Alternatives to ntopng

Web-based network traffic probe that shows real-time and historical flows by host, protocol and application. The listings below can replace it for an important use case. Each note says what changes if you switch.

Replacements

Listings that take over the same core job as ntopng.

  • Akvorado

    Self-hosted flow collector, enricher and visualizer for NetFlow, IPFIX and sFlow traffic data.

    FreeProprietaryLinuxSelf-hosted

    Akvorado is free and self-hosted, but focuses on NetFlow, IPFIX and sFlow exports from routers rather than mirror ports, and has several components to deploy.

  • Sniffnet

    Shows what your machine is actually talking to, with charts instead of a wall of packets.

    FreeOpen sourceWindowsmacOSLinux

    Sniffnet is free and open source under Apache-2.0 with readable charts, but it only sees traffic on the machine it runs on, not the whole network.

  • pmacct

    A set of passive network monitoring tools that collect NetFlow, IPFIX, sFlow, packet and BGP data.

    FreeOpen sourceLinuxSelf-hostedCommand line

    pmacct is free and open source and also collects BGP and RPKI data, but it is configured through text files and has no web interface of its own.

  • nfdump

    A suite of command-line tools for collecting, processing and analyzing NetFlow, IPFIX and sFlow data.

    FreeOpen sourceLinuxSelf-hostedCommand line

    nfdump is free and BSD-licensed for collecting and filtering flow records, but it is command-line only with no graphical interface and no application detection.

  • Malcolm

    A self-hosted network traffic analysis suite that turns PCAP files, Zeek logs and Suricata alerts into searchable dashboards.

    FreeOpen sourceLinuxSelf-hosted

    Malcolm is free and open source, analysing PCAP files, Zeek logs and Suricata alerts in searchable dashboards, but it is a large multi-container stack needing substantial server resources.

  • IPTraf-ng

    A console-based network monitor for Linux that shows live IP traffic statistics by connection and interface.

    FreeOpen sourceLinuxCommand line

    IPTraf-ng is free and open source and shows live per-connection statistics, but it runs only in a Linux terminal and keeps no historical traffic view.

  • Security Onion

    A free Linux distribution for network security monitoring, packet capture, detection and threat hunting.

    FreemiumProprietaryLinuxSelf-hosted

    Security Onion is a free Linux distribution for security monitoring with packet capture and threat hunting, installed from an ISO on dedicated hardware rather than as a traffic probe.

  • Arkime

    Store and search captured network traffic through a web interface.

    FreeOpen sourceLinuxSelf-hostedWeb

    Arkime is free and open source under Apache-2.0, storing and indexing full packet captures for search, which needs substantial storage instead of ntopng's flow and application views.

Also worth comparing

These listings name ntopng as their own alternative, so the relationship runs both ways.

  • Domotz

    Cloud-managed network monitoring and management for IT teams looking after devices across many sites.

    PaidProprietaryWeb

    ntopng is a self-hosted web traffic probe showing flows by host and application, so monitoring data stays on your own servers, with some paid features.

  • EtherApe

    A graphical network monitor that draws live network activity as a diagram of hosts and links.

    FreeOpen sourceLinux

    ntopng gives a web interface with real-time and historical flows by host and application, runs on more platforms, and has some paid features.

  • vnStat

    A console network traffic monitor for Linux and BSD that logs interface usage over time.

    FreeOpen sourceLinuxCommand line

    ntopng adds a web interface with real-time and historical traffic by host and application, but some features are paid and it needs a mirror port or flow export.

Similar software

Related functionality, not a direct replacement.