Lion Cipher Lab

Baseline your network traffic with ntopng — then catch the anomaly you plant yourself

• Cyber / Security Engineer
• Intermediate
• ~60 min
• Free · no account required

Why it matters

The first honest answer to 'is this network traffic suspicious?' is almost always another question: 'compared to WHAT?'. You cannot recognise the abnormal until you have seen the normal, and most people have genuinely never looked — they have no idea which handful of hosts do most of the talking on their own network, which protocols dominate, or what a quiet baseline even looks like. ntopng is the cheapest, fastest way to fix that. It is a free, web-based traffic monitor that sits on an interface, watches every packet go by, and turns that firehose into three things a human can actually read:…

What you'll learn

• explaining in plain words what ntopng is: a free, web-based network traffic monitor that watches a live interface, groups packets into flows, and shows you who is talking to whom and over what protocols
• defining the core vocabulary cold — a FLOW (one conversation between two endpoints: same src/dst IP, ports and protocol), a TALKER (a host, ranked by how much traffic it sends/receives), a PROTOCOL (the application it is speaking, e.g. HTTPS/DNS/SSH), and DPI / nDPI (deep packet inspection — ntopng looking inside packets to guess the application, not just trusting the port number)
• installing ntopng from zero — the Docker way (docker run the ntop/ntopng image with --net=host and -i <interface>) and the apt way on Ubuntu — and understanding why it needs to see a real interface
• opening the web UI at http://localhost:3000, logging in with the default admin/admin, and immediately forcing a password change
• reading the dashboard to BUILD A BASELINE: the Top Talkers / Hosts list, the Active Flows table, and the Application Protocols breakdown — so you can state, with numbers, what 'normal' looks like on your own box
• manufacturing an anomaly on your OWN host and finding it: run a quick nmap port scan (a fan of many short flows to many ports) or a repeated curl 'beacon' (a metronomic, regularly-repeating flow) and locate it in Active Flows / Hosts / Alerts
• stating the honest limits out loud: ntopng tells you WHAT is talking, not that it is malicious; absence of an alert is not absence of the activity; DPI can guess wrong and encrypted payloads hide detail; sampling and short retention constrain it
• judgment: ntopng is FLOW VISIBILITY, not an IDS/IPS — when to reach for it (situational awareness, capacity, 'who is this host talking to?') and when to pair it with Suricata or Zeek (which are built to DETECT and to log evidence)

Steps in this lab

1. From zero: what ntopng is, and the four words that unlock it
2. Install ntopng — the Docker way (easiest) or apt on Ubuntu
3. Open the web UI, log in, and change the default password now
4. Build the baseline: read Top Talkers, Active Flows, and Protocols
5. Plant the anomaly on your OWN host: a port scan and a beacon
6. The honest negative: what ntopng did NOT just prove
7. Judgment: flow visibility vs detection — when NOT to use ntopng

Open the full interactive lab →