the password for the NST ''''root'''' user. The '''[http://www.ntop.org ntop]''' ''''admin'''' password is set when the NST script: '''[http://nst.sourceforge.net/nst/docs/scripts/nstpasswd.html nstpasswd]''' is run.

Paul Blankenbaker: /* KML Document (Google Earth) */

2010-11-17T12:27:39Z

KML Document (Google Earth)

← Older revision		Revision as of 08:27, 17 November 2010
Line 101:		Line 101:
	\|}		\|}

	When using '''[http://earth.google.com Google Earth]''', ~~one~~ can ~~also~~ view the ''''Document Description'''' balloon by clicking on the generated '''[http://en.wikipedia.org/wiki/Keyhole_Markup_Language KML]''' '''ntop Hosts''' place found under '''Temporary Places''' within the sidebar on the left-hand side. You can also expand the '''ntop Hosts''' place to ''explore'' all geolocated hosts and associated network statistics.		When using '''[http://earth.google.com Google Earth]''', you can view the ''''Document Description'''' balloon by clicking on the generated '''[http://en.wikipedia.org/wiki/Keyhole_Markup_Language KML]''' '''ntop Hosts''' place found under '''Temporary Places''' within the sidebar on the left-hand side. You can also expand the '''ntop Hosts''' place to ''explore'' all geolocated hosts and associated network statistics.

	=== '''IP Geolocation Adjustments''' ===		=== '''IP Geolocation Adjustments''' ===

Paul Blankenbaker: /* KML Document (Google Earth) */

2010-11-17T12:22:39Z

KML Document (Google Earth)

← Older revision		Revision as of 08:22, 17 November 2010
Line 91:		Line 91:

	=== '''KML Document (Google Earth)''' ===		=== '''KML Document (Google Earth)''' ===
	Use the ''''ntop Hosts - KML'''' button to generate on demand '''Geolocated ntop Hosts''' rendered on a '''[http://en.wikipedia.org/wiki/Keyhole_Markup_Language KML]''' '''Earth Browser''' such as '''[http://earth.google.com Google Earth]'''. One can override the '''Map Annotation''' if necessary. Generating a '''[http://en.wikipedia.org/wiki/Keyhole_Markup_Language KML]''' document can take some time depending on the number of hosts to geolocate. We have observed that ~~to geolocate 1000 hosts,~~ it takes roughly ~~between 40 and~~ 50 seconds to ~~complete~~. Once the document has completed, you can view it in '''[http://earth.google.com Google Earth]''' (See the HowTo document: [[HowTo_Setup_Your_Client_System_To_View_Geolocation_Data \| HowTo Setup Your Client System To View Geolocation Data]]).		Use the ''''ntop Hosts - KML'''' button to generate on demand '''Geolocated ntop Hosts''' rendered on a '''[http://en.wikipedia.org/wiki/Keyhole_Markup_Language KML]''' '''Earth Browser''' such as '''[http://earth.google.com Google Earth]'''. One can override the '''Map Annotation''' if necessary. Generating a '''[http://en.wikipedia.org/wiki/Keyhole_Markup_Language KML]''' document can take some time depending on the number of hosts to geolocate. We have observed that it takes roughly 50 seconds to geolocate 1000 hosts. Once the document has completed, you can view it in '''[http://earth.google.com Google Earth]''' (See the HowTo document: [[HowTo_Setup_Your_Client_System_To_View_Geolocation_Data \| HowTo Setup Your Client System To View Geolocation Data]]).

	Each host that was geolocated appears as a host marker and contains a ''''Host Description'''' balloon depicting selective '''[http://www.ntop.org ntop]''' network traffic statistics ~~information~~. Click on a host marker to reveal the ''''Host Description'''' balloon. Hyperlinks are also provided to the '''[http://www.ntop.org ntop]''' (Host Collector) user interface and ~~to one or more~~ NST WUI ''''IP Tools'''' ~~pages~~ for additional network processing using the host's IP Address.		Each host that was geolocated appears as a host marker and contains a ''''Host Description'''' balloon depicting selective '''[http://www.ntop.org ntop]''' network traffic statistics. Click on a host marker to reveal the ''''Host Description'''' balloon. Hyperlinks are also provided to the '''[http://www.ntop.org ntop]''' (Host Collector) user interface and the NST WUI ''''IP Tools'''' page for additional network processing using the host's IP Address.

