NTOP Problem ?

Mikegyver42

Hello,

i have some trouble with Ntop 5.0.1 v2.4 since pFsense 2.1.2.
The ntop page works fine but when i go to IP, Summary, Traffic i could see all the ip in my network.
But if if clic on a IP to see the traffic of this IP the page don't show the informations, the page is not refresh, i've got only the turning flower.
I have the problem under IE and Firefox.

Do you have any idea to solve the problem ?

carloscape

I have the same issue. It happened when I updated to the latest firmware. All I can see is the webpage trying to load something from google.

humps

I'm having issues as well. Just Upgraded mine to version 5.0.1_1 v2.4 and it will not start. :(

ESPNSTI

Same here, NTOP 5.0.1_1 v2.4 on pfSense 2.1.3.
Most, if not all the functions seem to work except for getting details for an IP address.
If you click on a link for an IP address, it starts to load the detail page, but it never shows any information and the loading.gif spinning logo shows.
System activity doesn't show any elevated CPU usage, so I don't think it's actually doing much of anything when this happens.
The NTOP log doesn't show anything when this occurs.
The system log shows this during this time:

ntop[33731]: EPIPE while sending page to web client

I've uninstalled NTOP and installed it again, and except for setting a password and picking an interface, kept all the defaults.
However, that didn't fix it.

When loading the detail page with the developer console up in Firefox, I see one 404 error when querying sankey.py.
In the response I find this:


# Error 404

The server cannot find the requested page (page expired or ntop configuration ?).

Received request:

> <tt>"GET /python/sankey.py?maxhost=16&zoom=0&hostselected%5B%5D=10.x.x.10 HTTP/1.1"</tt>

Python support disabled into this ntop instance

I don't know if this is normal or not, can someone with a working NTOP check to see if they have this message?

I also see some 404s trying to get png files.

![NTOP details.gif](/public/imported_attachments/1/NTOP details.gif)
![NTOP details.gif_thumb](/public/imported_attachments/1/NTOP details.gif_thumb)

markn62

I have the same issue as Mike. Neither browser displays IP info now. Was working until the latest upgrade. Also, the "Host Map" displays nothing. And, not that it's much use, but the "Local, Network Trafffic Map" I thought resolved each block in the graph. Only resolution is on local devices, public devices only show MAC addy, no hostname. I'm fairly certain the last version did. I'm still not clear what is to be put in "google_maps.key". A server key, a browser key, Google Maps Embed API, Google Maps JavaScript API v3, or Google Static Maps API? Here I've been banging my head for hours thinking the API was the cause of individual IP info not displaying. Darn near wiped out my weekend.

markn62

Ver 2.1.2-Amd64.

Unless I'm using the wrong steps, it would appear the nTop settings, "ntop.maxNumHashEntries" & "ntop.maxNumSessions" aren't sticky. I can double their values in StartUp Options or Edit Preferences GUI then restart nTop & goto "About, Show Configuration" & it still reports;

-x…..8102
-X.....8192

I think these PfSense system log errors are due to the inability to upsize either the -x or -X parameter, more likely the -x.

ntop[56500]: ERROR Low memory @ ip.c:262
ntop[56500]: WARNING: Max num hash entries (8102) reached (see -x)

It appears that some preferences are fixed values at time of compiling so they're really not preferences at all. Best I can do is reduce the time that idle hosts are held, down to a very short time like 60 seconds. I don't have time to look much at what nTop shows before the link comes up empty reporting no info due to timeout. 3600 seconds would be nice but then I get the syslog errors above.

If I link down to the extensive configuration I see a header "Compile Time: globals-defines.h" that reports the sessions doubled in value but not the hash entries.

DEFAULT_NTOP_MAX_HASH_ENTRIES…..8192
DEFAULT_NTOP_MAX_NUM_SESSIONS.....32768

Am I way off base in my assessment? Can the nTop package be made to hold more hash entries, I have 8GB memory, using 1G.

ESPNSTI

"Host Map" works for me once I allow google.com and gstatic.com in the NoScript Firefox extension.
"Local, Network Trafffic Map" only shows ip/mac for public hosts, no names, but I use that so infrequently that I don't recall if it ever did.
I do not have the problem with reaching the max hash entries, but I normally don't have a lot of connections.

markn62

Don't want the NoScript FF extension as it is a whitelist taking more maintenance to use. Tried a blacklist plugin blocking java from the two url's you mentioned and no change. Keeps reporting something about checking that an html page is installed properly. Trying to get to that spinning screen until it times out but before nTop crashes to see that message verbatim is a challenge. So I paraphrase…

markn62

Looks like this problem has been around for a while.
https://forum.pfsense.org/index.php?topic=69658.0

humps

I've been checking this post every other day or so hoping someone would find a fix for the NTOP issues but no help/fix is coming.. Sigh! . . Its kinda SAD though cuz it seems we're left in the dark and the only solution is to uninstall NTOP and wait for the developers to release an updated version hoping it will fix things..

