Kiến Thức Linux

How to Monitor Network Traffic on Raspberry Pi

Introduction

Network monitoring is crucial for the Raspberry PI network’s security and stability. The process allows users to identify potential problems, such as slow performance or security breaches, and take corrective action.

This guide teaches you how to monitor network traffic on Raspberry Pi using Ntop and Darkstat.

How to Monitor Network Traffic on Raspberry Pi

Prerequisites

Note: Before installation, update and upgrade your system with sudo apt update && sudo apt upgrade.

Monitor Network Traffic Using Ntop

Ntop is a free and open-source network traffic monitoring tool. The utility tracks bandwidth usage, identifies bottlenecks, and monitors network performance and system health.

Ntop improves the performance and security of any network. The following text elaborates on how to set up Ntop in a Raspberry PI system.

Step 1: Download Ntop Package

Download the Ntop deb package for the Raspberry Pi from the official website. To accomplish this, use the wget command:

wget http://packages.ntop.org/RaspberryPI/apt-ntop.deb
Download Ntop package

Note: The official download links change over time. Make sure to check http://packages.ntop.org/ if the current link does not work.

Step 2: Install Ntop deb Package

To install the previously downloaded Ntop deb package, run the following: 

sudo apt install ./apt-ntop. deb
Ntop install package

After completing this step, update the repository once again:

sudo apt update
sudo apt update terminal output

Step 3: Install Additional Packages

Next, install additional packages which complement Ntop. Once installed, the packages provide:

  • Ntopng. This web-based monitoring application allows users to visualize and analyze network traffic data.
  • Nprobe. The network probe, which collects network traffic data from various sources.
  • n2n. The firewall bypassing tool.

To install the packages, run:

sudo apt install ntopng nprobe n2n
Install additional packages

Wait until the output shows the process is done.

Step 4: Configure Ntopng

After installing Ntopng, configure the program to use the correct network interface and port number. The process requires changing the Ntopng configuration file.

Note: Run ifconfig to verify the correct network interface.

To make changes in the Ntopng configuration file:

1. Open the Ntopng config file in a text editor of choice. This tutorial uses nano.

sudo nano /etc/ntopng/ntopng.conf
Access Ntop configuration file

2. Find and uncomment the following lines:

-i=eth1
-w=3000

3. Find the Interface section.

4. Change the -i section to match the interface name. For example, wlan0:

step 4 ntop configure ntop modify configuration file 1

If you use a different network interface, replace the wlan0 with the interface name you want to monitor.

5. Save and exit the file.

Step 5: Edit Network Interface and IP Range

Specify the IP range and the network interface that the Ntopng service will monitor. Edit the ntopng.start file to configure the parameters:

1. Open the ntopng.start file in a text editor:

sudo nano /etc/ntopng/ntopng.start

2. Add the following:

--local-networks "[your IP range]"

Add the IP range that is a part of your local network. This tells the tool how to differentiate between internal and external traffic and to provide information on the internal network traffic.

--interface ["your interface"]
Ntop config file adding lines

3. Save and exit the file.

Step 6: Start ntop

After performing the configuration step, start the Ntopng service on the Raspberry Pi. Run the following command:

sudo systemctl start ntopng
Starting Ntop

The command shows no output.

Step 7: Access the Web Interface

To access the Ntopng web interface:

1. Open any browser and type the address https://Pi-IP:3000 to open the Ntopng login page:

Ntop login screen

2. Type the default username and password as admin.

3. Click the Login button.

4. Change the default password.

5. Once logged in, click on the Dashboard icon and switch to Traffic Dashboard:

Switching to traffic dashboard

Now, monitor the network using the Ntop Traffic Dashboard.

Network interface

Monitor Network Traffic using Darkstat

Another option to monitor network traffic on Raspberry Pi is Darkstat. Darkstat is a lightweight, real-time network traffic monitoring tool that runs in the background on the Raspberry Pi.

The utility captures network traffic, calculates statistics, and provides a web interface for viewing the data in graphs. Darkstat also supports IPv6.

The following sections provide a step-by-step guide to installing Darkstat on the Raspberry Pi.

Step 1: Install Darkstat on Raspberry Pi

It’s easier to install Darkstat than Ntop since the Darkstat repository is already included in the official Raspberry Pi repository list.

To install Darkstat on Raspberry Pi, use the following command:

sudo apt install darkstat
Install Darkstat

Verify the installation is complete by checking the Darkstat version:

darkstat --version
Darkstat checking version

Step 2: Modify Darkstat Configuration

To change the Darkstat configuration file on Raspberry Pi, follow these steps:

1. Access the file using a text editor:

sudo nano /etc/darkstat/init.cfg

2. Find the following section:

START_DARKSTAT=no
Access Darkstat config file

3. Change no to yes.

Changing Darkstat config file

4. Find the INTERFACE section:

INTERFACE="-i [interface name]"
Finding Interface section in Darkstat config file

5. Change the interface name to the interface you want to monitor. For example, enter wlan0

Darkstat changing interface section in config file

Step 3: Restart Darkstat

To continue, run systemctl restart:

sudo systemctl restart darkstat

The command shows no output. 

Step 4: Verify the Darkstat is Running

The last part before accessing the Darkstat web interface is to verify the service is active. 

To do so, enter:

sudo systemctl status darkstat
Checking Darkstat status

The output shows the green active (running) status for the program.

Step 5: Access Darkstat Web Interface 

To access Darkstat, follow these steps:

1. Run the hostname command to find the Raspberry Pi IP address:

hostname -I
hostname -I terminal output

The local address in this example is 10.0.2.15.

2. Use the following syntax to access Darkstat:

http://[hostaddress]:667

Replace the [hostaddress] parameter with the Raspberry Pi IP address.

In this example, the address we used in a web browser is:

http://10.0.2.15.:667

The browser accesses Darkstat. The web interface shows the network traffic at different timings and ensures a successful Darkstat service setup on the Raspberry Pi device.

Darkstat web interface

Conclusion

After reading this article, you now know how to monitor traffic on Raspberry Pi.

Next, learn how to update your Raspberry Pi system.

Đăng ký liền tay Nhận Ngay Bài Mới

Subscribe ngay

Cám ơn bạn đã đăng ký !

Lỗi đăng ký !

Add Comment

Click here to post a comment

Đăng ký liền tay
Nhận Ngay Bài Mới

Subscribe ngay

Cám ơn bạn đã đăng ký !

Lỗi đăng ký !