installing Ntop

razzera · 05-04-2010, 08:35 AM

Hello

I wanted to install Ntop on my debian server. i used "apt-get install ntop" to get it installed. then i ran the command "ntop" and it asked me to give "admin" a password so i made one. then when i started ntop it wont start. bellow is what i get when i run "ntop". when i try to stop ntop trough init.d it's saying there is no deamon running and when i try to start it it's saying the deamon is running. what is the problem here ?

Edit: when i try to go mydomain.com:3000 is never times out and it never shows anyting.

ntop startup - waiting for user response!

Please enter the password for the admin user:
Please enter the password again:
Tue May 4 15:04:32 2010 Admin user password has been set
server:/home/frogy/public_html# ntop
Tue May 4 15:10:00 2010 NOTE: Interface merge enabled by default
Tue May 4 15:10:00 2010 Initializing gdbm databases
Tue May 4 15:10:00 2010 ntop will be started as user nobody
Tue May 4 15:10:00 2010 ntop v.3.3
Tue May 4 15:10:00 2010 Configured on Aug 6 2008 9:53:46, built on Aug 6 2008 09:54:10.
Tue May 4 15:10:00 2010 Copyright 1998-2007 by Luca Deri <deri@ntop.org>
Tue May 4 15:10:00 2010 Get the freshest ntop from http://www.ntop.org/
Tue May 4 15:10:00 2010 NOTE: ntop is running from 'ntop'
Tue May 4 15:10:00 2010 NOTE: (but see warning on man page for the --instance parameter)
Tue May 4 15:10:00 2010 NOTE: ntop libraries are in '/usr/lib'
Tue May 4 15:10:00 2010 Initializing ntop
Tue May 4 15:10:00 2010 No default device configured. Using eth0
Tue May 4 15:10:00 2010 Checking eth0 for additional devices
Tue May 4 15:10:00 2010 Resetting traffic statistics for device eth0
Tue May 4 15:10:00 2010 Initializing device eth0 (0)
Tue May 4 15:10:00 2010 DLT: Device 0 [eth0] is 1, mtu 1514, header 14
Tue May 4 15:10:00 2010 Initializing gdbm databases
Tue May 4 15:10:00 2010 VENDOR: Loading MAC address table.
Tue May 4 15:10:00 2010 VENDOR: Checking for MAC address table file
Tue May 4 15:10:00 2010 VENDOR: Loading newer file '/etc/ntop/specialMAC.txt'
Tue May 4 15:10:00 2010 VENDOR: ...found 61 lines
Tue May 4 15:10:00 2010 VENDOR: ...loaded 59 records
Tue May 4 15:10:00 2010 VENDOR: Checking for MAC address table file
Tue May 4 15:10:00 2010 VENDOR: Loading newer file '/etc/ntop/oui.txt'
Tue May 4 15:10:00 2010 VENDOR: ...found 48541 lines
Tue May 4 15:10:00 2010 VENDOR: ...loaded 7853 records
Tue May 4 15:10:00 2010 Fingerprint: Loading signature file
Tue May 4 15:10:00 2010 Fingerprint: Checking for Fingerprint file... file
Tue May 4 15:10:00 2010 Fingerprint: Loading file '/etc/ntop/etter.finger.os'
Tue May 4 15:10:00 2010 Fingerprint: ...loaded 1765 records
Tue May 4 15:10:00 2010 ASN: Checking for Autonomous System Number table file
Tue May 4 15:10:00 2010 ASN: Loading file '/etc/ntop/AS-list.txt'
Tue May 4 15:10:01 2010 ASN: ...found 111435 lines
Tue May 4 15:10:01 2010 ASN: ....Used 7560 KB of memory (24 per entry)
tis 4 maj 2010 15.10.01 I18N: Default language (from ntop host) is 'sv_SE'
tis 4 maj 2010 15.10.01 I18N: This instance of ntop supports 0 additional language(s)
tis 4 maj 2010 15.10.01 IP2CC: Checking for IP address <-> Country Code mapping file
tis 4 maj 2010 15.10.01 IP2CC: Loading file '/etc/ntop/p2c.opt.table'
tis 4 maj 2010 15.10.01 IP2CC: ...found 52395 lines
tis 4 maj 2010 15.10.01 Database support not compiled into ntop
tis 4 maj 2010 15.10.01 Initializing external applications
tis 4 maj 2010 15.10.01 THREADMGMT[t1082132816]: NPA: Started thread for network packet analyzer (eth0)
tis 4 maj 2010 15.10.01 THREADMGMT[t1082132816]: NPA: network packet analyzer (packet processor) thread running [p12407]
tis 4 maj 2010 15.10.01 THREADMGMT[t1090525520]: SFP: Fingerprint scan thread starting [p12407]
tis 4 maj 2010 15.10.01 THREADMGMT[t1090525520]: SFP: Started thread for fingerprinting
tis 4 maj 2010 15.10.01 THREADMGMT[t1098918224]: SIH: Idle host scan thread starting [p12407]
tis 4 maj 2010 15.10.01 THREADMGMT[t1098918224]: SIH: Started thread for idle hosts detection
tis 4 maj 2010 15.10.01 THREADMGMT[t1107310928]: DNSAR(1): Address resolution thread running
tis 4 maj 2010 15.10.01 THREADMGMT[t1107310928]: DNSAR(1): Started thread for DNS address resolution