	{\|cellpadding="5"		{\|cellpadding="5"

Paul Blankenbaker: /* Mercator World Map */

2010-11-17T12:13:13Z

Mercator World Map

← Older revision		Revision as of 08:13, 17 November 2010
Line 76:		Line 76:
	[[Image:Ntop-progress-page.png\|center\|frame\|ntop Progress Generation Page]]		[[Image:Ntop-progress-page.png\|center\|frame\|ntop Progress Generation Page]]

	Once the process of geolocating and rendering hosts on the '''Mercator World Map''' has completed, the resultant map will be ~~shown in a new tab or browser window~~. The '''ntop World Map Hosts''' image shown below was produced using marker type: "'''star'''" with marker color: "'''blue'''".		Once the process of geolocating and rendering hosts on the '''Mercator World Map''' has completed, the resultant map will be displayed. The '''ntop World Map Hosts''' image shown below was produced using marker type: "'''star'''" with marker color: "'''blue'''".

	[[Image:Ntop-wm-hosts.png\|center\|frame\|ntop Mercator World Map Hosts]]		[[Image:Ntop-wm-hosts.png\|center\|frame\|ntop Mercator World Map Hosts]]
	Use the '''Image Control Button Grid''' located in the upper left-hand corner of the map to both position and resize the map projection. Hover your mouse pointer over the information icon to reveal a detailed ~~description~~ associated with the '''Geolocated ntop Hosts'''. The map below was zoomed in and ~~also is showing~~ the information tooltip ~~balloon~~.		Use the '''Image Control Button Grid''' located in the upper left-hand corner of the map to both position and resize the map projection. Hover your mouse pointer over the information icon to reveal a detailed summary report associated with the '''Geolocated ntop Hosts'''. The map below was zoomed in and shows the information tooltip.

	[[Image:Ntop-wm-hosts-tt.png\|center\|frame\|ntop Mercator World Map Hosts - Zoomed In with Information Tooltip Balloon]]		[[Image:Ntop-wm-hosts-tt.png\|center\|frame\|ntop Mercator World Map Hosts - Zoomed In with Information Tooltip Balloon]]

Paul Blankenbaker: /* Mercator World Map */

2010-11-17T12:09:52Z

Mercator World Map

← Older revision		Revision as of 08:09, 17 November 2010
Line 72:		Line 72:
	<div class="centerBlock"><div class="noteMessage">'''Note:''' One may need to allow pop-up window generation on your browser for the NST host so that the '''Progress Generation''' page can be displayed correctly.</div></div>		<div class="centerBlock"><div class="noteMessage">'''Note:''' One may need to allow pop-up window generation on your browser for the NST host so that the '''Progress Generation''' page can be displayed correctly.</div></div>

	You have some control while waiting for the map generation on the progress page. If you do nothing, the process will automatically leave the progress page and display the map. You can use the "'''Cancel'''" button to cancel the map generation and close the progress page. You can use the "'''Hold'''" button to prevent the automatic transition to the map display. This is useful if you would like to use the "'''View Generate Log'''" to see all commands and log output for geolocating '''ntop Hosts''' on the Mercator World Map projection.		You have some control while waiting for the map generation on the progress page. If you do nothing, the process will automatically leave the progress page and display the map. You can use the "'''Cancel'''" button to cancel the map generation and close the progress page. You can use the "'''Hold'''" button to prevent the automatic transition to the map display. This is useful if you would like to use the "'''View Generate Log'''" button to see all commands and log output for geolocating '''ntop Hosts''' on the Mercator World Map projection.

