forked from lucab/ntop
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathChangeLog
1928 lines (1529 loc) · 71.1 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
_ _ _
| \ | | |_ ___ _ __
| \| | __/ _ \| '_ \
| |\ | || (_) | |_) |
|_| \_|\__\___/| .__/
|_|
Network Top
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
ChangeLog
=========
This is the list of all {significant | noteworthy | major | et al } changes
to the ntop source tree.
The file NEWS contains a chronology of releases and major milestone versions.
3.3
=-=
Removed ./configure in favor of ./autogen.sh - see docs/BUILD-NTOP.txt
3.2
=-=
No info here, sorry
3.1
=-=
Biggies --
New look & feel - cascading menus, different colors and logos.
Platforms - ntop has been developed and tested on the following platforms:
- Linux
- MacOS
- Win32 (Visual C++ 6.0, MinGW should again work)
- Solaris 9 (i86 and sparc)
- FreeBSD (4.9+ and 5.3)
- NetBSD (Single Threaded only) - not tested.
- OpenBSD, HP-UX and AIX have some left-over coding/configure
support, but do not work or have not been tested.
Nothing much to ./configure
Added options:
* Added Packet sampling option.
Startup:
* Parts of ntop configuration now stored in prefs database and can be changed
via the web server (effective on the next run).
Protocols:
* Added SCTP support.
* P2P: BitTorrent.
Internals:
* Lots of minor bug fixes for stability, proper/better function, more error
checking, etc.
* Lots of code reorg - into/out of utils, modules split up, RRD constants
moved into rrdPlugin.h from globals-defines.h, etc.
* Internal split into L3 vs. L4 stuff, common tcp security checks, etc.
* Lots of Win32 and VLAN changes.
* The BufferTooShort() logic did not detect problems due to a change
in the way newer glibc reports overflow. This was corrected and a
number of problems were detected/fixed.
* Single-threaded ntop should again compile and work.
* Reduced some memory requrements.
* Better handling if same host is seen in multiple vlans.
* Running ntop from a file should report the time as that of the last packet.
* FibreChanel NS and OS fingerprints are now cached.
* Host information pages offer packet or byte sort options.
* Removed the FILEDESCRIPTORBUG work-around. This makes ntop again sensitive to
the FreeBSD bug bin/51535. ntop will probably NOT work with FreeBSD versions
4.8 and below nor 5.1.
External tools and data files:
* Ettercap - OS fingerprints updated to Ettercap NG.
* Frozen version of rrd is now 1.0.49.
Plugins:
* Re-writes of netFlow and sFlow plugins.
* Removed nfs plugin.
* New SNMP plugin.
3.0 (was going to be 2.3)
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
(Apply Usual-caveats)
Biggies --
IPv6 - code contributed by Olivier Festor <Olivier.Festor at loria.fr> and
Abdelkader Lahmadi <Abdelkader.Lahmadi at loria.fr>
of the MADYNES Research Time (Managing DYnamic NEtworks and Services),
http://madynes.loria.fr/.
FibreChannel and SCSI - code contributed by Dinesh G Dutt <ddutt at cisco.com>
of Cisco.
-x/-X memory limit options - Gianluca Insolvibile <g.insolvibile at cpr.it>
All | Local | Remote selections - Luigi Iotti <luigi at iotti.biz>
Lots of minor bug fixes for stability, proper/better function, more error
checking, etc.
Platforms - ntop has been developed and tested on the following platforms:
- Linux
- MacOS
- Win32 (Visual C++ 6.0, MinGW no longer works after 2.1.3)
- Solaris 8/9 (i86 and sparc)
- FreeBSD (4.x and 5.2)
The web server will deadlock (actually just run incredibly slowly)
unless the --set-pcap-nonblocking option is given at run time.
Lots of credit for wrassling this aligator go to Michal Meloun
<meloun at miracle.cz> and Stanley Hopcroft <Stanley.Hopcroft at
IPAustralia.Gov.AU>
- NetBSD (Single Threaded only)
- OpenBSD 3.4 (and ONLY 3.4) work thanks to lots of effort by
Julien Touche <julien.touche at lycos.com>
- HP-UX and AIX have some left-over coding/configure
support, but do not work or have not been tested.
Another significant update to ./configure
* auto* tools (automake and autoconf) are no longer required.
