NTOP(8)                                                                NTOP(8)



[1mNAME[0m
       ntop - display top network users

[1mSYNOPSIS[0m
       [1mntop  [22m[[1m@filename[22m] [[1m-a[22m|[1m--access-log-path [4m[22m<path>[24m] [[1m-b[22m|[1m--disable-decoders[22m]
       [[1m-c[22m|[1m--sticky-hosts] [22m[[1m-f[22m|[1m--traffic-dump-file  [4m[22mfile>[24m]  [[1m-g[22m|[1m--track-local-[0m
       [1mhosts[22m]  [[1m-h[22m|[1m--help[22m] [[1m-k[22m|[1m--filter-expression-in-extra-frame[22m] [[1m-l[22m|[1m--pcap-[0m
       [1mlog   [4m[22m<path>[24m]   [[1m-m[22m|[1m--local-subnets   [4m[22m<addresses>[24m]    [[1m-n[22m|[1m--numeric-ip-[0m
       [1maddresses[22m]  [[1m-o[22m|[1m--no-mac[22m]  [[1m-p[22m|[1m--protocols  [4m[22m<list>[24m] [[1m-q[22m|[1m--create-suspi-[0m
       [1mcious-packets[22m]   [[1m-r[22m|[1m--refresh-time   [4m[22m<number>[24m]   [[1m-s[22m|[1m--no-promiscuous[22m]
       [[1m-t[22m|[1m--trace-level  [4m[22m<number>[24m]  [[1m-w[22m|[1m--http-server  [4m[22m<port>[24m] [[1m-z[22m|[1m--disable-[0m
       [1msessions[22m]  [[1m-A[22m|[1m--set-admin-password  [4m[22mpassword[24m]  [[1m-B[22m|[1m--filter-expression[0m
       [4mexpression[24m]  [[1m-C[22m|[1m--large-network[22m]  [[1m-D[22m|[1m--domain [4m[22m<name>[24m] [[1m-F[22m|[1m--flow-spec[0m
       [4m<specs>[24m]     [[1m-M[22m|[1m--no-interface-merge[22m]      [[1m-O[22m|[1m----output-packet-path[22m]
       [[1m-P[22m|[1m--db-file-path    [4m[22m<path>[24m]   [[1m-R[22m|[1m--filter-rule   [4m[22m<file>[24m]   [4m<number>[24m]
       [[1m-U[22m|[1m--mapper [4m[22m<URL>[24m] [[1m-V[22m|[1m--version] [22m[[1m--throughput-bar-chart[22m] [[1m--dynamic-[0m
       [1mpurge-limits[22m] [[1m--reuse-rrd-graphics[22m] [[1m--p3p-cp[22m] [[1m--p3p-uri[22m] [[1m--disable-[0m
       [1mstopcap[22m]

       Not available on micro-ntop:

       [[1m-e[22m|[1m--max-table-rows [4m[22m<number>[24m]

       Unix options:

       [[1m-d[22m|[1m--daemon[22m] [[1m-i[22m|[1m--interface [4m[22m<name>[24m] [[1m-u[22m|[1m--user [4m[22m<user>[24m]  [[1m-E[22m|[1m--enable-[0m
       [1mexternal-tools[22m]   [[1m-K[22m|[1m--enable-debug[22m]   [[1m-L[22m]  [[1m-use-syslog  [4m[22m<facility>[24m]
       [[1m--ignore-sigpipe[22m]

       Win32 option:

       [[1m-i[22m|[1m--interface [4m[22m<number>[24m]

       OpenSSL options:

       [[1m-W[22m|[1m--https-server [4m[22m<port>[24m] [[1m--use-sslwatchdog[22m]


[1mDESCRIPTION[0m
       [1mntop [22mshows the current network usage. It displays a list of hosts  that
       are  currently using the network and reports information concerning the
       (IP and non-IP) traffic generated by each host.  [1mntop [22mmay operate as  a
       front-end  collector (sFlow and/or netFlow plugins) or as a stand-alone
       collector/display program. A web browser is needed to access the infor-
       mation captured by the [1mntop [22mprogram.

       An  older,  and unsupported version, [1mintop [22mcan be started in a terminal
       window.



[1mCOMMAND-LINE OPTIONS[0m
       [1m@filename[0m
        The text of [1mfilename [22mis copied -  ignoring  line  breaks  and  comment
        lines  (anything following a #) - into the command line.  [1mntop [22mbehaves
        as if all of the text had simply been typed directly  on  the  command
        line.   For example, if the command line is "-t 3 @d -u ntop" and file
        d contains just the line '-d', then the effective command line is -t 3
        -d -u ntop.  Multiple @s are permitted.

