Ntop Error

[vkv]

Hi All,

I recently installed ntop the network monitoring system in my UBUNTU k

it is working fine through the browser but when i tried to use it from a terminal this is the error I got

I know the output I have pasted is really long to read but I think this will help to know about the exact problem

Please help me out in this because I need to install this in my linux gateway where I only can access things through terminal

Tue Oct 5 17:30:28 2010 NOTE: Interface merge enabled by default
Tue Oct 5 17:30:28 2010 Initializing gdbm databases
Tue Oct 5 17:30:28 2010 ntop will be started as user nobody
Tue Oct 5 17:30:28 2010 ntop v.3.3
Tue Oct 5 17:30:28 2010 Configured on Dec 23 2008 15:27:44, built on Dec 23 2008 15:28:04.
Tue Oct 5 17:30:28 2010 Copyright 1998-2007 by Luca Deri <deri@ntop.org>
Tue Oct 5 17:30:28 2010 Get the freshest ntop from Welcome to ntop.org
Tue Oct 5 17:30:28 2010 NOTE: ntop is running from 'ntop'
Tue Oct 5 17:30:28 2010 NOTE: (but see warning on man page for the --instance parameter)
Tue Oct 5 17:30:28 2010 NOTE: ntop libraries are in '/usr/lib'
Tue Oct 5 17:30:28 2010 Initializing ntop
Tue Oct 5 17:30:29 2010 Checking wlan0 for additional devices
Tue Oct 5 17:30:29 2010 Resetting traffic statistics for device wlan0
Tue Oct 5 17:30:29 2010 Initializing device wlan0 (0)
Tue Oct 5 17:30:29 2010 DLT: Device 0 [wlan0] is 1, mtu 1514, header 14
Tue Oct 5 17:30:29 2010 Initializing gdbm databases
Tue Oct 5 17:30:29 2010 VENDOR: Loading MAC address table.
Tue Oct 5 17:30:29 2010 VENDOR: Checking for MAC address table file
Tue Oct 5 17:30:29 2010 VENDOR: File '/etc/ntop/specialMAC.txt' does not need to be reloaded
Tue Oct 5 17:30:29 2010 VENDOR: ntop continues ok
Tue Oct 5 17:30:29 2010 VENDOR: Checking for MAC address table file
Tue Oct 5 17:30:29 2010 VENDOR: File '/etc/ntop/oui.txt' does not need to be reloaded
Tue Oct 5 17:30:29 2010 VENDOR: ntop continues ok
Tue Oct 5 17:30:29 2010 Fingerprint: Loading signature file
Tue Oct 5 17:30:29 2010 Fingerprint: Checking for Fingerprint file... file
Tue Oct 5 17:30:29 2010 Fingerprint: Loading file '/etc/ntop/etter.finger.os'
Tue Oct 5 17:30:29 2010 Fingerprint: ...loaded 1765 records
Tue Oct 5 17:30:29 2010 ASN: Checking for Autonomous System Number table file
Tue Oct 5 17:30:29 2010 ASN: Loading file '/etc/ntop/AS-list.txt'
Tue Oct 5 17:30:29 2010 ASN: ...found 111435 lines
Tue Oct 5 17:30:29 2010 ASN: ....Used 7560 KB of memory (24 per entry)
Tuesday 05 October 2010 05:30:29 PM IST I18N: Default language (from ntop host) is 'en_IN'
Tuesday 05 October 2010 05:30:29 PM IST I18N: This instance of ntop supports 0 additional language(s)
Tuesday 05 October 2010 05:30:29 PM IST IP2CC: Checking for IP address <-> Country Code mapping file
Tuesday 05 October 2010 05:30:29 PM IST IP2CC: Loading file '/etc/ntop/p2c.opt.table'
Tuesday 05 October 2010 05:30:29 PM IST IP2CC: ...found 52395 lines
Tuesday 05 October 2010 05:30:29 PM IST Database support not compiled into ntop
Tuesday 05 October 2010 05:30:29 PM IST Initializing external applications
Tuesday 05 October 2010 05:30:29 PM IST THREADMGMT[t139973558389008]: NPA: Started thread for network packet analyzer (wlan0)
Tuesday 05 October 2010 05:30:29 PM IST THREADMGMT[t139973558389008]: NPA: network packet analyzer (packet processor) thread running [p2875]
Tuesday 05 October 2010 05:30:29 PM IST THREADMGMT[t139973549996304]: SFP: Started thread for fingerprinting
Tuesday 05 October 2010 05:30:29 PM IST THREADMGMT[t139973541603600]: SIH: Started thread for idle hosts detection
Tuesday 05 October 2010 05:30:29 PM IST THREADMGMT[t139973549996304]: SFP: Fingerprint scan thread starting [p2875]
Tuesday 05 October 2010 05:30:29 PM IST THREADMGMT[t139973541603600]: SIH: Idle host scan thread starting [p2875]