* Distributed scripts built with:
automake 1.6.3
Autoconf 2.57
libtool 1.4.2
* Most OS/Distribution/Release specific configuration is in the
configureextra/ directory, in files named according to what they
support: <OS>[<distro>][<release>], e.g. SOLARIS, LINUXredhat8.
* export NTOPCONFIGDEBUG=yes to enable the debug stuff (this
now includes improved tracking of the variables set in the
various steps of the ./configure process.
* export NTOPAUTOREBUID=yes to enable the testing of auto* tool
versions and automatic rebuild - IF YOU HAVE THE TOOLS INSTALLED
of the ./configure scripts.
* linuxrelease script - shared with census - to determine (consistently)
the OS/Distro/Release.
* First time install (i.e. create the directory), warn the user that
the ntop user id (-u xxxxx) must be the owner of the directory and
that s/he will have to chown it.
Removed external tools and required libraries:
* lsof
* gdchart - ntop's graph.c is now a completely self-contained graph
creator sufficient (only) for ntop's needs. (still use the gd library)
External data files
* Handle compressed input files.
* Check file to determine if internal database copies need to be
recreated.
* Check age of dns cache and recreate if it's 'old'.
log (traceEvent) messages
* Lots of small cleanups
* --log-extra
1 adds [file:line] to every message.
2 adds a [MSGIDnnnnnnn] to every message.
These tags should (unlike file:line) be stable across ntop
releases.
Removed compile and run-time options:
* MAKE_MICRO_NTOP
* --ignore-sigpipe
* --throughput-bar-chart
* --dynamic-purge-limits
* --large-network | -C
* --enable-external-tools | -E
Added options:
* --spool-file-path | -Q
Allows specification of alternate directory for the 'temporary' database
files (addressQueue.db, dnsCache.db and macPrefix.db) vs. the 'permanent'
ones (prefsCache.db and ntop_pw.db). If --spool-file-path is not
specified, the value for --db-file-path (-P) (or it's CFG_DBFILE_DIR)
default from ./configure is used.
* --disable-instantsessionpurge
Due to a bug, ntop reclassifies a properly closed session to
FLAG_STATE_TIMEOUT. So, at present, ntop doesn't retain session data
for more than a few seconds after the tcp/ip session is terminated.
This corrected behavior is NOT the default, because a large number of
retained sessions can significantly increase the memory usage of the
ntop instance if there are hosts that open/close large #s of sessions
(e.g. a web server).
* (Windows) Now possible to specify the adapter using a numeric identifier
or its name. ntop -h shows list of adapters at end of help text.
* make dnvt and make dnetter now work to download and create the vendor
and Ettercap tables respectively.
Startup:
* ntop tries to be smarter about root/non-root user during startup.
* When ntop is not started as root but it has been installed
with the sicky bit set and root:root as owner, it asks
the root password. If correct, ntop becomes root, does what's
needed, then it changes the uid back to the original user.
* Automatic fall back to our (libiberty) version of getopt_long on
systems where it isn't available in system libraries.
* The various data files can be compressed on disk.
* The various data files are not reloaded if the database file is newer
than the file to load.
* Windows: use pcap_findalldevs() that is the correct way to find devices
with the latest winpcap 3.x.
Security:
* Shed privledges earlier, so that the various files and databases are
read/written as the ntop -u xxxxxx userid, not root.
Internals
* Host hashing removed - no more expands
* Lots of work on threading, better data protection, eliminate
deadlocks, etc.
* Moved the Win32 code closer/more unified with Unix.
* If -g is used, the RRD plugin saves only local hosts
* oui updated to current (IEEE) as of 11Aug2003
* ettercap updated to current (SourceForge) version, dated 08Jul2003
* Added dynamic support for IP-based protocols. This means that protocols
such as OSPF/IGMP are now handled dynamically.
At the moment OSPF/IGMP/IPSEC are "manually" added in main.c.
* Added initial AS (Autonomous System) number support. Several components
(e.g. NetFlow plugin) need to be made AS-aware.
Web Server
* New look for ntop's menus - takes up far less room.
* New 'Log' option shows the last 50 messages ntop sent to the log.
* Show AS numbers on separate page.
* URL security cleanup for better flow - we do not perform processing
on unvalidated (and possibly hostile) data, and we decode %nn values
to their equivalent characters (e.g. %41 becomes A).
* [All][Local Only][Remote Only] options added to most long display lists.
* Update textinfo.html/PR output with new automatically generated lists
of #define symbols. These now automatically #ifdef the symbol so
there should be no undefined symbol problems.