        Remember,  most  [1mntop  [22moptions  are "sticky", that is they just set an
        internal flag. Invoking them  multiple  times  doesn't  change  [1mntop's[0m
        behavior.  However,  options  that set a value, such as --trace-level,
        will use the LAST value given: --trace-level 2  --trace-level  3  will
        run as --trace-level 3.


       [1m-a | --access-log-path[0m
        By  default [1mntop [22mdoes not maintain an http log. Use this flag to spec-
        ify the path of the file where HTTP accesses will be logged. Each  log
        entry is in Apache-like style.  The only difference between Apache and
        [1mntop [22mis that an additional column has been added which  has  the  time
        (in milliseconds) that [1mntop [22mneeded in order to serve the request.


       [1m-b | --disable-decoders[0m
        This  flag disables protocol decoders (e.g. DNS, NetBIOS).  Use it for
        better performance or if you feel [1mntop [22mhas problem handling some  pro-
        tocols.


       [1m-c | --sticky-hosts[0m
        By  default  idle hosts are periodically purged from memory.  Use this
        flag to prevent idle hosts from being purged from  memory.   NOTE:  if
        idle  hosts are kept in memory you can experience severe memory usage.


       [1m-d | --daemon[0m
        This flag causes ntop to become a daemon, i.e. it is started in  back-
        ground and runs detached from the terminal.


       [1m-e | --max-table-rows[0m
        Is the maximum number of HTML table rows that [1mntop [22mwill display.


       [1m-f | --traffic-dump-file[0m
        Specifies  the file containing tcpdump captured traffic that has to be
        used by ntop.  NOTE: if you specify -f ntop will not capture any traf-
        fic  after  the  file  has  been read.  This option is mostly used for
        debug purposes.


       [1m-g | --track-local-hosts[0m
        Use this flag to tell [1mntop [22mthat you do care  only  about  local  hosts
        (use -m to specify local nets).  This flag is useful on large networks
        or those that see many hosts, (e.g. a border router or  gateway),  yet
        only the local ones need to be tracked.


       [1m-h | --help[0m
        Print help information for [1mntop [22m, including usage.


       [1m-i | --interface[0m
        Specifies the network interface used by [1mntop[0m

        If  multiple  interfaces  are  used (this feature is available only if
        ntop is compiled with thread support) their names  must  be  separated
        with a comma. For instance -i "eth0,lo".

        By  default,  traffic  information  obtained  by all the interfaces is
        merged together as if the traffic were seen  by  only  one  interface.
        Use the -M flag to keep traffic separate by interface.

        Win32  note:  This is the number of the interface, not it's name.  Run
        [1mntop [22m-h to see a list of interface name-number mappings (at the end of
        the help information).


       [1m-k | --filter-expression-in-extra-frame[0m
        When this flag is used, the current filter expression is printed in an
        extra frame and thus always visible.


       [1m-l | --pcap-log[0m
        Dumps the network traffic captured by ntop in a file  in  pcap  format
        (useful for debug).


       [1m-m | --local-subnets[0m
        This flag allows users to specify the subnets whose traffic is consid-
        ered  local.   The  format  is  <network   address>/<#   subnet   mask
        bits>[,<network  address>/<#  subnet  mask  bits>].  Both netmasks and
        CIDR      notation      may      be      used,      for       instance
        "131.114.21.0/24,10.0.0.0/255.0.0.0".


       [1m-n | --numeric-ip-addresses[0m
        This  causes [1mntop [22mto show numeric IP addresses instead of the symbolic
        names. This option can useful when the DNS is  not  present  or  quite
        slow.   Under  intop,  you  can toggle the address format (numeric vs.
        symbolic) by pressing the [1mn [22mkey while [1mintop [22mis running.


       [1m-o | --no-mac[0m
        Specifies the user [1mntop [22mshould not trust MAC  addresses  but  just  IP
        addresses.   This  option  is  useful  whenever  ntop is started on an
        interface where MAC addresses cannot be really trusted (e.g. port/VLAN
        mirror).

        Be  aware  that  information which is dependent upon the MAC addresses
        (such as IPX) will not be collected nor displayed.


