Ntopng questions

Networking & Firewalls
#1

I just installed ntopng, 100% new to this and mostly new to pfsense in general. I am seeing lots of fun alerts and I am not sure if they should be of concern or not… things like this:

image
image3336×302 29.2 KB

I am trying to understand what these mean, and if they are issues I should act upon. I have only opened a single port to the outside word (besides the two that I believe ovpn setup on its own when creating a site to site VPN and a VPN connection to remote into my network with. Just trying to have a better understanding of what I am looking at, and hopefully ease my concern as warnings within networking tools showing connections I don’t know about are obviously concerning - but I am also a noob and am not sure what I am looking at.

#2

Second Image (I can’t paste more than 1 image per post… still a noob 'round these parts).

image
image1199×442 30.2 KB

#3
#4

I am still rather confused here. Clicking on any of the “Broadcast Domain”'s in the interface’s section besides my known ISP’s IP, they all “No results found”. I don’t fully understand why there would be “ghost networks” on WAN. Is this just a function of things attempting to hit WAN and being blocked as they should be?

I still have a lot of learning to do with this plugin. Definitely have some youtube watching to do + some reading, but would like to understand what I am looking at here with these warnings.

Also just of quick note, your YT channel did get me using pfsense, setting up site to site VPN’s, vlans, etc (all just for fun homelab usage), so, genuinely, thank you for what you provide - its invaluable :slight_smile:

#5

Check the ARP table in pfsense and see if there are any entries. ARP Table — pfSense Documentation

#6

Hmm, no entries matching what I see in ntopng, but another strange thing is happening. I see an IP address in the ARP table that keeps popping in and out on one of my subnets, mac address is “(incomplete)”, no hostname, and no status. with Link Type ethernet . What exactly am I even looking at here? I am not sure what device this is as this particular subnet is my homelab network… I definitely know what all of the devices there are, and I do not know what this is. Doesn’t show up in the DHCP list which suggests its not getting a IP through DHCP.

If I go to Diagnostics → states, I do see some udp traffic from this windows PC (20.152) I am using to type this… but I have no idea what machine that this Windows machine is seemingly reaching out to (21.15). I tried to ping it from my PC, I get nothing in return.

image
image1151×185 7.31 KB

Nothing in my homelab is on 21.15 that I know of. The rabbit hole only gets deeper…

Also just to clarify, if I don’t see any ARP hits for the ntop IP’s in question, I should be fine? In ntop they are on my WAN network, but I don’t fully understand what a ghost network would be on WAN.

#7

Probably something your ISP is doing and as long as you don’t have a WAN rule allowing that network to route inward it should be fine.

1 Like