* Drill-down view of unknown protocols.
* MAC addresses are now printed as <hw manufacturer>:XX:XX:XX
netFlow (Plugin)
* netFlow: 'assume high port netflow traffic is ftp' now run time option,
vs. ./configure in 2.2.
* Former ./compile option, --enable-netflowassumeftpdata - is now a run-time
option in the NetFlow plugin.
* Added signal trap in plugin, #define MAKE_WITH_NETFLOWSIGTRAP
rrd (Plugin)
* rrdtool - a frozen and patched copy of rrdtool 1.0.42 is part of ntop
in the myrrd directory. ntop should ignore any installed version.
* Optind is reset to 1 before every getopt_long call - prevent a
random/unpredictable crash inside rrd while parsing options.
* Removed run-time option: --reuse-rrd-graphics.
* Run-time option --enable-largerrdpop is now the default (and only)
supported version.
Note that there is a script @ SourceForge in the user contributed area
to move existing .rrd files into the new structure. Use this script
at your own risk (i.e. backup your data FIRST).
* Permissions for rrd files and directories controlled via plugin
setting.
intop
* Gone. There is a separate, work-in-progress integrated shell
version of ntop, called ntcsh, available from the cvs.
doc
* FAQ has been once again completely updated and revised.
Debugging
* Lots of message cleanup, things that wouldn't compile, etc.
____ ____
|___ \ |___ \
__) | __) |
/ __/_ / __/
=-=-=- |____(_)|_____| =-=-=-=-=-=-=-=-=-=-=-=-=
(Apply Usual-caveats)
Platforms - ntop has been developed and tested on the following platforms
- Linux
- MacOS
- Win32 (MS VC++ 6.0, with some support for MinGW)
- FreeBSD (4.6, 4.7 and 5.0)
- Solaris 8
With other platforms, we've been unable to test (anyone want to pony up
remote root access to systems)? Or, with the assistance of various users
tried and failed. See ./configure --enable-showoses
gdchart et al
- buildAll.sh script has tests for being run in the correct directory.
- buildAll.sh script tests if there is a version of libpng already
installed on the system and deletes the in-tree copy of to prevent
the 1.0.x vs. 1.2.x version conflict.
- Updated in-tree copy of libpng from 1.2.1 to 1.2.4
ntop
- SQL support removed.
- rrd support added (see rrd Plugin below).
- Added ability to configure plugins while inactive.
- Added @<filename> for configuration options.
- Table driven conversion of ip address -> country code replaces
- where available - old gTLD/ccTLG version.
- memory failure trap, allows access to reports after ntop stops
and run time parameter, --disable-stopcap to return to old
behavior.
- Replaced active use of nmap with passive use of ettercap
for OS fingerprinting.
- Automatic creation of problem report skeleton.
- Plugins menu shows plugins disabled due to problems.
- Eliminated (we hope) the requirement for the auto* tools
(autoconf, automake and libtools) to be installed in order
to compile the ntop source.
- Default protocol list (if no -p option) changed to:
FTP=ftp|ftp-data
HTTP=http|www|https|3128 3128 is Squid, the HTTP cache
DNS=name|domain
Telnet=telnet|login
NBios-IP=netbios-ns|netbios-dgm|netbios-ssn
Mail=pop-2|pop-3|pop3|kpop|smtp|imap|imap2
DHCP-BOOTP=67-68
SNMP=snmp|snmp-trap
NNTP=nntp
NFS=mount|pcnfs|bwnfs|nfsd|nfsd-status
X11=6000-6010
SSH=22
Peer-to-Peer Protocols
----------------------
Gnutella=6346|6347|6348
Kazaa=1214
WinMX=6699|7730
DirectConnect=0 Dummy port as this is a pure P2P protocol
eDonkey=4661-4665
Instant Messenger
-----------------
Messenger=1863|5000|5001|5190-5193
- Internal reorg:
* Almost all structures and typedefs moved into new file,
globals-structtypes.h
* Almost all #define values moved into new file,
globals-defines.h
****AND DOCUMENTED****
- Menu changes:
* "HELP" page added to About menu.
* Plugins moved to Admin menu.
* Data Dump added to Admin menu.
* Totals tab/menu added.
* NetFlow moved from Data Sent/Received menu to Totals menu.
* AS and VLAN options added to IP Protocol menu.
* (Access via About -> Configuration) textinfo.html page with
lots of additional information about ntop's configuration.