       [1m-p | --protocols[0m
        It is used to specify the TCP/UDP protocols that  [1mntop  [22mwill  monitor.
        The  format  is  <label>=<protocol  list> [, <label>=<protocol list>],
        where label is used to symbolically identify the <protocol list>.  The
        format of <protocol list> is <protocol>[|<protocol>], where <protocol>
        is either a valid protocol specified inside the /etc/services file  or
        a numeric port range (e.g. 80, or 6000-6500).  If the -p flag is omit-
        ted the following default value is used:

          FTP=ftp|ftp-data
          HTTP=http|www|https|3128     3128 is Squid, the HTTP cache
          DNS=name|domain
          Telnet=telnet|login
          NBios-IP=netbios-ns|netbios-dgm|netbios-ssn
          Mail=pop-2|pop-3|pop3|kpop|smtp|imap|imap2
          DHCP-BOOTP=67-68
          SNMP=snmp|snmp-trap
          NNTP=nntp
          NFS=mount|pcnfs|bwnfs|nfsd|nfsd-status
          X11=6000-6010
          SSH=22

          Peer-to-Peer Protocols
          ----------------------
          Gnutella=6346|6347|6348
          Kazaa=1214
          WinMX=6699|7730
          DirectConnect=0      Dummy port as this is a pure P2P protocol
          eDonkey=4661-4665

          Instant Messenger
          -----------------
          Messenger=1863|5000|5001|5190-5193

        If the <protocol list> is very long you may store it in  a  file  (for
        instance  protocol.list).   To do so, specify the file name instead of
        the <protocol list> on the command line.  e.g.  [1mntop [22m-p  protocol.list
        instead of [1mntop [22m-p FTP=ftp|ftp-data,HTTP=http|www|https|3128 ...


       [1m-q | --create-suspicious-packets[0m
        Forces ntop to create a file ntop-suspicious-pkts.XXX.pcap (XXX is the
        interface name) file.  One file is created for each network  interface
        where  suspicious packets are found.  The file is in pcap format (tcp-
        dump).


       [1m-r | --refresh-time[0m
        Specifies the delay (in seconds) between screen updates  (the  default
        is 3 seconds).

        Please  note  that if the delay is very short (1 second for instance),
        ntop might not be able to process all the network traffic.


       [1m-s | --no-promiscuous[0m
        Use this flag  for  preventing  from  setting  the  interface(s)  into
        promiscuous mode.

        [1mntop  [22mmust  probably still be started as root, since the libpcap func-
        tion on most systems require it to capture raw packets.

        This eliminates the ability of capturing ethernet frames regardless of
        whether  they are directed to the local ethernet card or to the ether-
        net broadcast address.

        Even if you use this flag, the interface could well be in  promiscuous
        mode as other applications may have enabled it.


       [1m-t | --trace-level[0m
        This  flag  specifies  the level of [1mntop [22mtracings on stdout. The trace
        level ranges between 0 (no trace) and 5 (full  debug  tracings).   The
        default  trace  value  is  3.  The  higher is the trace level the more
        information are printed.  Trace level 1 is used to print errors  only,
        level 2 for both warnings and errors, and so on.

        Trace  level  4 is called 'noisy' and it is.  It also enables a MSGID-
        nnnnn tag on every message, which may be useful for log watchers.


       [1m-u | --user[0m
        Specifies the user [1mntop [22mshould run as after it initializes. The  value
        specified  may be either a username or a numeric user id. The group id
        used will be the primary group of the user specified.  If this parame-
        ter  is  not  specified, ntop will try to switch first to 'nobody' and
        then to 'anonymous' before giving up.


       [1m-w | --http-server[0m
        [1mntop [22moffers an embedded web server so that users can attach their  web
        browsers to the program and browse traffic information remotely.  This
        parameter specifies the port (and optionally the address (i.e.  inter-
        face))  of  the [1mntop [22mweb server.  For example, if started with -w 3000
        (the default port), the URL to access [1mntop  [22mis  http://hostname:3000/.
        If  started  with a full specification, e.g. -w 192.168.1.1:3000, [1mntop[0m
        listens on only that address/port combination.

        If -w is set to 0 the HTTP  port  will  not  be  enabled  ('-w  0'  is
        accepted only if [1mntop [22mhas been compiled with HTTPS support and has not
        been started with '-W 0' [see below]).

        Some examples:

        [1mntop -w 3000 -W 0 [22m(this is the default setting) HTTP requests on  port
        3000 and no HTTPS.

        [1mntop  -w 80 -W 443 [22mBoth HTTP and HTTPS have been enabled on their most
        common ports.

        [1mntop -w 0 -W 443 [22mHTTP disabled, HTTPS enabled on the common port.

