I constructed a Raspberry Pi “Black Field” that information all the pieces on my house community

My house community has grown right into a small lab with computer systems, digital machines, storage gadgets, and loads of different issues that sometimes determine to behave unusually. When one thing goes unsuitable, determining what occurred will be troublesome as a result of the helpful data might already be gone by the point I begin investigating.

I needed a small machine that might quietly watch the community and maintain sufficient data round to assist me perceive what occurred. I already had a Raspberry Pi 5 with 8GB of RAM and a 128GB SSD, so I made a decision to show it right into a community black field utilizing Docker and ntopng.

The Raspberry Pi turns into a community observer

I used a headless raspberry pi

The Raspberry Pi 5 is working the 64-bit headless model of Raspberry Pi OS. There isn’t any desktop setting, which is okay as a result of I can configure all the pieces over SSH and entry ntopng by means of its internet interface. The SSD provides me a significantly better place to maintain utility knowledge and historic community data than a microSD card. I additionally use fan cooling as a result of this Pi can be processing community site visitors constantly.

The solely different necessary piece of {hardware} is a managed swap with port mirroring. The Raspberry Pi doesn’t sit between my router and the remainder of the community. Instead, I configure my managed swap to reflect site visitors to the Pi’s Ethernet port. The swap continues forwarding regular site visitors whereas sending a duplicate to the Raspberry Pi. That means the monitoring system can reboot or cease working with out taking my community down with it.

Docker runs ntopng

Installing the container

ntopng is an open-source community site visitors monitoring software that turns community site visitors into a visible dashboard. It can present related hosts, bandwidth utilization, protocols, functions, site visitors flows, and historic exercise, making it simpler to grasp what is going on throughout a community with out manually inspecting packet captures. For this undertaking, ntopng turns the site visitors copied from my managed swap into one thing I can examine in an internet browser. I put in Docker on the headless Raspberry Pi OS system and created a listing for the undertaking:

curl -fsSL https://get.docker.com | sh
sudo usermod -aG docker "$USER"

After logging out and again in, I checked that Docker was working and I then created a listing for ntopng:

mkdir -p ~/network-blackbox/ntopng
cd ~/network-blackbox

I take advantage of Docker Compose as a result of it makes the configuration easier to reproduce. My compose.yml appears to be like like this:

companies:
  ntopng:
    picture: ntop/ntopng_arm64.dev:newest
    container_name: ntopng
    restart: unless-stopped
    network_mode: host
    command:
      - --community
      - -i
      - eth0

The necessary half right here is network_mode: host. The Ethernet interface is receiving the mirrored site visitors, so ntopng wants entry to that interface reasonably than sitting behind Docker’s regular bridge networking.

If your interface will not be referred to as eth0, verify it with:

ip hyperlink

Then change the interface within the Compose file. I begin ntopng with:

docker compose up -d

ntopng provides me the community black field

The dashboard exhibits what is going on

I can now open ntopng from one other machine on the community:

http://address:3000

The first login makes use of the default credentials offered by the container, after which I can change the password. The dashboard provides me a way more helpful view of the community than uncooked packet seize. I can see hosts, site visitors volumes, protocols, interfaces, and which gadgets are producing site visitors.

If one thing all of the sudden consumes a variety of bandwidth, I can establish the host accountable. If a tool begins speaking closely with one other machine, I can examine that relationship from the dashboard. The historic data is what makes the setup fascinating. I don’t must be staring on the dashboard when one thing goes unsuitable.

I might have used Malcolm

It’s advance however I ran out of RAM

I did think about using Malcolm for this undertaking. Malcolm would make the setup significantly extra concerned and supply a a lot bigger community site visitors evaluation stack. It is one thing I wish to experiment with when I’ve extra {hardware} obtainable. The drawback is that I don’t have a 16GB mannequin (in case you have the 16GB mannequin, go for it).

I could purchase one sooner or later, however for now I’ve different issues to spend cash on earlier than buying more Raspberry Pi {hardware} simply to present my community monitoring setup extra RAM. So, for now, ntopng is doing the job and, actually, I just like the simplicity. I don’t want an infinite monitoring stack to reply the questions I even have about my house community.

Pi has turn out to be a watchdog

The monitoring system will not be a router, firewall, or gateway. It merely watches a duplicate of the site visitors and turns that exercise into data I can examine later. That makes it a helpful community black field. When one thing breaks, I can verify what the community was doing across the time of the issue as a substitute of making an attempt to guess what occurred. For a small house lab undertaking, that may be a fairly helpful second profession for a Raspberry Pi.