tis 4 maj 2010 15.10.01 THREADMGMT[t1115703632]: DNSAR(2): Address resolution thread running
tis 4 maj 2010 15.10.01 THREADMGMT[t1115703632]: DNSAR(2): Started thread for DNS address resolution
tis 4 maj 2010 15.10.01 THREADMGMT[t1124096336]: DNSAR(3): Address resolution thread running
tis 4 maj 2010 15.10.01 THREADMGMT[t1124096336]: DNSAR(3): Started thread for DNS address resolution
tis 4 maj 2010 15.10.01 Calling plugin start functions (if any)
tis 4 maj 2010 15.10.01 SSL is present but https is disabled: use -W <https port> for enabling it
tis 4 maj 2010 15.10.01 INITWEB: Initializing web server
tis 4 maj 2010 15.10.01 INITWEB: Initializing TCP/IP socket connections for web server
tis 4 maj 2010 15.10.01 **ERROR** INITWEB: binding problem - 'Adressen redan upptagen'(98)
tis 4 maj 2010 15.10.01 Check if another instance of ntop is running
tis 4 maj 2010 15.10.01 or if the current user (-u) can bind to the specified port
tis 4 maj 2010 15.10.01 **FATAL_ERROR** Binding problem, ntop shutting down...
tis 4 maj 2010 15.10.01 CLEANUP[t140238237382368]: ntop caught signal 2
tis 4 maj 2010 15.10.01 THREADMGMT[t140238237382368]: ntop RUNSTATE: SHUTDOWN(7)
tis 4 maj 2010 15.10.01 CLEANUP[t140238237382368] catching thread is unknown
tis 4 maj 2010 15.10.01 CLEANUP: Running threads SFP SIH DNSAR1 DNSAR2 DNSAR3 NPA(eth0)
tis 4 maj 2010 15.10.01 THREADMGMT[t1107310928]: DNSAR(1): Address resolution thread terminated [p12407]
tis 4 maj 2010 15.10.01 Joining thread DNSAR1
tis 4 maj 2010 15.10.01 joinThread() returned Adressen redan upptagen
tis 4 maj 2010 15.10.01 THREADMGMT[t1090525520]: SFP: Fingerprint scan thread running [p12407]
tis 4 maj 2010 15.10.01 THREADMGMT[t1115703632]: DNSAR(2): Address resolution thread terminated [p12407]
tis 4 maj 2010 15.10.01 THREADMGMT[t1098918224]: SIH: Idle host scan thread running [p12407]
tis 4 maj 2010 15.10.01 Joining thread DNSAR2
tis 4 maj 2010 15.10.01 joinThread() returned Adressen redan upptagen
tis 4 maj 2010 15.10.01 THREADMGMT[t1124096336]: DNSAR(3): Address resolution thread terminated [p12407]
tis 4 maj 2010 15.10.01 Joining thread DNSAR3
tis 4 maj 2010 15.10.01 joinThread() returned Adressen redan upptagen
tis 4 maj 2010 15.10.01 Signaling thread NPA(eth0)
tis 4 maj 2010 15.10.01 CLEANUP: Locking purge mutex (may block for a little while)
tis 4 maj 2010 15.10.01 CLEANUP: Locked purge mutex, continuing shutdown
tis 4 maj 2010 15.10.01 CLEANUP: Continues (still running SFP SIH NPA(eth0))
tis 4 maj 2010 15.10.01 FREE_HOST: Start, 1 device(s)
tis 4 maj 2010 15.10.01 FREE_HOST: End, freed 0
tis 4 maj 2010 15.10.01 PLUGIN_TERM: Unloading plugins (if any)
tis 4 maj 2010 15.10.01 THREADMGMT[t1082132816]: NPA: network packet analyzer (eth0) thread terminated [p12407]
tis 4 maj 2010 15.10.01 CLEANUP: Freeing device eth0
tis 4 maj 2010 15.10.01 CLEANUP: Clean up complete
tis 4 maj 2010 15.10.01 THREADMGMT[t140238237382368]: ntop RUNSTATE: TERM(8)
tis 4 maj 2010 15.10.01 CLEANUP[t140238237382368]: Still running threads SFP SIH
tis 4 maj 2010 15.10.01 ===================================
tis 4 maj 2010 15.10.01 ntop is shutdown...
tis 4 maj 2010 15.10.01 ===================================

acid_kewpie · 05-04-2010, 08:47 AM

well as the log there *very* clearly states, something else, maybe another instance of ntop, is already on that port. run "netstat -plnt" or "lsof -i TCP:3000" and see what is hogging it, killing that pid if appropriate.

razzera · 05-04-2010, 09:15 AM

Quote:

Originally Posted by acid_kewpie

well as the log there *very* clearly states, something else, maybe another instance of ntop, is already on that port. run "netstat -plnt" or "lsof -i TCP:3000" and see what is hogging it, killing that pid if appropriate.

server:/# lsof -i TCP:3000
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
ntop 11705 nobody 11u IPv6 3595214 TCP *:3000 (LISTEN)
server:/# kill 11705
server:/# lsof -i TCP:3000
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
ntop 11705 nobody 11u IPv6 3595214 TCP *:3000 (LISTEN)

I cant kill it, not can i restart, stop or start it. i cant access it either. what's wrong here ? :/

acid_kewpie · 05-04-2010, 09:38 AM

what what IS the process? check what that PID is to make it more meaningful. As for killing it, use a -9 on the kill command.