- ./configure
* TOTAL REWRITE!!!!
* Many more cases of reconfiguration handled automatically.
* New structure.
* Clearly indicated failure messages.
* Support level for various platforms documented.
* ./configure --enable-showoses to view this.
* Requires automake 1.6+ and autoconf 2.5x+.
* Explicit test for matching auto* tools versions. If those
versions do not match - EXACTLY - then the first time you
run ./configure, ntop will delete and recreate ALL of the
generated files and update autotoolversions. You then
need to run ./configure a SECOND time to do the actual
configuration!
* Added tests for lib64 (ia64) in the library searches
- Parameter changes
* REMOVED: -b | --sql-host
* REMOVED: -j | --border-sniffer-mode (see -b, -g, -o and -z)
* REMOVED: -v | --mysql-host
* REMOVED: -S | --store-mode
* ADDED: -b | --disable-decoders
* ADDED: -g | --track-local-hosts
* ADDED: -o | --no-mac
* ADDED: -z | --disable-sessions
* ADDED: -C | --large-network
* ADDED: --dynamic-purge-limits (Host purge time limit)
* ADDED: --reuse-rrd-graphics
* ADDED: --p3p-cp
* ADDED: --p3p-uri
* ADDED: --xmlfileout
* ADDED: --xmlfilesnap
* ADDED: --xmlfilein
* ADDED: --disable-stopcap
- Unrecognized options are printed with a warning message/hint.
- Misc. enhancements
- traceEvent() message cleanup - many now clearly indicate their cause.
- Added ALWAYS and NOISY class so -t 0 and -t 4 are meaningful and
still show what they have to.
- DEBUG cleanup - multiple options, indicated as xxx_DEBUG in log.
- ntop heartbeat - periodic log messages to show it's still running.
- long options work on all platforms.
- Traps and errors if no password when running in daemon mode.
- Minimum password now 5 characters.
- Python format data dump.
- gdchart watchdog - catches libpng conflicts and other problems and
returns.
an error graphic to the user.
- Hooks for P3P support (and tolerates AT&T PrivacyBird)
- P2P knowledgeable about Gnutella, Kazaa, WinMX and DirectConnect.
- Knowledgeable about ftp and smtp/pop/imap
- host names are color coded indicating how long ago they were first seen.
- Pie charts made 2D (from 3D) for readability and tiny slices suppressed.
- showPortTraffic report added.
- Human friendly interface names under Windows.
- Additional information during ntop startup (interface type,
daemoninzing, etc.).
- ntop will not allow itself to run as root, except if EXPLICITLY
requested via -u root option.
- Added Local Hosts Statistics to Stats menu tab.
- --use-syslog and --set-admin-password warn if they do not have a
provided value (which is often a sign of a missing =).
- Tests for lsof to make sure they're executable and suid root.
- Added Ip protos R->R list
- Memory usage reduction and optimization (e.g. don't allocate space
for obscure counters until you need them, etc.)
- ssl random seed initialization if OS doesn't do it.
- PPPoE encapsulated traffic is now understood.
- Static plugins via ./configure --enable-static-plugins and then
make sntop
- Vendor lookup table moved from static .h to file, with mini
file provided and ability to download full file from IEEE.
- p3p... added parameters to set p3p header values cp= and policyref=
Also added ability to return default p3p file upon request from
browser.
NOTE: there is no sample file provided. This is not an
oversight. After careful consideration, we are not
providing one. The reason is that a .p3p file is
intended to be a legal contract between your site
and your users.
- Limited - VERY LIMITED - i18n support
- Bare bones for a new xml dump facility to dump all internal data.
- Notable performance and bug fixes
- Lots of crash cleanups, buffer overflows, etc.
- Memory leaks repaired
- Fixed deadlock and 'un-locked' mutex problems! Yea Luca!!
netFlow (Plugin)
- netFlow now updates the traffic matrix.
- netFlow has white/black list to control what hosts are updated.
- Accepts v7 flows (converts to v5 for internal processing)
- Added specification of the local network for netFlow devices.
- Fixed double counting of bytes/packets send/received.
- Added an OPTION to count unclassified traffic as ftp-data.
sFlow (Plugin)
- Added specification of the local network for sFlow devices.
rrd (Plugin)
- replaces sql for long-term persistent storage.
- ntop now creates multiple RRA (round robin archives), which
allow for a (user configurable) number of years of daily data
to be recorded.
- ./configure --enable-largerrdpop so .rrd files are created in
a a/b/c/d directory structure vs a.b.c.d (one level) - gets
past the Liunx 32K files/directory limit.
- Fixed rrd bug when same host seen on multiple interfaces - made
the files per interface.
intop
- Should work - no promises.
doc
- FAQ has been revised, updated and more than doubled in size.
- ntop-autotools.vsd and .pdf added - shows the flow of auto* tools,
including ./configure and make
____ __
|___ \ / |
__) | | |
/ __/_ | |
=-=-=- |____(_)|_| =-=-=-=-=-=-=-=-=-=-=-=-=
(With the caveat that this is based almost exclusively on
my manual reading of the source diffs, here is what's changed
in ntop between 2.0 and 2.1...
The dividing line between major and minor is arbitrary and my
own choices.
The order is arbitrary
-----Burton)
Major items
1. zlib updated to v1.1.4
2. libpng update to v1.2.1
3. intop is largely unsupported. It compiles, but was not tested in v2.1.
4. rmonPlugin moved to /obsolete directory (i.e. no longer supported)
5. wapPlugin moved to /obsolete directory (i.e. no longer supported)
6. sflowPlugin added
7. netflowPlugin added
8. pdaPlugin added
9. myGlobals - a huge # of global items were moved into a single
myGlobals.xxxx structure (New header file is globals.h, removed
from ntop.h, globals-core.h and globals-report.h) (See
initNtopGlobals() in globals-core.c for much of the initialization).
10. Generated charts are returned via the http:// stream instead of
returning the name of a temporary file.
11. The erroneous message "Buffer overflow!" has been replaced by a
BufferTooShort() macro, which gives an appropriate message.
12. Rules removed - ntop-rules.8, event.c, rules.c, rules.h and rules.sample
moved to /obsolete
12a. An /obsolete directory was added for code no longer supported or
even minimally maintained, but perhaps of historical interest.
13. Documentation (ntop.8, ntop.txt and ntop.html) updated to reflect
command line parameter changes.
14. Long options (e.g. --trace-level) added, along with ./configure tests
for getopt_long. Most parallel existing short options, but a few are
unique to long options or (--use-syslog= and --set-admin-password=)
are different from their corresponding short options.
15. Code and ./configure test added to correctly handle endianness
(NTOP_BIG_ENDIAN and/or NTOP_LITTLE_ENDIAN parameters).
16. ntop can now return http:// responses using zlib compression
(HAVE_ZLIB). Test for -lz (specifically gzopen) added to ./configure.
17. (except for WIN32) ntop now prompts the user to set the admin password
on the 1st run, vs. having a fixed (known) value.
18. XML output added to dump reports (emitter.c).
19. A huge number of Segmentation Fault problems were removed by a total
rewrite of the hashing routines, including elimination of the shrinkage
capability. Ntop's pattern of expansion of the hash table was modified
to better reflect real-world usage (see note on textinfo.html page).
Includes things like eliminating notifyPluginsHashResize().
20. URLsecurity updated to handle the RFC1945 set of invalid characters.
21. -j (also --border-sniffer-mode) ****
-j is used when you are starting ntop on a mirrored
interface where you cannot trust MAC addresses.
Note that:
1. -j usually requires you to specify the local network
(-m) as a mirrored interface might have a
wrong/ip-less/private IP address.
2. -j disables some features as TCP session tracking etc.
In future versions -j will disappear and it will be replaced
with more granlar flags for better controlling all these options.
22. -A (accuracy level) switch removed. Code remains in initialize.c
in initGlobalValues() if somebody needs to manually enable this.
23. ntop will not let itself implicitly run as root. To run as root,
with all the risks that entails, you must explicitly give the
-u root command line parameter.
24. netflow.c (the code that creates and sends netflow packets from
ntop to another collector) was re-written to support multiple
flows per packet.
25. A change to the logic allows the protocol file (-p option) to span multiple
lines and ignore comments (anything after a #) in it.
26. (MinGW) ntop now runs as a Windows service. ntop /i installs it, ntop /r
deletes it, ntop /c runs immediately.
For /i and /c, follow them with a normal ntop parameter set, e.g. -i1 -w 3000...
27. Reporting logic was reworked to fix up a bunch of sorting errors.
28. "Service/Port Usage" and "Recently Used Ports" added to host report.
29. syslog(..) call fix - corrected a security issue discussed on BugTraq.
30. Improved ntop's calls to cgi routines.
31. Fixed http:// and https:// handlers so that -w ip:port and -W ip:port bind
only to the selected address.
Minor items
1. gdchart0.94c - buildAll.sh updated to build the subordinate products for Sun
and Mac OS X.
2. Definition of mySQL/postgres table IPtraffic (in database\mySQLdefs.txt and
database\pg_SQLdefs.txt) updated to match code.
3. docs\ files added: BUG_REPORT and 1STRUN.txt
4. html files updated to be both W3C HTML4.01 compliant
(most of them, for those that aren't a w3c alternate file is provided)
and to support both older browsers and style sheets. Makes for messy html, but
it does pass the standards check at w3c.org!
5. Temporary file names for charts are now randomly named
(except under WIN32 which uses the socket #)
6. make ntop.html updated so it works and creates BOTH copies, ntop.html
and html/ntop.html.
7. make install-data-local updated to add $(DESTDIR) for rpm creation.
8. www/Perl/mapper.pl updated for new URL and query format.
9. Bytes Sent & Bytes Rcvd added to icmp Plugin report.
10. Logging of suspicious packets in logger.db (not the storing of packets
themselves, but the message: "Detected overlapping packet fragment [xx->xx]:
fragment id=#, actual offset=#, previous offset=#"
was removed, logger.c moved to /obsolete.
11. vendortable.h updated to an early June 2002 IEEE file.
12. If available (gcc only), and if the -K command line is set, ntop will automatically
generate a backtrace (stack trace) upon a segnetation fault.
13. IBM AIX configuration (enable_shared=no, enable_static=yes) removed.
AM_ENABLE_SHARED made default for all configurations.
14. Option descriptions for ./configure --help make clearer.
15. Test for gethostbyaddr_r added to ./configure and code which uses the right
version is in address.c.
16. pep Plugin is not compiled by default. Requires change to configure.am to
re-enable.
17. ltmain.sh updated for Darwin (MAC OS X).
18. Session specific code moved out of pbuf.c (and other places) into new file,
sessions.c.
19. Threading problem resolved in address.c, resolveAddress() function.
20. cleanupHostEntries() thread now sleeps until specified interval elapses
(caused 100% cpu usage problem).
21. Napster specific coding removed.
22. --throughput-bar-chart option added to allow for BAR vs. AREA charts.
23. Packet TTL pie chart (pktTTLDistribPie()) added to Global Traffic Statistics
report.
24. info.html improved and textinfo.html (suitable for bug reports) added.
25. getHostInfo() moved from pbuf.c to hash.c
26. ntop generates titles, ALT tags on images, etc. on the html pages.
27. favicon.ico added.
28. hostsDistanceChart added to Global Traffic Statistics (based on ttl).
29. hostTrafficDistrib, hostFragmentDistrib, hostTotalFragmentDistrib and
hostIPTrafficDistrib charts added.
30. dumpFlows.html added.
31. Ring buffer (size MAX_NUM_BAD_IP_ADDRESSES) added of addresses which
have sent us bad requests (URLsecurity).
Any request from that IP is ignored for five minutes or until the ring
buffer wraps around.
Note that this is NOT a security issue, we're just choosing to stop
wasting processing cycles for bad guys early in the process instead
of after finding another bad URL. That is a string of bad ones won't
get anything MORE out of ntop - either a 404 or no response, depending
on the ring buffer. Don't like it? There is a #define constant to
turn it off.
32. HTS - Host Traffic Statistics thread removed.
33. TU - Throughput Update (optional) thread removed.
34. SIH - Scan Idle Hosts (optional) 2nd thread (scanIdleSessionsLoop) removed.
35. DNSAR - DNS Address Resolution (optional) thread permits multiple instances
(MAX_NUM_DEQUEUE_THREADS). ntop ships with this set to 1 and larger values
may not have been well tested.
36. ntop always creates at least one device (a dummy) so that it won't crash
if there are no interfaces. This is most common when using sFlow/netFlow
without local monitoring.
37. myGlobals.pcapLogBasePath (DBFILE_DIR) added to (optional) pcaplog and
ntop-suspicious-pkts output file names.
38. Default protocol list (if no -p option) changed to:
FTP: ftp|ftp-data|
HTTP: http|www|https|3128|
DNS: name|domain|
Telnet: telnet|login|
NBios-IP: netbios-ns|netbios-dgm|netbios-ssn|
Mail: pop-2|pop-3|pop3|kpop|smtp|imap|imap2|
DHCP/BOOTP: 67-68|
SNMP: snmp|snmp-trap|
NNTP: nntp|
NFS: mount|pcnfs|bwnfs|nfsd|nfsd-status|
X11: 6000-6010|
SSH: 22|
Gnutella: 6346|6347|6348|
Morpheus: 1214|
WinMX: 6699|7730|
Audiogalaxy: 41000-41900|
39. scanTimedoutTCPSessions() moved from pbuf.c to sessions.c.
40. updateOSName() moved from pbuf.c to util.c
41. Improvements in handling bootp/dhcp packets.
42. DNS sniffing igores .arpa responses.
43. A number of longer reports are now paged with prev/next first/last buttons.
44. "Local Subnet Routers" are reported only if we're trusting the MAC
address (i.e. not border sniffer mode).
45. Debug logic, printSession(), printSessions() and printTCPSessions() removed.
46. A "Remote Traffic" section was added to the "IP Protocol Distribution" report.
If ntop is sitting on a backbone or wan link with lots of traffic remote to
remote, this can be interesting. For most users it's useless. (I'm allowed to
dis it, it's my own code -----Burton)
47. A lot of minor name cleanup for consistency (i.e. Rcvd everywhere instead of
some being Received).
48. ICMP statistics ("ICMP Traffic") added to "Info about host" report.
49. Whois link to http://www.radb.net/cgi-bin/radb/whois.cgi added to "Info about
host" report.
50. Host Traffic History added.
51. If SSL is compiled in, but there is no -W command line parameter, an
informational message is printed during startup.
52. Peak throughput calculation - fixed a one period lag, vs. average.
53. Added error messages for allocation and mutexes - to make future
troubleshooting easier.
54. Fix trace level handler so values other than 3 work.
55. updateOSName(), _incrementUsageCounter(), moved from pbuf.c to util.c.
56. Added routines to store plugin settings/preferences in a database
between runS.
57. Fixed up ntop "sleep" routine to handle interrupts.
58. Added note to "Switch NIC" to explain: Note that the netFlow and
sFlow plugins - if enabled - force -M to be set (i.e. they disable
interface merging).
59. Moved usage() from webInterface.c to main.c
60. Hash table extend sizing now parameterized AND explained in ntop.h
61. --no-admin-password-hint option was removed in favor of NO predictable
default and with the -A option to make it cleaner to set the default.
____ ___
POST |___ \ / _ \
__) | | | |
/ __/_ | | |
=-=-=- |____(_)|___/ =-=-=-=-=-=-=-=-=-=-=-=-=
through 12Feb2002
Traffic classification fixed (was classifying most as remote)
through 06Feb2002
sFlowPlugin
through 04Feb2002
Long options: There are now long option name equivalents for all of the ntop options
(e.g. -p and --protocols). Run ntop with a bum option to get the list.
--no-admin-password-hint option, removes the hint on the password entry dialog box
--throughput-bar-chart, makes the throughput charts of bar vs. area type
New pie chart showing the distribution of packet TTS, on the Stats tab, Traffic report
Longer reports are now paged.
If ntop doesn't like an option, it will now tell you what it didn't like:
FATAL ERROR: unknown ntop option, 'xxxx'
Default protocols are added to the monitoring list ONLY if we have nothing from the user.
The list of protocols (-p | --protocols option), if placed into a file, may now be on multiple lines.
The number of IP protocols being monitored was added to the configuration report.
The default protocol list includes three additional peer-to-peers:
handleProtocolList("Gnutella", "6346|6347|6348|");
handleProtocolList("Morpheus", "1214|");
handleProtocolList("WinMX", "6699|7730|")
Idle session timeout (IDLE_SESSION_TIMEOUT) was changed from 30 to 10 minutes.
Handle UDP traffic is handled like TCP traffic - that is: if we know about the lower# port, even if
it's the destination, classify the traffic that way.
Average packet length approximation in the Stats | Traffic report was fixed.
wheel.gif become antenna.gif for DHCP servers.
--border-sniffer-mode (also -j) - for using ntop in a switched environment, where the traffic is
being mirrored for monitoring, this makes ntop less dependend on the MAC addresses.
