kk的blog: ntopng

顯示具有 ntopng 標籤的文章。顯示所有文章

2026/08/29

ntopng又發生更新後無法執行的情況

2026/07/13

昨天碰到的 ntopng 的問題

升到以下版本就解決了

2026/07/12

ntopng 更新又出包

早上 6:01 更新後就死了

2026-07-12T06:01:49+0800 INFO ================================================================================

Package Architecture Version Repository Size

================================================================================

Upgrading:

nprobe x86_64 11.0.260711-8713 ntop 4.8 M

ntop-license x86_64 1.0-724 ntop 668 k

ntopng x86_64 6.6.260711-28602 ntop 13 M

雖然 8:08有再出了一版更新但還是沒用

2026-07-12T08:08:23+0800 INFO ===============================================================================

Package Arch Version Repository Size

===============================================================================

Upgrading:

cento x86_64 2.4.260712-1173 ntop 1.6 M

n2disk x86_64 3.8.260712-5580 ntop 1.7 M

nprobe x86_64 11.0.260712-8715 ntop 4.9 M

ntap x86_64 1.2.260712-131 ntop 644 k

ntop-license x86_64 1.0-728 ntop 668 k

ntopng x86_64 6.6.260712-28602 ntop 13 M

ntopng-data noarch 6.6.260712-28602 ntop-noarch 60 M

這次的問題是daemon 活著

但 3000 沒 listen

先倒回備分再等几天看看吧

2026/06/24

先前 ntop的更新問題

今天看到新版 20260624

更新後就正常了

https://packages.ntop.org/centos-stable/9/x86_64/Packages/

2026/06/17

早上 ntopng 又起不來了

果然又是更新出包三不五時就來一下

https://packages.ntop.org/centos-stable/9/x86_64/Packages/

先倒回去等個几天吧

暫停更新

在 /etc/dnf/dnf.conf 加上

exclude=cento,n2disk,nprobe,ntap,ntop-license,ntopng,ntopng-data

2025/09/22

今天早上打開看ntopng時發現完全沒有資料

本來以為是mirror有問題

測試了一下

其他的几器使用tcpdump 去看都正常

唯獨這台完全捉不到封包

dmesg發現以下訊息

[ 4.618648] ------------[ cut here ]------------

[ 4.618940] WARNING: CPU: 3 PID: 671 at net/core/dev.c:603 dev_add_pack+0xaa/0xd0

[ 4.618954] Modules linked in: pf_ring(OE+) rfkill bochs drm_vram_helper drm_ttm_helper ttm drm_kms_helper pcspkr virtio_balloon i2c_piix4 joydev drm fuse xfs libcrc32c sr_mod cdrom sg ata_generic ata_piix libata crc32c_intel virtio_net net_failover virtio_blk failover serio_raw

[ 4.618969] CPU: 3 PID: 671 Comm: modprobe Tainted: G OE ------- --- 5.14.0-570.44.1.el9_6.x86_64 #1

[ 4.618971] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014

[ 4.618973] RIP: 0010:dev_add_pack+0xaa/0xd0

[ 4.618975] Code: c5 28 11 00 00 eb a0 48 8b 6f 28 48 85 ed 74 15 48 81 c5 18 11 00 00 48 85 d2 74 8b 48 8d aa a8 01 00 00 eb 82 48 85 d2 75 f2 <0f> 0b 5b 5d 41 5c 41 5d e9 99 b7 2b 00 66 c1 c0 08 83 e0 0f 48 c1

[ 4.618977] RSP: 0018:ffff983bc076fb58 EFLAGS: 00010246

[ 4.618979] RAX: 0000000000000300 RBX: ffffffffc0814da0 RCX: 0000000000000201

[ 4.618981] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffffc0814da0

[ 4.618981] RBP: 0000000000000000 R08: ffff983bc076fb00 R09: ffff8ae7c72b7860

[ 4.618982] R10: ffff8ae7c3c78540 R11: 000000000003a680 R12: 0000000000000000

[ 4.618983] R13: 00007f5329cd55ad R14: 000055d97d7be962 R15: ffff983bc076fc20

[ 4.618985] FS: 00007f532a75d740(0000) GS:ffff8ae8f7d80000(0000) knlGS:0000000000000000

[ 4.618986] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

[ 4.618987] CR2: 00007f5329cd4ff0 CR3: 0000000108956000 CR4: 00000000000006f0

[ 4.618992] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000

[ 4.618993] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

[ 4.618994] Call Trace:

[ 4.618996] <TASK>

[ 4.618998] ? show_trace_log_lvl+0x1c4/0x2df

[ 4.619003] ? show_trace_log_lvl+0x1c4/0x2df

[ 4.619006] ? __pfx_init_module+0x10/0x10 [pf_ring]

[ 4.619020] ? ring_init+0x29a/0xff0 [pf_ring]

