---
name: ntopng-admin
description: Professional network monitoring and device identification using ntopng Redis data. Designed for security auditing and diagnostic environments.
metadata:
  openclaw:
    disableModelInvocation: true
    requires:
      bins: ["ssh", "jq"]
      env: ["OPNSENSE_HOST", "OPNSENSE_SSH_PORT", "NTOP_INSECURE"]
---

# ntopng Network Monitor (Secure Edition)

A powerful network auditing tool that queries ntopng data directly from Redis via a secure SSH tunnel. This skill is built for network administrators and security professionals who need high-visibility into local network traffic.

## ⚠️ High Privilege Warning & Responsible Use

**PROCEED WITH CAUTION:** This skill performs high-privilege operations, including executing commands on your network gateway via SSH and reading internal network states. 

1.  **Strict Audit Only:** Intended for Lab, Test, or controlled Audit environments. Avoid use in critical production systems unless the agent's access is strictly isolated.
2.  **Explicit Consent:** By default, autonomous invocation is disabled. You must manually approve each query to maintain full oversight of the data being accessed.
3.  **Security Posture:** This tool uses SSH Key Authentication. Never use plain-text passwords. Ensure your SSH keys are protected with passphrases where applicable.
4.  **Data Sensitivity:** Be aware that this tool exposes MAC addresses, internal IPs, and connection metadata. Handle output with the same care as your network configuration files.

## Prerequisites

*   **SSH Key Access:** Public key authentication must be configured between the OpenClaw host and the OPNsense/ntopng host.
*   **Binaries:** `ssh` and `jq` must be available in the local environment.
*   **Backend:** ntopng must be running with Redis persistence enabled on the target host.

## Configuration

Declare these variables in your environment or agent configuration:

| Variable | Description | Default |
|----------|-------------|---------|
| `OPNSENSE_HOST` | Target gateway IP or hostname | `192.168.1.1` |
| `OPNSENSE_SSH_PORT` | SSH service port | `50222` |
| `NTOP_INSECURE` | Set to `true` for self-signed certificates (if applicable) | `false` |

## Available Commands

The helper script `scripts/ntopng-helper.sh` provides safe, read-only data extraction:

### 1. Network Inventory
```bash
./scripts/ntopng-helper.sh list [limit]
```
Lists detected devices with MAC, IP, total traffic volume, and last-seen timestamps.

### 2. Device Forensics
```bash
./scripts/ntopng-helper.sh device-info <ip|mac>
```
Provides granular traffic breakdown, packet counts, and inferred device classification.

### 3. Connection Audit
```bash
./scripts/ntopng-helper.sh connections <ip> [sample_size]
```
Extracts a sample of external domains contacted by a specific device from ntopng logs.

### 4. Health & Statistics
```bash
./scripts/ntopng-helper.sh status   # Verifies the ntopng service state
./scripts/ntopng-helper.sh stats    # Global network device counts
```

## Data Interpretation Guide

*   **Exfiltration Pattern:** An Upload:Download ratio higher than 5:1 on a non-server device is a high-priority anomaly.
*   **Device Spoofing:** Unexpected MAC addresses or MACs with the `DE:AD:BE:EF` prefix (often VPN/Tunnel interfaces) should be verified.
*   **Protocol Anomalies:** Use the `app` command to detect devices using protocols that violate your local security policy (e.g., unexpected SSH or HTTP servers).

## Security Implementation

- **No Secret Leaking:** Scripts are hardened to never echo credentials or sensitive environment variables.
- **Input Sanitization:** Arguments are filtered to prevent shell injection attempts.
- **Secure by Default:** SSL verification is active unless explicitly overridden for lab use.


---
Source attribution: modbender
Original project: https://github.com/modbender/skill-library-mcp/blob/d9c8fe903b5b4e82237dbe8d0df8567783022e18/data/ntopng-admin/SKILL.md
License: MIT
License information: https://opensource.org/license/mit
Original upstream instructions; downloaded from Mega AI Hub.

## Upstream license notice

MIT License

Copyright (c) 2025 skill-library-mcp contributors

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.



# Mega AI Hub resource metadata

Creator / publisher: modbender
Original project: https://github.com/modbender/skill-library-mcp/blob/d9c8fe903b5b4e82237dbe8d0df8567783022e18/data/ntopng-admin/SKILL.md
Attribution basis: Source repository record

Fields of work: Development & Engineering, Operations
Roles: IT Operations, Security Engineer
Specialties: Specialty not specified
Tools: Jq, Ntopng, Ssh
Country applicability: Country not specified
Classification basis: Source catalog labels
Instruction SHA-256: 5ed76d81b20a2c0fde30f93c39fe011ba498aa01b804931456f26d9fc329e545