        An external HTTP server is NOT required NOR supported.  The  [1mntop  [22mweb
        server is embedded into the application.

        By  default  user/URL  administration  are  password protected and are
        accessible initially only user [1madmin [22mwith a password  set  during  the
        first run of [1mntop[0m

        Users  can  modify/add/delete  users/URLs  using ntop itself - see the
        Admin tab.

        The passwords, userids and URLs to protect with passwords  are  stored
        in  a database file.  Passwords are stored in an encrypted form in the
        database for further security.


       [1m-z | --disable-sessions[0m
        This flag disables TCP session tracking.  Use it  for  better  perfor-
        mance or when you don't really need/care to track sessions.


       [1m-A | --set-admin-password[0m
        This  flag is used to start [1mntop [22m, set the admin password and quit. It
        is quite useful for installers that may need to automatically set  the
        password for the admin user.

        -A and --set-admin-password (without a value) will prompt the user for
        the password.

        You may set a specific value using --set-admin-password=value.  [1mThe  =[0m
        [1mis REQUIRED![0m


       [1m-B | --filter-expression[0m
        [1mntop [22m, similar to what tcpdump does (and using the same BPF - Berkeley
        Packet Filter syntax), this allows the user to specify  an  expression
        which  restricts  the  traffic seen by [1mntop [22mYou may use this to select
        only the traffic of interest. For instance, suppose you are interested
        only  in  the  traffic  generated/received  by the host jake.unipi.it.
        [1mntop [22mcan then be started with the following filter: 'ntop -B "src host
        jake.unipi.it or dst host jake.unipi.it"'. i

        See  the  'expression'  section  of  the  [1mtcpdump [22mman page for further
        information about BPF filters.


       [1m-C | --large-network[0m
        This flag is a hint for [1mntop [22m: as the network being analyzed  will  be
        large,  [1mntop  [22mwill build a more efficient hash and save memory by dis-
        abling some features (e.g traffic distribution during  the  day)  that
        take up a large amount of memory.


       [1m-D | --domain[0m
        This  identifies  the  local  domain suffix, e.g. ntop.org.  It may be
        necessary, if [1mntop [22mis having difficulty determining it from the inter-
        face.


       [1m-E | --enable-external-tools[0m
        By  default  [1mntop  [22mdoes  not take advance of lsof even if present. Use
        this flag if you want make [1mntop [22menable it's use of  lsof  if  lsof  is
        present.


       [1m-F | --flow-spec[0m
        It  is used to specify network flows similar to more powerful applica-
        tions such as NeTraMet.  A flow is a stream of captured  packets  that
        match a specified rule. The format is

        [1m<flow-label>='<matching  expression>'[,<flow-label>='<matching expres-[0m
        [1msion>'][0m

        , where the label is used to symbolically identify the flow  specified
        by  the  expression.   The  expression  format  is  specified  in  the
        appendix. If an expression is specified, then the information concern-
        ing  flows  can  be  accessed following the HTML link named 'List Net-
        Flows'.

        For instance define two flows  with  the  following  expression  [1mLuca-[0m
        [1mHosts='host  jake.unipi.it  or host pisanino.unipi.it',GatewayRoutedP-[0m
        [1mkts='gateway gateway.unipi.it' .[0m

        All   the   traffic   sent/received   by   hosts   jake.unipi.it    or
        pisanino.unipi.it  is  collected  by  [1mntop  [22mand added to the LucaHosts
        flow, whereas all the packet routed by  the  gateway  gateway.unipi.it
        are  added  to  the  GatewayRoutedPkts flow. If the flows list is very
        long you may store in a file (for instance flows.list) and specify the
        file name instead of the actual flows list (in the above example, this
        would be 'ntop -F flows.list').


       [1m-K | --enable-debug[0m
        Use this flag to simplify application debug.  It does three things: 1.
        Does not fork() on the "read only" html pages.  2. Displays mutex val-
        ues on  the  configuration  (info.html)  page.   3.  (If  available  -
        glibc/gcc) Activates an automated backtrace on application errors.


       [1m-L | --use-syslog=facility[0m
        Use  this  flag  for  using the syslog instead of stdout.  Please note
        that if ntop (ever) forks a child, regardless  of  this  setting,  the
        syslog  will  be  used for this child.  The (optional) parameter value
        indicates the facility (e.g. daemon, security) to be used for logging,
        using --use-syslog=facility.  [1mThe = is REQUIRED![0m


       [1m-M | --no-interface-merge[0m
        Forces  [1mntop [22mnot to merge network interfaces together. This means that
        [1mntop [22mwill collect statistics for each interface and report them  sepa-
        rately - see Admin | Switch NIC to select which interface to report.

