Press "Enter" to skip to content

ntopng on pfsense, host filter [closed]

        I am using ntopng on pfSense
PFSense 2.6.0-RELEASE (amd64) built on Mon Jan 31 19:57:53 UTC 2022 FreeBSD 12.3-STABLE ntopng Community v.5.0.220112 (FreeBSD 12.3) I am trying to single out a host from being monitored. It is extremely high traffic, and that traffic is well defined, I wish to monitor mostly client workstations. So I have fond sparse information another forums, and in the documentation itself, but it appears that the implementation of ntopng in this environment does not follow those suggestions. it seems clear the option I want is --packet-filter, and the syntax seems relatively similar if not identical to tcpdump. The problem is where to set it? The documentaion refers to a /usr/local/etc/ntopng/ntopng.conf which does not exist,elsewhere it refers to a file ntop.conf.sample which should be copied to /etc as its (default) location, however neither the default or the example seem to exist... So it is assumed that the implementation on pfSense is different than just a direct install on some other OS/Distro/Package. I tried creating the file based on examples, the directory /usr/local/etc/ntopng did not exist, but I created it and created the file there, no joy,likewise with /etc/ntopng. I tried moving the file directly under /etc, still no joy. The file was just plain text containing the line --packet-filter=! Any help steering this the correct way for syntax, file location, or correct file would be greatly appreciated.

Be First to Comment

Leave a Reply

%d bloggers like this: