How to Monitor Network Traffic on Raspberry Pi

August 22, 2023


Network monitoring is crucial for the Raspberry PI network's security and stability. The process allows users to identify potential problems, such as slow performance or security breaches, and take corrective action.

This guide teaches you how to monitor network traffic on Raspberry Pi using Ntop and Darkstat.

How to Monitor Network Traffic on Raspberry Pi


Note: Before installation, update and upgrade your system with sudo apt update && sudo apt upgrade.

Monitor Network Traffic Using Ntop

Ntop is a free and open-source network traffic monitoring tool. The utility tracks bandwidth usage, identifies bottlenecks, and monitors network performance and system health.

Ntop improves the performance and security of any network. The following text elaborates on how to set up Ntop in a Raspberry PI system.

Step 1: Download Ntop Package

Download the Ntop deb package for the Raspberry Pi from the official website. To accomplish this, use the wget command:

Download Ntop package

Note: The official download links change over time. Make sure to check if the current link does not work.

Step 2: Install Ntop deb Package

To install the previously downloaded Ntop deb package, run the following: 

sudo apt install ./apt-ntop. deb
Ntop install package

After completing this step, update the repository once again:

sudo apt update
sudo apt update terminal output

Step 3: Install Additional Packages

Next, install additional packages which complement Ntop. Once installed, the packages provide:

  • Ntopng. This web-based monitoring application allows users to visualize and analyze network traffic data.
  • Nprobe. The network probe, which collects network traffic data from various sources.
  • n2n. The firewall bypassing tool.

To install the packages, run:

sudo apt install ntopng nprobe n2n
Install additional packages

Wait until the output shows the process is done.

Step 4: Configure Ntopng

After installing Ntopng, configure the program to use the correct network interface and port number. The process requires changing the Ntopng configuration file.

Note: Run ifconfig to verify the correct network interface.

To make changes in the Ntopng configuration file:

1. Open the Ntopng config file in a text editor of choice. This tutorial uses nano.

sudo nano /etc/ntopng/ntopng.conf
Access Ntop configuration file

2. Find and uncomment the following lines:


3. Find the Interface section.

4. Change the -i section to match the interface name. For example, wlan0:

If you use a different network interface, replace the wlan0 with the interface name you want to monitor.

5. Save and exit the file.

Step 5: Edit Network Interface and IP Range

Specify the IP range and the network interface that the Ntopng service will monitor. Edit the ntopng.start file to configure the parameters:

1. Open the ntopng.start file in a text editor:

sudo nano /etc/ntopng/ntopng.start

2. Add the following:

--local-networks "[your IP range]"

Add the IP range that is a part of your local network. This tells the tool how to differentiate between internal and external traffic and to provide information on the internal network traffic.

--interface ["your interface"]
Ntop config file adding lines

3. Save and exit the file.

Step 6: Start ntop

After performing the configuration step, start the Ntopng service on the Raspberry Pi. Run the following command:

sudo systemctl start ntopng
Starting Ntop

The command shows no output.

Step 7: Access the Web Interface

To access the Ntopng web interface:

1. Open any browser and type the address https://Pi-IP:3000 to open the Ntopng login page:

Ntop login screen

2. Type the default username and password as admin.

3. Click the Login button.

4. Change the default password.

5. Once logged in, click on the Dashboard icon and switch to Traffic Dashboard:

Switching to traffic dashboard

Now, monitor the network using the Ntop Traffic Dashboard.

Network interface

Monitor Network Traffic using Darkstat

Another option to monitor network traffic on Raspberry Pi is Darkstat. Darkstat is a lightweight, real-time network traffic monitoring tool that runs in the background on the Raspberry Pi.

The utility captures network traffic, calculates statistics, and provides a web interface for viewing the data in graphs. Darkstat also supports IPv6.

The following sections provide a step-by-step guide to installing Darkstat on the Raspberry Pi.

Step 1: Install Darkstat on Raspberry Pi

It's easier to install Darkstat than Ntop since the Darkstat repository is already included in the official Raspberry Pi repository list.

To install Darkstat on Raspberry Pi, use the following command:

sudo apt install darkstat
Install Darkstat

Verify the installation is complete by checking the Darkstat version:

darkstat --version
Darkstat checking version

Step 2: Modify Darkstat Configuration

To change the Darkstat configuration file on Raspberry Pi, follow these steps:

1. Access the file using a text editor:

sudo nano /etc/darkstat/init.cfg

2. Find the following section:

Access Darkstat config file

3. Change no to yes.

Changing Darkstat config file

4. Find the INTERFACE section:

INTERFACE="-i [interface name]"
Finding Interface section in Darkstat config file

5. Change the interface name to the interface you want to monitor. For example, enter wlan0

Darkstat changing interface section in config file

Step 3: Restart Darkstat

To continue, run systemctl restart:

sudo systemctl restart darkstat

The command shows no output. 

Step 4: Verify the Darkstat is Running

The last part before accessing the Darkstat web interface is to verify the service is active. 

To do so, enter:

sudo systemctl status darkstat
Checking Darkstat status

The output shows the green active (running) status for the program.

Step 5: Access Darkstat Web Interface 

To access Darkstat, follow these steps:

1. Run the hostname command to find the Raspberry Pi IP address:

hostname -I
hostname -I terminal output

The local address in this example is

2. Use the following syntax to access Darkstat:


Replace the [hostaddress] parameter with the Raspberry Pi IP address.

In this example, the address we used in a web browser is:

The browser accesses Darkstat. The web interface shows the network traffic at different timings and ensures a successful Darkstat service setup on the Raspberry Pi device.

Darkstat web interface


After reading this article, you now know how to monitor traffic on Raspberry Pi.

Next, learn how to update your Raspberry Pi system.

Was this article helpful?
Sara Zivanov
Sara Zivanov is a technical writer at phoenixNAP who is passionate about making high-tech concepts accessible to everyone. Her experience as a content writer and her background in Engineering and Project Management allows her to streamline complex processes and make them user-friendly through her content.
Next you should read
How to Set Up Static IP Address for Raspberry Pi
February 22, 2023

Setting up a static local network IP address on a device ensures that its location on the network persists across reboots. Static IPs are especially useful when accessing devices remotely (e.g., over SSH). This tutorial shows...
Read more
How to Set up FTP Server on Your Raspberry Pi
April 6, 2021

FTP (File Transfer Protocol) is a network protocol used to transfer files between two machines. Raspberry Pi can be used as an affordable FTP server. In this tutorial, you will learn to set up an FTP server on your...
Read more
How to Install Java on Raspberry Pi
April 25, 2020

This article guides you through the Java installation process on Raspberry Pi. You will also learn how to set the system-wide Java version in use as well as define the JAVA_HOME path environment variable...
Read more
How to Enable SSH on Raspberry Pi
February 12, 2020

This article shows you how to enable SSH on your Raspberry Pi using different methods. The guide also provides an essential tip on how to improve the security of your Raspberry Pi device. If you are not sure how to SSH into...
Read more