Tuesday 05 October 2010 05:30:29 PM IST THREADMGMT[t139973533210896]: DNSAR(1): Address resolution thread running
Tuesday 05 October 2010 05:30:29 PM IST THREADMGMT[t139973533210896]: DNSAR(1): Started thread for DNS address resolution
Tuesday 05 October 2010 05:30:29 PM IST THREADMGMT[t139973524818192]: DNSAR(2): Started thread for DNS address resolution
Tuesday 05 October 2010 05:30:29 PM IST THREADMGMT[t139973524818192]: DNSAR(2): Address resolution thread running
Tuesday 05 October 2010 05:30:29 PM IST THREADMGMT[t139973516425488]: DNSAR(3): Address resolution thread running
Tuesday 05 October 2010 05:30:29 PM IST THREADMGMT[t139973516425488]: DNSAR(3): Started thread for DNS address resolution
Tuesday 05 October 2010 05:30:29 PM IST Calling plugin start functions (if any)
Tuesday 05 October 2010 05:30:29 PM IST SSL is present but https is disabled: use -W <https port> for enabling it
Tuesday 05 October 2010 05:30:29 PM IST INITWEB: Initializing web server
Tuesday 05 October 2010 05:30:29 PM IST INITWEB: Initializing TCP/IP socket connections for web server
Tuesday 05 October 2010 05:30:29 PM IST **ERROR** INITWEB: binding problem - 'Address already in use'(9
Tuesday 05 October 2010 05:30:29 PM IST Check if another instance of ntop is running
Tuesday 05 October 2010 05:30:29 PM IST or if the current user (-u) can bind to the specified port
Tuesday 05 October 2010 05:30:29 PM IST **FATAL_ERROR** Binding problem, ntop shutting down...
Tuesday 05 October 2010 05:30:29 PM IST CLEANUP[t139973697705712]: ntop caught signal 2
Tuesday 05 October 2010 05:30:29 PM IST THREADMGMT[t139973697705712]: ntop RUNSTATE: SHUTDOWN(7)
Tuesday 05 October 2010 05:30:29 PM IST THREADMGMT[t139973541603600]: SIH: Idle host scan thread running [p2875]
Tuesday 05 October 2010 05:30:29 PM IST CLEANUP[t139973697705712] catching thread is unknown
Tuesday 05 October 2010 05:30:29 PM IST CLEANUP: Running threads SFP SIH DNSAR1 DNSAR2 DNSAR3 NPA(wlan0)
Tuesday 05 October 2010 05:30:29 PM IST Joining thread DNSAR1
Tuesday 05 October 2010 05:30:29 PM IST THREADMGMT[t139973533210896]: DNSAR(1): Address resolution thread terminated [p2875]
Tuesday 05 October 2010 05:30:29 PM IST Joining thread DNSAR2
Tuesday 05 October 2010 05:30:29 PM IST THREADMGMT[t139973524818192]: DNSAR(2): Address resolution thread terminated [p2875]
Tuesday 05 October 2010 05:30:29 PM IST THREADMGMT[t139973549996304]: SFP: Fingerprint scan thread running [p2875]
Tuesday 05 October 2010 05:30:29 PM IST Joining thread DNSAR3
Tuesday 05 October 2010 05:30:29 PM IST THREADMGMT[t139973516425488]: DNSAR(3): Address resolution thread terminated [p2875]
Tuesday 05 October 2010 05:30:29 PM IST Signaling thread NPA(wlan0)
Tuesday 05 October 2010 05:30:29 PM IST CLEANUP: Locking purge mutex (may block for a little while)
Tuesday 05 October 2010 05:30:29 PM IST CLEANUP: Locked purge mutex, continuing shutdown
Tuesday 05 October 2010 05:30:29 PM IST THREADMGMT[t139973558389008]: NPA: network packet analyzer (wlan0) thread terminated [p2875]
Tuesday 05 October 2010 05:30:29 PM IST CLEANUP: Continues (still running SFP SIH)
Tuesday 05 October 2010 05:30:29 PM IST FREE_HOST: Start, 1 device(s)
Tuesday 05 October 2010 05:30:29 PM IST FREE_HOST: End, freed 0
Tuesday 05 October 2010 05:30:29 PM IST PLUGIN_TERM: Unloading plugins (if any)
Tuesday 05 October 2010 05:30:29 PM IST CLEANUP: Freeing device wlan0
Tuesday 05 October 2010 05:30:29 PM IST CLEANUP: Clean up complete
Tuesday 05 October 2010 05:30:29 PM IST THREADMGMT[t139973697705712]: ntop RUNSTATE: TERM(
Tuesday 05 October 2010 05:30:29 PM IST CLEANUP[t139973697705712]: Still running threads SFP SIH
Tuesday 05 October 2010 05:30:29 PM IST ===================================
Tuesday 05 October 2010 05:30:29 PM IST ntop is shutdown...
Tuesday 05 October 2010 05:30:29 PM IST ===================================


