How do I install the Ntopng Admin skill?

Run npx skillmds@latest add modbender/ntopng-admin in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Ntopng Admin safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: executes scripts, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Ntopng Admin?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Ntopng Admin free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Ntopng Admin?

modbender (@modbender) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Ntopng Admin by modbender — Agent Skill

Name: Ntopng Admin
Rating: 4.2 (5 reviews)
Author: modbender

File contents

ntopng Network Monitor (Secure Edition)

A powerful network auditing tool that queries ntopng data directly from Redis via a secure SSH tunnel. This skill is built for network administrators and security professionals who need high-visibility into local network traffic.

⚠️ High Privilege Warning & Responsible Use

PROCEED WITH CAUTION: This skill performs high-privilege operations, including executing commands on your network gateway via SSH and reading internal network states.

Strict Audit Only: Intended for Lab, Test, or controlled Audit environments. Avoid use in critical production systems unless the agent's access is strictly isolated.
Explicit Consent: By default, autonomous invocation is disabled. You must manually approve each query to maintain full oversight of the data being accessed.
Security Posture: This tool uses SSH Key Authentication. Never use plain-text passwords. Ensure your SSH keys are protected with passphrases where applicable.
Data Sensitivity: Be aware that this tool exposes MAC addresses, internal IPs, and connection metadata. Handle output with the same care as your network configuration files.

Prerequisites

SSH Key Access: Public key authentication must be configured between the OpenClaw host and the OPNsense/ntopng host.
Binaries: ssh and jq must be available in the local environment.
Backend: ntopng must be running with Redis persistence enabled on the target host.

Configuration

Declare these variables in your environment or agent configuration:

Variable	Description	Default
`OPNSENSE_HOST`	Target gateway IP or hostname	`192.168.1.1`
`OPNSENSE_SSH_PORT`	SSH service port	`50222`
`NTOP_INSECURE`	Set to `true` for self-signed certificates (if applicable)	`false`

Available Commands

The helper script scripts/ntopng-helper.sh provides safe, read-only data extraction:

1. Network Inventory

./scripts/ntopng-helper.sh list [limit]

Lists detected devices with MAC, IP, total traffic volume, and last-seen timestamps.

2. Device Forensics

./scripts/ntopng-helper.sh device-info <ip|mac>

Provides granular traffic breakdown, packet counts, and inferred device classification.

3. Connection Audit

./scripts/ntopng-helper.sh connections <ip> [sample_size]

Extracts a sample of external domains contacted by a specific device from ntopng logs.

4. Health & Statistics

./scripts/ntopng-helper.sh status   # Verifies the ntopng service state
./scripts/ntopng-helper.sh stats    # Global network device counts

Data Interpretation Guide

Exfiltration Pattern: An Upload:Download ratio higher than 5:1 on a non-server device is a high-priority anomaly.
Device Spoofing: Unexpected MAC addresses or MACs with the DE:AD:BE:EF prefix (often VPN/Tunnel interfaces) should be verified.
Protocol Anomalies: Use the app command to detect devices using protocols that violate your local security policy (e.g., unexpected SSH or HTTP servers).

Security Implementation

No Secret Leaking: Scripts are hardened to never echo credentials or sensitive environment variables.
Input Sanitization: Arguments are filtered to prevent shell injection attempts.
Secure by Default: SSL verification is active unless explicitly overridden for lab use.

---name: ntopng-admindescription: Professional network monitoring and device identification using ntopng Redis data. Designed for security auditing and diagnostic environments.--- # ntopng Network Monitor (Secure Edition) A powerful network auditing tool that queries ntopng data directly from Redis via a secure SSH tunnel. This skill is built for network administrators and security professionals who need high-visibility into local network traffic. ## ⚠️ High Privilege Warning & Responsible Use **PROCEED WITH CAUTION:** This skill performs high-privilege operations, including executing commands on your network gateway via SSH and reading internal network states. 1. **Strict Audit Only:** Intended for Lab, Test, or controlled Audit environments. Avoid use in critical production systems unless the agent's access is strictly isolated. 2. **Explicit Consent:** By default, autonomous invocation is disabled. You must manually approve each query to maintain full oversight of the data being accessed. 3. **Security Posture:** This tool uses SSH Key Authentication. Never use plain-text passwords. Ensure your SSH keys are protected with passphrases where applicable. 4. **Data Sensitivity:** Be aware that this tool exposes MAC addresses, internal IPs, and connection metadata. Handle output with the same care as your network configuration files. ## Prerequisites * **SSH Key Access:** Public key authentication must be configured between the OpenClaw host and the OPNsense/ntopng host. * **Binaries:** `ssh` and `jq` must be available in the local environment. * **Backend:** ntopng must be running with Redis persistence enabled on the target host. ## Configuration Declare these variables in your environment or agent configuration: | Variable | Description | Default | |----------|-------------|---------| | `OPNSENSE_HOST` | Target gateway IP or hostname | `192.168.1.1` | | `OPNSENSE_SSH_PORT` | SSH service port | `50222` | | `NTOP_INSECURE` | Set to `true` for self-signed certificates (if applicable) | `false` | ## Available Commands The helper script `scripts/ntopng-helper.sh` provides safe, read-only data extraction: ### 1. Network Inventory ```bash ./scripts/ntopng-helper.sh list [limit] ``` Lists detected devices with MAC, IP, total traffic volume, and last-seen timestamps. ### 2. Device Forensics ```bash ./scripts/ntopng-helper.sh device-info <ip|mac> ``` Provides granular traffic breakdown, packet counts, and inferred device classification. ### 3. Connection Audit ```bash ./scripts/ntopng-helper.sh connections <ip> [sample_size] ``` Extracts a sample of external domains contacted by a specific device from ntopng logs. ### 4. Health & Statistics ```bash ./scripts/ntopng-helper.sh status # Verifies the ntopng service state ./scripts/ntopng-helper.sh stats # Global network device counts ``` ## Data Interpretation Guide * **Exfiltration Pattern:** An Upload:Download ratio higher than 5:1 on a non-server device is a high-priority anomaly. * **Device Spoofing:** Unexpected MAC addresses or MACs with the `DE:AD:BE:EF` prefix (often VPN/Tunnel interfaces) should be verified. * **Protocol Anomalies:** Use the `app` command to detect devices using protocols that violate your local security policy (e.g., unexpected SSH or HTTP servers). ## Security Implementation - **No Secret Leaking:** Scripts are hardened to never echo credentials or sensitive environment variables. - **Input Sanitization:** Arguments are filtered to prevent shell injection attempts. - **Secure by Default:** SSL verification is active unless explicitly overridden for lab use.

Frequently asked questions

Ntopng Admin