	[[Image:Ntop-progress-page.png\|center\|frame\|ntop Progress Generation Page]]		[[Image:Ntop-progress-page.png\|center\|frame\|ntop Progress Generation Page]]

Paul Blankenbaker: /* Mercator World Map */

2010-11-17T12:09:18Z

Mercator World Map

← Older revision		Revision as of 08:09, 17 November 2010
Line 72:		Line 72:
	<div class="centerBlock"><div class="noteMessage">'''Note:''' One may need to allow pop-up window generation on your browser for the NST host so that the '''Progress Generation''' page can be displayed correctly.</div></div>		<div class="centerBlock"><div class="noteMessage">'''Note:''' One may need to allow pop-up window generation on your browser for the NST host so that the '''Progress Generation''' page can be displayed correctly.</div></div>

	You have some control ~~during~~ the ~~generate process~~. If you do nothing, the process will automatically leave the progress page and display the map. You can use the "'''Cancel'''" button to cancel the map generation and close the progress page. You can use the "'''Hold'''" button to prevent the automatic transition to the map display. This is ~~usefule~~ if you would like to use the "'''View Generate Log'''" to see all commands and log output for geolocating '''ntop Hosts''' on the Mercator World Map projection.		You have some control while waiting for the map generation on the progress page. If you do nothing, the process will automatically leave the progress page and display the map. You can use the "'''Cancel'''" button to cancel the map generation and close the progress page. You can use the "'''Hold'''" button to prevent the automatic transition to the map display. This is useful if you would like to use the "'''View Generate Log'''" to see all commands and log output for geolocating '''ntop Hosts''' on the Mercator World Map projection.

	[[Image:Ntop-progress-page.png\|center\|frame\|ntop Progress Generation Page]]		[[Image:Ntop-progress-page.png\|center\|frame\|ntop Progress Generation Page]]

Paul Blankenbaker: /* Mercator World Map */

2010-11-17T12:07:32Z

Mercator World Map

← Older revision		Revision as of 08:07, 17 November 2010
Line 72:		Line 72:
	<div class="centerBlock"><div class="noteMessage">'''Note:''' One may need to allow pop-up window generation on your browser for the NST host so that the '''Progress Generation''' page can be displayed correctly.</div></div>		<div class="centerBlock"><div class="noteMessage">'''Note:''' One may need to allow pop-up window generation on your browser for the NST host so that the '''Progress Generation''' page can be displayed correctly.</div></div>

	~~One has~~ some control during the generate process ~~to "'''Hold'''"~~, "'''Cancel'''" or "'''~~Continue~~'''". ~~One can also~~ use the "'''View Generate Log'''" to see all commands and log output for geolocating '''ntop Hosts''' on the Mercator World Map projection.		You have some control during the generate process. If you do nothing, the process will automatically leave the progress page and display the map. You can use the "'''Cancel'''" button to cancel the map generation and close the progress page. You can use the "'''Hold'''" button to prevent the automatic transition to the map display. This is usefule if you would like to use the "'''View Generate Log'''" to see all commands and log output for geolocating '''ntop Hosts''' on the Mercator World Map projection.

	[[Image:Ntop-progress-page.png\|center\|frame\|ntop Progress Generation Page]]		[[Image:Ntop-progress-page.png\|center\|frame\|ntop Progress Generation Page]]

Paul Blankenbaker: /* Mercator World Map */

2010-11-17T12:01:17Z

Mercator World Map

← Older revision		Revision as of 08:01, 17 November 2010
Line 68:		Line 68:

	=== '''Mercator World Map''' ===		=== '''Mercator World Map''' ===
	Use the ''''ntop Hosts - World Map'''' button to generate on demand '''Geolocated ntop Hosts''' rendered on a '''Mercator World Map''' projection. ~~You~~ can customize the host geolocation marker type and color. One can also override the '''Map Annotation''' if necessary. The following '''Progress Generation''' page is displayed while the '''ntop Hosts''' are in the process of being geolocated and rendered on the '''Mercator World Map''' projection.		Use the ''''ntop Hosts - World Map'''' button to generate on demand '''Geolocated ntop Hosts''' rendered on a '''Mercator World Map''' projection. One can customize the host geolocation marker type and color. One can also override the '''Map Annotation''' if necessary. The following '''Progress Generation''' page is displayed while the '''ntop Hosts''' are in the process of being geolocated and rendered on the '''Mercator World Map''' projection.

