ntopng

Overview

The probe gathers information from traffic mirrors, NetFlow exporters, SNMP devices, firewall logs, and intrusion detection systems, then provides real-time and historical exploration through an encrypted web interface. It can capture packets with libpcap or PF_RING and collect flows from nProbe, NetFlow, and sFlow exporters. That mix gives administrators options for bringing together packet and flow visibility rather than relying on a single collection method.

ntopng’s open-source project dates to 1998. Its traffic analysis spans bandwidth monitoring and wider network operations, making it relevant to Network Traffic Analysis Software, Bandwidth Monitoring Software, and Network Monitoring.

Key features

Protocol and performance visibility

Its nDPI-powered detection supports more than 450 Layer-7 application protocols. That is useful when administrators need to distinguish application activity, not just observe aggregate traffic. Metrics include application latency, round-trip time, throughput, TCP retransmissions, packet loss, and VoIP jitter and MOS, giving teams a way to investigate both traffic patterns and service performance.

Integration and extensibility

An HTTP-based RESTful API and Lua scriptability make ntopng more adaptable to custom workflows. It can export to Elasticsearch and big-data systems. Pro and higher editions add LDAP and OpenID Connect login, aggregation across multiple interfaces, and alert delivery to Elasticsearch, Microsoft Teams, or Fail2Ban. Those additions make the paid editions more suitable where centralized access and alert routing matter; the Community edition does not include those paid-edition capabilities.

ntopng also supports synthetic checks and topology maps. Its packages are digitally signed with a PGP key, which users can use to verify package integrity. For support, ntop offers paid consultancy, commercial-grade phone, email, or on-site support, training, and customization; community support is best-efforts.

Pricing

The Community edition is free and aimed at home and network practitioners. Its suggested maximums are 256 live local hosts and 128K live flows, with up to 8 monitored interfaces. Those ceilings can be enough for a small environment, but they make it a poor fit for larger deployments.

Pro costs 299.00 EUR per once as a perpetual license with one year of maintenance. Designed for offices and small enterprises, it retains the 256-host and 8-interface suggested limits while raising the suggested live-flow maximum to 1M. Its value is less about scaling hosts than gaining the Pro-tier features, including identity integrations, interface aggregation, and alert integrations.

Enterprise editions are also perpetual licenses with one year of maintenance:

• Enterprise M: 699.95 EUR per once; suggested maximum 1K live local hosts, 4M live flows, and 16 interfaces.
• Enterprise L: 899.95 EUR per once; suggested maximum 4K live local hosts, 8M live flows, and 32 interfaces.
• Enterprise XL: 1499.95 EUR per once; suggested maximum 32K live local hosts, 16M live flows, and 64 interfaces.

The M, L, and XL plans offer the enterprise feature set with progressively larger suggested capacity. Licenses are perpetual and include installation support, updates, and support for the duration of maintenance; the included maintenance period is one year. Buyers who need ongoing maintenance beyond that period should factor the renewal terms into their decision.

Platforms

ntopng is self-hosted and supports Linux, FreeBSD, Windows x64, macOS, and RaspbianOS; pfSense and OPNsense are also named among supported Unix platforms. Its web interface and API support operational access beyond the machine running the probe.

Who it's for

Community is the sensible starting point for home users and practitioners with small networks within its suggested caps. Pro fits an office or small enterprise that wants paid-edition integrations but can stay within the same 256-host and 8-interface limits. Enterprise M, L, and XL are the better fit for organizations whose live-host, flow, or interface counts exceed those boundaries. If all that is needed is a narrowly scoped single-host monitor, ntopng’s wider collection and analysis capabilities may be more than necessary.

Pros and cons

• Pro: Collects from packet, flow, device, firewall, and intrusion-detection sources, offering flexibility for mixed network environments.
• Pro: More than 450 detected Layer-7 protocols plus latency, loss, retransmission, and VoIP metrics support deeper diagnosis than traffic volume alone.
• Pro: Perpetual paid licenses include one year of maintenance, installation support, updates, and support during maintenance.
• Con: Community has suggested ceilings of 256 local hosts, 128K flows, and 8 interfaces, which can constrain even some modest deployments.
• Con: LDAP/OpenID Connect, multiple-interface aggregation, and named alert integrations require Pro or higher, so the free edition lacks these operational features.
• Con: Community support is best-efforts; commercial-grade support, consultancy, training, and customization are paid services.

Alternatives

• sFlowTrend is worth comparing for readers seeking a paid traffic-monitoring product with a free plan and support for Linux, macOS, Windows, web, and self-hosted use.
• SoftPerfect Bandwidth Manager is an option for readers focused on bandwidth rules and usage monitoring, with a free Lite plan capped at 5 rules/streams and a paid Standard plan.
• GlassWire may suit readers who want a freemium tool on Android, web, or Windows; its free plan includes one day of bandwidth usage, 24 hours of network history, and current-day alert logs.
• ManageEngine NetFlow Analyzer is a candidate for readers who prefer a freemium product with a free edition capped at 2 interfaces and paid monthly editions.
• Sniffnet is a free, open-source option for readers who prioritize a no-cost Linux, macOS, or Windows tool.
• Akvorado is another free, self-hosted option, developed by French ISP Free.
• bwmon is a free, self-hosted alternative for monitoring a single Linux host under the MIT license.
• MRTG is a free option for readers focused on monitoring SNMP devices and other data sources.

Verdict

Choose ntopng if you need self-hosted visibility across varied traffic sources, detailed protocol identification, and performance metrics, with editions that scale from a small network to enterprise capacities. Its clearest reason to look elsewhere is the combination of Community caps and paid-tier gates: larger or centrally managed deployments need a paid license, while teams that only need a simpler single-purpose monitor may not need ntopng’s breadth.