[ 4.619030] ? dev_add_pack+0xaa/0xd0

[ 4.619031] ? __warn+0x7e/0xd0

[ 4.619035] ? dev_add_pack+0xaa/0xd0

[ 4.619037] ? report_bug+0x100/0x140

[ 4.619040] ? handle_bug+0x3c/0x70

[ 4.619043] ? exc_invalid_op+0x14/0x70

[ 4.619045] ? asm_exc_invalid_op+0x16/0x20

[ 4.619050] ? dev_add_pack+0xaa/0xd0

[ 4.619052] ? __pfx_init_module+0x10/0x10 [pf_ring]

[ 4.619062] ring_init+0x29a/0xff0 [pf_ring]

[ 4.619072] do_one_initcall+0x44/0x210

[ 4.619077] do_init_module+0x64/0x230

[ 4.619080] __do_sys_init_module+0x12e/0x1b0

[ 4.619084] do_syscall_64+0x5f/0xe0

[ 4.619086] ? syscall_exit_to_user_mode+0x19/0x40

[ 4.619088] ? do_syscall_64+0x6b/0xe0

[ 4.619090] ? netif_receive_skb_list_internal+0x1e4/0x300

[ 4.619094] ? napi_complete_done+0x6e/0x220

[ 4.619096] ? virtnet_poll+0x1fb/0x2d4 [virtio_net]

[ 4.619104] ? __napi_poll+0x2c/0x170

[ 4.619106] ? net_rx_action+0x29c/0x370

[ 4.619109] ? kvm_sched_clock_read+0xd/0x20

[ 4.619111] ? sched_clock+0xc/0x30

[ 4.619114] ? sched_clock_cpu+0xb/0x190

[ 4.619119] ? irqtime_account_irq+0x3c/0xb0

[ 4.619121] ? handle_softirqs+0x16b/0x270

[ 4.619125] ? __irq_exit_rcu+0x46/0xc0

[ 4.619127] ? common_interrupt+0x43/0xa0

[ 4.619129] entry_SYSCALL_64_after_hwframe+0x78/0x80

[ 4.619133] RIP: 0033:0x7f5329f0f51e

[ 4.619135] Code: 48 8b 0d fd 98 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 af 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ca 98 0e 00 f7 d8 64 89 01 48

[ 4.619137] RSP: 002b:00007ffe93d34038 EFLAGS: 00000246 ORIG_RAX: 00000000000000af

[ 4.619138] RAX: ffffffffffffffda RBX: 000055d97db21bb0 RCX: 00007f5329f0f51e

[ 4.619139] RDX: 000055d97d7be962 RSI: 000000000005e59d RDI: 00007f5329c77010

[ 4.619140] RBP: 00007f5329c77010 R08: 000055d97db21e40 R09: 0000000000000000

[ 4.619141] R10: 0000000000000005 R11: 0000000000000246 R12: 000055d97d7be962

[ 4.619142] R13: 000055d97db21d20 R14: 000055d97db21bb0 R15: 000055d97db21df0

[ 4.619144] </TASK>

[ 4.619144] ---[ end trace 0000000000000000 ]---

[ 4.619146] [PF_RING] pf_ring initialized correctly

[ 4.676410] dca service started, version 1.12.1

[ 4.683689] gnss: GNSS driver registered with major 240

knerlel 更新後 pf_ring 不能用了

只好先倒回去更新前的備分

倒回去後開几就正常了

再來就是先暫停kernel的更新

vi /etc/dnf/dnf.conf

在 [main] 加上 exclude=kernel*

如下

[main]
...