If anyone found a fix for the current issues i would really appreciate if you could post some feedback here
Thanks

markn62

I had to uninstall the nTop package. Can't make it stable. Keeps overrunning the max hash value causing errors even with idle host set to a short 30 seconds. CPU < 20%.

2.1.3-RELEASE (amd64)

denisalves

I'm having the same problem. The spinning logo stays forever and I can't see the info about the host. If I right-click at the host and save the HTML link to my computer, I'm able to see some infos, but with not a good interface. I'm waiting for a fix for this too :(

rahul6065

Hiii All,

I am facing the same problem. I have pfsense 2.1 amd 64 & ntop 5.0.1_1 v2.4 installed on it. but if I open that link on command line using elinks it opens e.g. elinks http://10.0.X.Y:3000/10.0.Y.Z.html. I tried all the browsers Chrome, Firefox, IE . All browser have the same issue.
I tried to install lower version .pbi using the link http://files.pfsense.org/packages/8/All/ with command line. It installs fine but after starting the ntop service I am unable to view some pi-charts. On every refresh pi-chart fluctuates. Any help please..

Thanks
Rahul

ESPNSTI

The new package 5.0.1 v2.5 did not resolve the "spinning logo on IP detail" problem for me.

humps

Ok Installed the new updated version of Ntop (5.0.1 v2.5) hoping that this version would fix the issues I have been having with the previous version (5.0.1_1 v2.4) but to my surprise everything remains the same.
I cannot connect to Ntop, each time i try to connect i get Time Out Error:
The connection has timed out
The server at 192.168.x.x is taking too long to respond.
I have never had any problem with Ntop before and i've been using it for 2yrs + but ever since I installed version 5.0.1_1 v2.4 it has become UNUSEABLE!
I have since UnInstalled Ntop, i still love this program and i will continue check for new versions until its fixed.
I'm running Pfsense 2.1.3 X64.
UPDATE: Someone posted a suggestion on a thread that I had started here: https://forum.pfsense.org/index.php?topic=76358.0

Ntop seems to be working fine for me again.
I've noticed with NTOP; when you reinstall/install, you have to select interfaces and enter the password again. Some reason the settings are not retained.

BeerCan

I am having the same issue. The ntop "info about" page only has a spinning flower and eventually 404's.
If I right click the host and save the link I can open it and view some info.

This seems like there may be some permission issue of the pfsense machine. It would be cool to see this fixed or ntopng made a package. I would be willing to add $25-50 to a bounty if anyone wanted to go in with me.

razblack

I too am still having some major problems with ntop and latest pfsense…

ntop[51381]: EPIPE while sending page to web client
ntop[15131]: ERROR Buffer too short @ report.c:3905 (increase to at least 1070) [ a23-...amaitechnologies.com OS: Linux HTTP Server 23.197.146.70<

no clue how to fix this, tried to find something in the docs and google... no luck at all.

razblack

well.. not sure this is a fix or not, but i currently (for the time) have this dril-down working.

I switched from using HTTP to HTTPS via ntop > admin > configure > startup options > [basic prefs] and changed -w (HTTP) to 0 (zero) and HTTPS server to a port of my choosing. restarted ntop and now I am able to drill-down:

IP > traffic directions > local to remote and select a host IP to get detailed info.

I don't understand why, but seems the built-in webservices is having some kind of buffer issue for HTTP services since latest updates.. perhaps related/unrelated to the OpenSSL sercurity changes.. no idea.

BeerCan

@razblack:

well.. not sure this is a fix or not, but i currently (for the time) have this dril-down working.

I switched from using HTTP to HTTPS via ntop > admin > configure > startup options > [basic prefs] and changed -w (HTTP) to 0 (zero) and HTTPS server to a port of my choosing. restarted ntop and now I am able to drill-down:

IP > traffic directions > local to remote and select a host IP to get detailed info.

I don't understand why, but seems the built-in webservices is having some kind of buffer issue for HTTP services since latest updates.. perhaps related/unrelated to the OpenSSL sercurity changes.. no idea.

Ahh you had me hopeful :) I tried this on my system and I still have the same issue as before (spinning flower with no info).

I am glad you were able to get a fix for your issue.

razblack

@BeerCan:

Ahh you had me hopeful :) I tried this on my system and I still have the same issue as before (spinning flower with no info).

I am glad you were able to get a fix for your issue.

ya, i'm not sure this was a silver bullet… there are a couple other changes I've made that could have also contributed.

I enabled use W3C (yes) under display prefs, and also noticed that after adding a few lists in pfblocker, that my memore utilization was around 75%, so I reduced squid memory cache size to 3MB. Those probably have absolutely no coincidental relation, but who knows.