mirror of
https://github.com/ntop/ntopng.git
synced 2026-05-01 00:19:33 +00:00
54 lines
1.8 KiB
Text
54 lines
1.8 KiB
Text
Using Divert with ntopng
|
|
------------------------
|
|
|
|
BSD-based operating systems (e.g. pfSense) use the divert interface to send
|
|
packets to user-space applications such as ntopng. This mechanism is based
|
|
on a socket interface, so that the communications happen on a local
|
|
predefined port where packets are received. User space applications such
|
|
as ntopng can read the traffic and reinject/drop/mark it.
|
|
|
|
Supposing that you want to use port 7777 for the divert mechanism,
|
|
all you need to do is divert traffic to it. Example:
|
|
|
|
#
|
|
# Preliminary checks
|
|
#
|
|
# http://www.cyberciti.biz/faq/howto-setup-freebsd-ipfw-firewall/
|
|
# vi /etc/rc.conf
|
|
# firewall_enable="YES"
|
|
# firewall_script="/usr/local/etc/ipfw.rules"
|
|
# ipdivert_load="YES"
|
|
#
|
|
#
|
|
# kldload ipdivert.ko
|
|
#
|
|
|
|
Traffic diversion is done by configuring the firewall to divert
|
|
packets matching certain rules. For example, to divert all
|
|
UDP/TCP/ICMP traffic on port 7777 and let the rest of the traffic
|
|
go through, the following rules can be used (and possibly added to
|
|
configuration file /usr/local/etc/ipfw.rules):
|
|
|
|
ipfw -f flush
|
|
ipfw add 410 divert 7777 udp from any to any via em0
|
|
ipfw add 411 divert 7777 tcp from any to any via em0
|
|
ipfw add 412 divert 7777 icmp from any to any via em0
|
|
ipfw add 1000 allow ip from any to any
|
|
|
|
Similarly, to divert only ICMP traffic one can use the following
|
|
rules:
|
|
|
|
ipfw -f flush
|
|
ipfw add 400 divert 7777 icmp from any to any
|
|
ipfw add 401 allow icmp from any to any
|
|
|
|
ntopng let diverted packets received go through. Diverted packets re-enter the
|
|
firewall at the rule number following the rule number that caused the
|
|
diversion. This is fundamental to avoid loops. In the case described
|
|
above, packets diverted at rule 410 will re-enter the firewall at rule
|
|
401 and so on.
|
|
|
|
Make sure you start ntopng as follows (ntopng will inspect the traffic and
|
|
let it go through)
|
|
|
|
# ntopng -i divert:7777
|