exclude=kernel*

之後再看看如果kernel沒問題再拿掉吧

2024/11/20

今天把ntopng換到 almalinux9

官方說明頁面的步驟是

dnf config-manager --set-enabled crb

dnf install epel-release

錯了

要先 dnf install epel-release

才能 dnf config-manager --set-enabled crb

安裝後進管理介面

一直出現這個訊息

必須在

/etc/ntopng/ntopng.conf

加上

-X=500000

數字依据現實狀況而定

順便改一下這二個值

-m=10.0.0.0/8,192.168.0.0/16

-i=eth1

https://packages.ntop.org/centos-stable/

2024/02/16

本日的ntopng 更新後又出現問題

看來是有新加了一個 ntop-license

這個套件需要新增 ntop 這個user

而這個user要在 ntop這個 group 裡

所以出現以下錯誤

useradd: group 'ntop' does not exist

手動加上 ntop 這個group

groupadd ntop

再跑一次 update 就 ok 了

2024/01/29

ntopng版本一直停在 20240111

今天去下手動更新出現以下訊息

ntopng : Depends: pfring (= 8.6.1-8861) but 8.6.1-8845 is to be installed

apt install pfing 又出現

pfring : Depends: ndpi (= 4.8.0-4603) but 4.8.0-4608 is to be installed

然後去網站上看 ndpi 的版本是 4.8.0-4603 沒錯

查一下是什麼時候更新的

2024-01-11 03:04:15 status installed ndpi:amd64 4.8.0-4608

因為這個是ntopng 自己的 apt source list

不知道是不是官方那天搞錯後又換回來

好吧換回舊版

apt install ndpi=4.8.0-4603

醬更新就沒問題了

2023/02/28

今天早上三點多開始收到ntopng的告警

進主几看了一下 process不見了

重開也沒用

看了一下log

ntopng果然有更新

更新後起不來

接下來看ntopng的log

發現本次更新後必須使用到 libbpf.so.0

Feb 28 08:09:17 W-ntopng-ubuntu-2004 ntopng[3247]: /usr/bin/ntopng: error while loading shared libraries: libbpf.so.0: cannot open shared object file: No such file or directory

Feb 28 08:09:22 W-ntopng-ubuntu-2004 ntopng[3272]: /usr/bin/ntopng: error while loading shared libraries: libbpf.so.0: cannot open shared object file: No such file or directory

Feb 28 08:09:28 W-ntopng-ubuntu-2004 ntopng[3294]: /usr/bin/ntopng: error while loading shared libraries: libbpf.so.0: cannot open shared object file: No such file or directory

apt install libbpf0

目前正常了再觀察看看

2023/02/13

今天早上要進ntop管理介面的時候

打完帳號密碼登不進去

進os看了一下HD滿了

然後再看log

出現一堆如下的訊息把HD塞爆了

Feb 13 08:14:29 W-ntopng ntopng[286]: 13/Feb/2023 08:14:29 [SQLiteAlertStore.cpp:151] ERROR: SQL Error: database disk image is malformed

Feb 13 08:14:29 W-ntopng ntopng[286]: INSERT INTO flow_alerts (alert_id, interface_id, tstamp, tstamp_end, severity, ip_version, cli_ip, srv_ip, cli_port, srv_port, vlan_id, is_cli_attacker, is_cli_victim, is_srv_attacker, is_srv_victim, proto, l7_proto, l7_master_proto, l7_cat, cli_name, srv_name, cli_country, srv_country, cli_blacklisted, srv_blacklisted, cli_location, srv_location, cli2srv_bytes, srv2cli_bytes, cli2srv_pkts, srv2cli_pkts, first_seen, community_id, score, flow_risk_bitmap, alerts_map, cli_host_pool_id, srv_host_pool_id, cli_network, srv_network, probe_ip, input_snmp, output_snmp, json, info) VALUES (26, 3, 1676247257, 1676247266, 3, 4, '192.168.40.66', '192.168.0.65', 44983, 80, 0, 0, 0, 0, 0, 6, 7, 0, 5, '', '', '', '', 0, 0, 0, 0, 126, 120, 2, 2, 1676247257, '1:rj5vzKw7WQX8TONTQ++bh3BkBh8=', 10, 70368744177664, X'04000000', 0, 0, 65535, 65535, '0.0.0.0', 0, 0, '{"ntopng.key":12345678,"hash_entry_id":23456789,"alert_generation": {"script_key":"ndpi_unidirectional_traffic","subdir":"flow","flow_risk_info":"{\"46\":\"No client to server traffic\"}"},"proto": {"http": {},"confidence":0}}', '');

google了一下是 sqllite 因為斷電導致有問題

果然

斷一次電事情一堆

看是有recovery sqlite的方法

算了

直接倒回事發前一天晚上的備分好了

倒回後目前正常

再觀察看看

https://blog.csdn.net/wolfking0608/article/details/71076588

2022/07/28

今天早ntop 更新出現以下問題應該是key 過期了

Failed to fetch https://packages.ntop.org/apt-stable/20.04/x64/InRelease The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 3D84C955924F7599

參考

https://packages.ntop.org/apt-stable/

重新下載再安裝一次

wget https://packages.ntop.org/apt-stable/20.04/all/apt-ntop-stable.deb

apt install ./apt-ntop-stable.deb

目前正常

再觀察看看

2020/12/11

使用yum update ntopng 時經常會出現因為相依性而無法安裝的情況

解決方法如下

先至官方網站手動下載rpm file

https://packages.ntop.org/centos/

wget https://packages.ntop.org/centos/7Server/x86_64/Packages/pfring-7.9.0-3294.x86_64.rpm

再來手動強制安裝

rpm -ivh --force --nodeps pfring-7.9.0-3294.x86_64.rpm

接下來手動強制移除舊的rpm

rpm -e pfring-7.8.0-3294.x86_64 --nodeps

再使用yum -y update

2019/03/28

ntopng有個 Alerts的功能
可以依需求把需要的Alerts打開
其中有一個

Probing Alerts

打開後可以針對

Suspicious TCP SYN Probing

留下記錄

本來想使用這個資訊來block

但跑了几天發現誤判實在太多

不可行

訂閱：文章 (Atom)