Ntop can't see IP detail information

akong · Jul 14, 2014, 2:43 AM

Hello,I install pfsense 2.1.4 and install ntop package.I can access ntop web gui.But when I see any IP detail information.It's will show overview tab and have a cycle.Please see attachment.How to fix it?

dgcom · Jul 14, 2014, 2:59 AM

I looked a it and my conclusion is here: NTOP Problem ?

And recommendation - next time, try the search :)

akong · Jul 14, 2014, 3:22 AM

Thanks for your reply.I think this is bug,Ntop can't load python.I have see someone to change Admin settings.I will try it.
But I have another problem.I already setup ntop password.But when I click admin interface and click any lock item.I input account wjth Admin and input password.But it's can't login.What's this problem?

dgcom · Jul 14, 2014, 3:39 AM

Which setting you want to change? If that's "Use W3C" then it should be on by default, but it won't make python loaded…

As for password, make sure that you specify user correctly - it should be admin (all lower case).
If you forgot password, you can try stopping ntop service and resetting password using command line - option is:

 --set-admin-password=<pass></pass>

akong · Jul 14, 2014, 4:09 AM

Hello,
I can access admin manager.Thanks a lot.
I have check W3C is default.But it's always show this cycle.Someone say this is python problem.You haven't this problem?

dgcom · Jul 14, 2014, 4:14 AM

Yes, I have this issue, level 3 hosts (IP) information cannot be seen.
If you go to About -> System Configuration, you will see that Embedded Python - Not Present.
There are two possibilities:

ntop was compiled without python support
ntop cannot find correct python executable

akong · Jul 14, 2014, 4:44 AM

So,Could have any solution?Or wait to fix?

highlandpeak · Jul 17, 2014, 5:30 PM

I had this problem and I just got it to work:

From within NTop, try Admin/Switch NIC and choose your wan interface.

Bruce

dgcom · Jul 17, 2014, 6:36 PM

Did you click on IP address or MAC?

highlandpeak · Jul 17, 2014, 8:24 PM

Not sure what you're asking… Could you clarify?

Bruce

dgcom · Jul 17, 2014, 8:30 PM

When you look at host, there are two different types of addresses shown - IP (level 3) and MAC (level 2).
You can click on both of them to view host information, however only level 2 addresses work currently.
That is why I am asking - when you switched interface and looked at host - was this level 2 or level 3 host? I.e. did you click on IP address or MAC to show host information?

highlandpeak · Jul 17, 2014, 8:51 PM

Host name & macs where there is one work, ip addresses are not clickable in the reports that I can see. Macs do not show up for remote networks.

I don't know if this has to do with differences in how I have mine setup vs yours.

In ntop Settings I have 3 interfaces selected (LAN, OPT1, WAN) and allow merge interfaces ticked.

In Admin/Configure ntop/IP Prefs I have DNS resolution mode (-n) set to all.

Bruce

![Screen Shot 2014-07-17 at 4.47.20 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2014-07-17 at 4.47.20 PM.png_thumb)
![Screen Shot 2014-07-17 at 4.47.20 PM.png](/public/imported_attachments/1/Screen Shot 2014-07-17 at 4.47.20 PM.png)

dgcom · Jul 17, 2014, 8:54 PM

So, in the screenshot you attached - what happens if you click on host name?

BTW - see that drop down, which is saying "Show only L3 hosts"? What you see is the list of all level 3 hosts - being it name or IP… If you switch to level 2, you will see MAC addresses...

highlandpeak · Jul 17, 2014, 9:33 PM

See attached

![Screen Shot 2014-07-17 at 5.31.00 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2014-07-17 at 5.31.00 PM.png_thumb)
![Screen Shot 2014-07-17 at 5.31.00 PM.png](/public/imported_attachments/1/Screen Shot 2014-07-17 at 5.31.00 PM.png)
![Screen Shot 2014-07-17 at 5.32.43 PM.png](/public/imported_attachments/1/Screen Shot 2014-07-17 at 5.32.43 PM.png)
![Screen Shot 2014-07-17 at 5.32.43 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2014-07-17 at 5.32.43 PM.png_thumb)

dgcom · Jul 17, 2014, 10:20 PM

This is interesting… Your host information page (1st screenshot) is different than the one with spinning wheel - it has less tabs (like the one I get for L2 hosts).
Are there any global ntop settings you changed?

Cino · Jul 18, 2014, 12:10 AM

something has change.. I'm seeing the same thing on my box… This wasn't the case for me 1-2 months ago... Submit a bug report here: https://redmine.pfsense.org/

I believe Jimp normally maintains this package, hopefully its a quick fix by recompiling the binary

akong · Jul 18, 2014, 10:28 AM

I submit it.
https://redmine.pfsense.org/issues/3764

ipassashuman · Jul 21, 2014, 8:20 PM

I had your exact problem. Managed to resolve it;
Did a few things before restarting the service. So I'm not sure exactly which it was that resolved it;

Admin -> Configure -> Startup Options;

Enable Session Handling (-z) -> No
Run as daemon (-d) YES
Set Both these and restart the service in PfSense -> Status -> Services

Other changes i made;
NTOP IP ranges were incorrect; (Admin -> Configure -> Preferences
look for all references to your IP ranges and fix them. e.g.
netflow.2.ifNetMask 192.168.0.0/255.255.255.0 -> Change to your ranges 192.168.1.0/255.255.255.0

Tested this under another system and resolved the same issue.

Later

dgcom · Jul 21, 2014, 8:41 PM

It looks like disabling TCP sessions handling switches host information to simplified page which works, but shows much less data than when ntop can track TCP sessions.

Would still be nice if integration with Python can be fixed, so ntop can show all data collected.

akong · Jul 24, 2014, 12:47 AM

I have to report to redmine.pfsense.org.It's report for me.

there's nothing broken in general with ntop. it needs to be deprecated and replaced with ntopng regardless.

So,Is it will be use ntopng?