____ ___
|___ \ / _ \
__) | | | |
/ __/_ | | |
=-=-=- |____(_)|___/ =-=-=-=-=-=-=-=-=-=-=-=-=
2.0 Released 27Dec2001
- Major improvements, too many to list
1.2a13 [Snapshot]
Fixed bugs:
- Fixed PPP compatibility glitch
_ _____
_ _____
/ | |___ /
| | |_ \
| |_ ___) |
=-=-=- |_(_)____/ =-=-=-=-=-=-=-=-=-=-=-=-=
1.3a0 [Snapshot]
- better GNU autoconf-ified distribution
- include initial release of NtoPerl module
_ ____
/ | |___ \
| | __) |
| |_ / __/
=-=-=- |_(_)_____| =-=-=-=-=-=-=-=-=-=-=-=-=
1.2a13 [Snapshot]
Fixed bugs:
- Fixed PPP compatibility glitch
- Various fixes
(Courtesy of Andreas Pfaller <[email protected]>)
- Fixed a mutex bug that cause ntop HTML interface to lock
- Thpt graphs didn't show the right value (graphs where
compressed 8x)
- Fixed a bug in configure that prevented it to
recognise user specified directories
(e.g. --with-gdbm=...)
- Added a fix for address resolution
(Courtesy of Andreas Pfaller <[email protected]>)
- Several fixes about address resolution and
(Courtesy of Ralf Amandi <[email protected]>)
- Fixed a bug (that caused a core) in the icmpPlugin when
ntop receives fragmented ICMP packets.
- Added fix for 1) better handling fragmented packets and
2) improving fragment lookup speed.
(Courtesy of Andreas Pfaller <[email protected]>)
- Added further Suse fixes
(Courtesy of Ralf Amandi <[email protected]>)
- Fixed NFS plugin bug
(Courtesy of Scott Hebert <[email protected]>)
- Fixed incompatibility with interfaces
without an IP address associated (e.g. bridge)
(Courtesy of Diana Eichert <[email protected]>)
- ntop used to crash in interactive mode while
reading from a pcap capture file
(Courtesy of John Bates <[email protected]>)
- Fixed an incorrect MIME type on icmpPlugin
- The 'Shutdown ntop' menu entry is now protected
by default
- Fixed MTU size check
(Courtesy of Andreas Pfaller <[email protected]>)
- Fixed a security flaw: ntop now check whether the
requested URL does not contains strings such as '..'
that may violate system security.
(Courtesy of Vanja Hrustic <[email protected]>)
- On the left HTML frame a link to a non JavaScript
menu has been added. ntop can now be used
confortably by non JavaScript-enabled browsers.
(Courtesy of Boja Morcos <????????????????>)
- nmap, neped and lsof are now searched in the
PATH at ntop startup and no longer by the
configure script.
- Fixed a bug in the lsof handling code.
(Courtesy of Ralf Amandi <[email protected]>)
- Fixed several small problems in the SQL code
(Courtesy of Ralf Amandi <[email protected]>)
- Fixed a bug in the code that compares the captured
packet size with the MTU of the capture device.
- Fixed a bug that prevented ntop to properly
handle multiple capture devices
- ntop/Linux: the libnsl -if present- is included
because is needed on some distributions
such as RH
(Courtesy of Brian Bothwell <[email protected]>)
- Added a few fixes to the installer/Makefile
and compatibility issues with FreeBSD
(Courtesy of Borja Marcos <[email protected]>)
- Fixed yet another small glitch that might cause ntop
to crash under heavily loaded networks.
- Fixed a bug in the Makefile 'clean'
(Courtesy of Anthony David <[email protected]>)
- Fixed a bug that prevented virtual interfaces
(e.g. eth0:0) to be properly handled by ntop.
Enhancements:
- Removed '-a' flag: ntop recognises automatically
multihomed interfaces.
- Added QNX support
(Courtesy of Andreas Pfaller <[email protected]>)
- Actual throughput is now calculated everytime
statistics are displayed
- Added Packets/sec 'Traffic Stats'
(Courtesy of Ted Staberow <[email protected]>)
- Modified HostTraffic typedef: 20% memory
saving for each hash bucket.
- Service/Port Usage table, now reports traffic for
each protocol.
- added localhost.gif icon for RH hosts with no
domain set
(Courtesy of Kashif Rashid <[email protected]>)
- ntop not implements filter rules (-R flag).
- ntop+SSL has now a new certificate that does no
longer require a password at startup.
(Courtesy of Ralf Amandi <[email protected]>)
- Enhanced the SuSe package
(Courtesy of Ralf Amandi <[email protected]>)