        Note  that the netFlow and sFlow plugins will force the setting of -M.


       [1m-O | --output-packet-path[0m
        Base path for the ntop-suspicious-pkts.XXX.pcap and normal packet  log
        file (in tcpdump format).  If the base path is a directory you have to
        append a / to the string for this to work.


       [1m-P | --db-file-path[0m
        This specifies where [1mntop[0m

        Note that the default, "." may not be what  you  expect  when  running
        [1mntop  [22mas  a  daemon  or  Win32  service.  Setting an explicit value is
        [1mSTRONGLY [22mrecommended.


       [1m-U | --mapper[0m
        Specifies the URL of the mapper.pl utility.  [1mntop [22mcreates a  hyperlink
        to  this  URL by appending ?host=xxxxx and creates a clickable button.
        Any type of host lookup could be performed, but this  is  intended  to
        lookup the geographical location of the host.

        A cgi-based mapper interface to http://www.multimap.com is part of the
        [1mntop [22mdistribution [see www/Perl/mapper.pl]).


       [1m-V | --version[0m
        Prints [1mntop [22mversion information and then exits.


       [1m-W | --https-server[0m
        If [1mntop [22mhas been compiled with HTTPS support (via OpenSSL), this  flag
        can  be used to set the HTTPS port and address.  If the user specifies
        '-W 0', HTTPS support is disabled.  This is the default (disabled).

        For more information, see the -w parameter above.


       [1m--throughput-bar-chart[0m
        Format the throughput charts with bars instead of as an area chart.


       [1m--dynamic-purge-limits[0m
        Enable a dynamic adjustment of the idle host purge  limits.   Normally
        the  purge  is limited to 1/3 of the hash size or 512 hosts (whichever
        is smaller) per cycle.  This switch allows [1mntop [22mto dynamically  adjust
        the limit so that the purge takes between 0.5 and 5.0 seconds (but the
        minimum dynamic limit is 64 per cycle).  These values may be  adjusted
        via compile time constants.


       [1m--reuse-rrd-graphics[0m
        Enable the reuse of rrd graphics if appropriate (no rrd updates in the
        interim).  By default, with the flag not set, the graphics are  recre-
        ated for each request.


       [1m--p3p-cp[0m
        Tells ntop what to return in the p3p header, cp="xxxx".


       [1m--p3p-uri[0m
        Tells ntop what to return in the p3p header, policyref="xxxx".


       [1m--disable-stopcap[0m
        Return [1mntop [22mto the old (v2.1) behavior on a memory error.  The default
        of stopcap enabled makes  the  web  interface  available  albeit  with
        static content until [1mntop [22mis shutdown.


       [1m--ignore-sigpipe[0m
        Enable  a  handler for SIGPIPE errors. This usually happens only under
        debug (gdb).  (also  available  as  a  ./configure  option,  --enable-
        ignoresigpipe)


       [1m--use-sslwatchdog[0m
        Enables  a  'watchdog' for [1mntop [22mwebserver hangs.  These usually happen
        when connecting with Netscape 6.2.2 and some other browsers - but only
        via https:// urls.

        The  symptom  is that the user gets nothing back and other users can't
        connect.  Internally, the web server  hangs  in  SSL_accept().   While
        packet  processing  continues,  there  is  no  way  to access the data
        through the web server or shutdown [1mntop [22mcleanly.

        With the watchdog, a timeout occurs after 3  seconds,  and  processing
        continues  with a log message.  Unfortunately, the user sees nothing -
        it just looks like a failed connection.  (also available as  a  ./con-
        figure option, --enable-sslwatchdog)


[1mWEB VIEWS[0m
       While  [1mntop  [22mis running, multiple users can access the traffic informa-
       tion using conventional web browsers.  The main HTML page is divided is
       three  frames.  The top frame is a familiar tabbed navigation bar, con-
       taining items such as 'Total', 'Sent' and 'IP Protos'.  The left  frame
       allows  users  to select the specific traffic view from among those for
       the tab.  The resulting data will be displayed in the right frame.


[1mNOTES[0m
       [1mntop [22mrequires a number of external tools.  Other  tools  are  optional,
       but add to the program's capabilities.


