Build a Home Network Visibility Dashboard with ntopng, Syslog, and VLAN Traffic Summaries

Expected Outcome

A dedicated monitoring interface receives mirrored or routed observation traffic from two lab VLANs, ntopng identifies the expected hosts/flows, a test syslog event is received separately, and the operator can explain what traffic is and is not visible.

Assumptions

• A host with a dedicated capture/observation interface

• A switch/router capable of SPAN/mirror or another explicitly supported observation path

• Two disposable test VLANs or networks

• Permission to capture traffic; packet/flow metadata may be sensitive

• A separate management interface is strongly preferred

Bill of Materials

• Computer or server for hosting ntopng

• Router with VLAN support

• Network cables

• Monitor for dashboard display

Build Steps

1. Choose the observation topology first

   Use a documented SPAN/mirror source to a dedicated ntopng interface, or another supported flow source. State exactly which VLANs/interfaces are mirrored and which traffic cannot be observed. Do not assume installing ntopng on any host magically gives network-wide visibility.

2. Verify capture traffic before configuring dashboards

   Generate known traffic in each test VLAN and use a basic packet/counter check on the observation interface to prove frames/flows arrive. Record source/destination addresses so later ntopng attribution can be verified.

3. Configure ntopng for the intended interface and local networks

   Select the observation interface explicitly and define the lab local-network ranges so hosts and conversations are categorized correctly. Keep management exposure limited to the admin network.

4. Add one independent syslog path

   Configure one test router/switch/server to send a recognizable syslog event to the chosen collector. Treat syslog as event context, not as a substitute for traffic visibility.

5. Generate representative traffic and inspect attribution

   From each VLAN, create DNS, HTTP/TCP, and inter-VLAN traffic where permitted. Confirm ntopng shows the expected source, destination, protocol, volume, and network grouping.

6. Document visibility gaps

   Identify traffic the sensor cannot see because of mirror scope, encrypted overlays, east-west paths elsewhere, or asymmetric routing. Record those limits on the dashboard/runbook rather than presenting the view as complete network telemetry.

Validation

• The capture interface receives traffic from both intended VLANs

• Known test flows appear in ntopng with correct source/destination attribution

• Management traffic is not unintentionally mixed into the capture design

• A deliberate syslog event arrives from the intended source

• The lab documentation states which links/VLANs are outside the sensor's visibility

Troubleshooting

• No flows: verify switch/router mirror configuration and physical capture interface before changing ntopng

• Flows but wrong local/remote classification: review local-network definitions

• Missing one VLAN: compare mirror source membership and trunk/VLAN handling

• Do not turn on broad packet capture retention without a privacy/storage plan

Cleanup or Rollback

• Remove test mirror/SPAN configuration if it was created only for the lab

• Stop test syslog sending and remove lab-only collector rules

• Delete packet captures that contain sensitive data according to the lab retention plan

Next Improvements

• Explore ntopng's advanced features such as alerts and reporting.

• Integrate additional monitoring tools like Grafana for enhanced visualization.

• Consider setting up alerts for unusual traffic patterns.