Can ntopng show original source or destination in flows?



  • Hi all.
    I'm using 2.4.4-RELEASE-p3 at my home as my router/fw behind ISP modem. I have several interfaces: PPPoE for WAN and 3 additional VLAN interfaces for my home network (home, lab, guest). I installed ntopng to have an overview of active flows and overall traffic. What I'm looking at is if ntopng can show original source or destination in Active Flows - for example, when I select my WAN interface, client (source) is my WAN public IP but I would like to see original source - similar to what you see when you go to pfsense Diagnostic->States.
    The reason is that if I see some suspicions connection on WAN interface, in order to figure out what device in my home is making it (or receiving it), I have to switch interfaces in ntopng and find out by searching for the destination - but most of the time connections are short and they're gone before I identify the source.

    If you know if this is possible in ntopng or maybe some other package (although I quite like ntopng), it'll be much appreciated.

    Thanks!


Log in to reply