	<div class="centerBlock"><div class="noteMessage">'''Note:''' One may need to allow pop-up window generation on your browser for the NST host so that the '''Progress Generation''' page can be displayed correctly.</div></div>		<div class="centerBlock"><div class="noteMessage">'''Note:''' One may need to allow pop-up window generation on your browser for the NST host so that the '''Progress Generation''' page can be displayed correctly.</div></div>

Paul Blankenbaker: /* ntop Options */

2010-11-17T11:46:11Z

ntop Options

← Older revision		Revision as of 07:46, 17 November 2010
Line 35:		Line 35:

	=== ntop Options ===		=== ntop Options ===
	The '''ntop Options''' field is used to specific additional '''[http://www.ntop.org ntop]''' parameters that are not provided automatically by the NST WUI '''ntop Setup Management''' interface (e.g., Add an option so that ''Idle'' hosts are not purged from memory and set the ''Refresh'' page time in seconds to 1 min: "'''--sticky-hosts --refresh-time 60'''"). For detailed ~~additional~~ '''[http://www.ntop.org ntop]''' options, expand the '''ntop Command Line Options''' section on this NST WUI page.		The '''ntop Options''' field is used to specific additional '''[http://www.ntop.org ntop]''' parameters that are not provided automatically by the NST WUI '''ntop Setup Management''' interface (e.g., Add an option so that ''Idle'' hosts are not purged from memory and set the ''Refresh'' page time in seconds to 1 min: "'''--sticky-hosts --refresh-time 60'''"). For detailed information about these '''[http://www.ntop.org ntop]''' options, expand the '''ntop Command Line Options''' section on this NST WUI page.

	=== ntop Annotation ===		=== ntop Annotation ===

Paul Blankenbaker: /* Setup ntop Options */

2010-11-17T11:43:15Z

Setup ntop Options

← Older revision		Revision as of 07:43, 17 November 2010
Line 30:		Line 30:

	=== Setup ntop Options ===		=== Setup ntop Options ===
	The script: "'''setup_ntop'''" is used to support the NST WUI by creating a runtime execution environment for '''[http://www.ntop.org ntop]''' and starting up the '''[http://www.ntop.org ntop]''' daemon. The '''Setup ntop Options''' field allows one to add setup and runtime options associated with the script: "'''setup_ntop'''". Normally, ~~other than specifying the~~ ''runtime'' directory: "'''--rdir /var/nst'''"~~, this field does not need to be altered~~. For detailed additional setup '''[http://www.ntop.org ntop]''' options, expand the '''Setup ntop Options''' section on this NST WUI page.		The script: "'''setup_ntop'''" is used to support the NST WUI by creating a runtime execution environment for '''[http://www.ntop.org ntop]''' and starting up the '''[http://www.ntop.org ntop]''' daemon. The '''Setup ntop Options''' field allows one to add setup and runtime options associated with the script: "'''setup_ntop'''". Normally this field does not need to be altered. If you do alter this field, make sure that you specify a ''runtime'' directory ("'''--rdir /var/nst'''" shown below). For detailed additional setup '''[http://www.ntop.org ntop]''' options, expand the '''Setup ntop Options''' section on this NST WUI page.

	[[Image:Ntop-setup.png\|center\|frame\|NST WUI ntop Setup Management]]		[[Image:Ntop-setup.png\|center\|frame\|NST WUI ntop Setup Management]]