       Required libraries include:

       [1mlibpcap [22mfrom http://www.tcpdump.org/

       The  Win32  version  makes  use of [1mlibpcap for Win32 [22mwhich may be down-
       loaded  from  http://winpcap.polito.it/install/default.htm).   WARNING:
       The  2.x  series  of  [1mlibpcap  for  Win32 [22mreleases will NOT support SMP
       machines.

       [1mgdbm [22mfrom http://www.gnu.org/software/gdbm/gdbm.html

       [1mntop [22mrequires a POSIX threads library. Although a single-threaded  ver-
       sion of [1mntop [22mcan be built from the source if requested during ./config-
       ure, it is not recommended for more than trivial usage.

       [1mintop [22mrequires ncrypt and readline.


       Optional libraries include:

       The [1mgdchart [22mlibrary, available at http://www.fred.net/brv/chart/.  Note
       that [1mntop distributes an enhanced version of gdchart, 0.94c, as part of[0m
       [1mthe ntop [22msource tree.  [1mntop  has  not  be  tested  with  the  (develop-[0m
       [1mment/beta) releases of gdchart (the 0.10 [22mand 0.11 series).

       The   [1mgd   [22mlibrary,  for  the  creation  of  gif  files,  available  at
       http://www.boutell.com/gd/.  The 1.8.3 version of gd is  included  with
       gdchart  0.94c  in the [1mntop [22msource tree.  [1mntop [22mhas not been tested with
       any other version.

       The [1mlibpng [22mlibrary,  for  the  creation  of  png  files,  available  at
       http://www.libpng.org/pub/png/libpng.html.   Note  that  a  version  of
       libpng, 1.2.4, is distributed with the [1mntop  [22msource  tree.   [1mntop  [22mwill
       also  work  with  the  1.0.x series, which is distributed in many Linux
       distribtions.

       [1mHOWEVER [22mthe two series, 1.0 and 1.2, are not compatible nor interopera-
       ble.   If  compiled  against one version and executing against another,
       [1mntop [22mwill fail to create graphics.

       There is logic in the build script  (gdchart0.94c/buildAll.sh)  and  in
       the  program to attempt to catch this and rectify the problem or notify
       the user.  This may not work in all cases.  If you have a problem  with
       graphics not being produced, check the [1mntop [22mlog and check the installed
       versions of libpng.

       (if an https:// server is desired) [1mopenSSL  [22mfrom  the  OpenSSL  project
       available at http://www.openssl.org.

       The  [1mrrdtool  [22mis  required  by the rrd plugin.  rrdtool creates 'Round-
       Robin databases' which are used to hold and graph historical data.  The
       rrdtool  home  page  is http://people.ee.ethz.ch/~oetiker/webtools/rrd-
       tool/

       [1mntop [22mhas been tested with rrdtool versions 1.0.38 -> 1.0.41.  [1mntop  [22mhas
       NOT  been  (successfully) tested with the rrdtool development versions,
       and there are significant differences between the two branches.

       Also, please note that there is a patched  version  of  rrdtool  1.0.41
       available  in  the [1mntop [22mfiles area of SourceForge.  This contains a bug
       fix (which will be part of rrdtool 1.0.42 when released).  Without this
       fix, [1mntop [22mmay - rarely - crash during the create/update of an rrd.

       The  [1msflow  [22mPlugin  is  courtesy of and supported by InMon Corporation,
       http://www.inmon.com/sflowTools.htm.

       There are other optional libraries.  See the output of ./configure  for
       a fuller listing.


       An  optional tool, which [1mntop [22mwill utilize if available, is [1mlsof [22mavail-
       able from ftp://vic.cc.purdue.edu/pub/tools/unix/lsof/README.

       lsof is used to present a remote view of the open  files  on  the  [1mntop[0m
       host.

       Note  that  lsof  must be configured suid root to enable it's use.  [1mThe[0m
       [1muser is cautioned to fully understand the security implications of this[0m
       [1msetting  before enabling it.  ntop [22mwill function quite properly without
       the lsof tool.



[1mSEE ALSO[0m
       [1mintop[22m(1), [1mtop[22m(1), [1mtcpdump[22m(8).

[1mAUTHOR[0m
       Please send bug reports  to  the  ntop  mailing  list  <ntop@ntop.org>.
       Please send code patches to <patch@ntop.org>.

       ntop's author is Luca Deri who can be reached at deri@ntop.org.

       Tool  locations  are  current  as  of April 2003 - please send email to
       report new locations or dead links.



                             April 2003 (ntop 2.2)                     NTOP(8)