Please check this and help me out

Advance Thanks and Regards
VKV

[Kloschüssel]

ntop is rather clear about the problem he has:

Tuesday 05 October 2010 05:30:29 PM IST **ERROR** INITWEB: binding problem - 'Address already in use'(9
Tuesday 05 October 2010 05:30:29 PM IST Check if another instance of ntop is running
Tuesday 05 October 2010 05:30:29 PM IST or if the current user (-u) can bind to the specified port
Tuesday 05 October 2010 05:30:29 PM IST **FATAL_ERROR** Binding problem, ntop shutting down...

[vkv]

Hi,

I checked and no other instance of ntop is running and I tried giving the username

sudo ntop -u admin
but it is showing

fatal error ; unknown user

but in the browser this username is working

Advance Thanks

[Mudgen]

It's not clear how you expect to be able to "use it from a terminal". You're issuing a command to start the whole ntop facility, which presents its views via a web server. I don't think there's a command line/terminal interface to the display screens.

Your user "admin" is likely a user in the ntop user database, and is completely unknown in an "su" context, which knows only about Linux users (or things configured via PAM as analogs of Linux users). The user referred to in the errors is a Linux user.

[Kloschüssel]

Alright, so you proved that there is no instance of ntop running, so may be another of these messages may be the problem.

Tuesday 05 October 2010 05:30:29 PM IST **ERROR** INITWEB: binding problem - 'Address already in use'(9
Tuesday 05 October 2010 05:30:29 PM IST Check if another instance of ntop is running
Tuesday 05 October 2010 05:30:29 PM IST or if the current user (-u) can bind to the specified port
Tuesday 05 October 2010 05:30:29 PM IST **FATAL_ERROR** Binding problem, ntop shutting down...

Usually (in the unix world) only root can bind ports in the range of [1..1024], which port 80 (http/web) would be part of. But the "admin" user probably misses some special credentials to run ntop in this case. Run it as root and all should be fine, even if I would not recommend that. When you run ntop from console, you get all the output on the console and imho you don't need the web interface in this usecase.