What it does
ntopng is a network traffic monitoring application that passively analyzes packets, collects NetFlow, sFlow, and IPFIX, and can actively monitor selected devices through SNMP. It turns observed traffic into host, application, and security-related views rather than acting only as a flow collector. The software runs on supported operating systems and provides a browser interface and HTTP-based REST API. A free Community edition sits alongside paid editions with additional capacity and features.
A useful first deployment is to install ntopng on a host with access to a switch mirror or TAP, then select the interface to observe. If exporting flows is more practical than mirroring packets, the documentation describes collecting NetFlow, sFlow, or IPFIX; larger flow deployments may require the separate nProbe or nProbe Cento product. After data arrives, inspect hosts and application protocols, use monitoring views and alerts to spot anomalies, and check historical traffic when investigating a performance complaint.
This is a traffic-analysis tool, not a fix engine. It can show where traffic is going and which hosts or protocols are involved, but a network operator still needs to decide whether a routing, capacity, security, or application change is appropriate. Capacity and feature limits vary by edition, and its licensing guide distinguishes the free GPLv3 Community version from paid Professional and Enterprise options.
The installation guide covers Linux, Windows, macOS, FreeBSD, and containers. Choose a host with enough packet-processing capacity for the link you intend to observe, and consult the vendor's sizing guidance rather than assuming a small server will handle a high-speed feed.
Strengths
- Supports passive packet analysis, flow collection, and SNMP monitoring in one application.
- The Community edition is free and distributed under GPLv3; paid versions add features and higher limits.
- Provides a documented HTTP-based REST API and browser interface.
Watch out for
- Useful packet visibility requires access to a mirror port, TAP, or suitable flow exporters.
- Some flow-collection and large-network scenarios use separate ntop products, and edition limits vary.
Best for
- Network operators investigating traffic composition, host behavior, or application protocols
- Teams that need a self-hosted traffic monitor with flow and packet-analysis options
Sources
- ntopng - ntop (Oct 26, 2026)
- What is ntopng - ntopng Documentation (Oct 26, 2026)
- Available Versions & Licensing - ntopng Documentation (Oct 26, 2026)
- Installation - ntopng Documentation (Oct 26, 2026)