ntopng
Web-based network traffic probe that shows real-time and historical flows by host, protocol and application.
These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.
1 more ways to get ntopng
Package managers
- Homebrew
brew install ntopng
About ntopng
ntopng captures traffic from mirror ports or TAP devices, or collects NetFlow and sFlow through nProbe, and presents it in an encrypted web interface. It shows active flows and hosts, top talkers, autonomous systems and application protocols detected by nDPI.
It also reports latency, round trip time, TCP retransmissions and packet loss, VoIP metrics such as jitter and MOS, and host geolocation. It runs on Linux, FreeBSD, pfSense, OPNsense, macOS and Windows, and suits administrators who need visibility into what their network carries.
Strengths
- Application detection powered by nDPI
- Real-time and historical traffic in a web interface
- Runs on Linux, BSD firewalls, macOS and Windows
- Works with mirror ports or flow exports via nProbe
Limitations
- Some features need a paid licence
- Needs a mirror port, TAP or flow exporter to see network traffic
Details
- Pricing
- FreemiumLicensed editions are sold by ntop, listed as models on the product page.
- License
- Proprietary
- Developer
- ntop
- Platforms
- Windows, macOS, Linux, Self-hosted
- How it runs
- Downloadable app, Self-hosted
- Works offline
- Yes
- Best suited for
- Administrators who want to see which hosts and applications use their network
- Categories
- System monitoring, Network tools
- Last verified
- Added
- Provenance
- Facts checked against the developer's own pages and store listings, 1 sources on file.
Alternatives to ntopng
Compare allSoftware that can replace ntopng for an important use case, and what changes if you switch.
Akvorado
Self-hosted flow collector, enricher and visualizer for NetFlow, IPFIX and sFlow traffic data.
Akvorado is free and self-hosted, but focuses on NetFlow, IPFIX and sFlow exports from routers rather than mirror ports, and has several components to deploy.
Sniffnet
Shows what your machine is actually talking to, with charts instead of a wall of packets.
Sniffnet is free and open source under Apache-2.0 with readable charts, but it only sees traffic on the machine it runs on, not the whole network.
pmacct
A set of passive network monitoring tools that collect NetFlow, IPFIX, sFlow, packet and BGP data.
pmacct is free and open source and also collects BGP and RPKI data, but it is configured through text files and has no web interface of its own.
nfdump
A suite of command-line tools for collecting, processing and analyzing NetFlow, IPFIX and sFlow data.
nfdump is free and BSD-licensed for collecting and filtering flow records, but it is command-line only with no graphical interface and no application detection.
Malcolm
A self-hosted network traffic analysis suite that turns PCAP files, Zeek logs and Suricata alerts into searchable dashboards.
Malcolm is free and open source, analysing PCAP files, Zeek logs and Suricata alerts in searchable dashboards, but it is a large multi-container stack needing substantial server resources.
IPTraf-ng
A console-based network monitor for Linux that shows live IP traffic statistics by connection and interface.
IPTraf-ng is free and open source and shows live per-connection statistics, but it runs only in a Linux terminal and keeps no historical traffic view.
Security Onion
A free Linux distribution for network security monitoring, packet capture, detection and threat hunting.
Security Onion is a free Linux distribution for security monitoring with packet capture and threat hunting, installed from an ISO on dedicated hardware rather than as a traffic probe.
Arkime
Store and search captured network traffic through a web interface.
Arkime is free and open source under Apache-2.0, storing and indexing full packet captures for search, which needs substantial storage instead of ntopng's flow and application views.
ntopng as an alternative
Listings that name ntopng as an alternative.
Domotz
Cloud-managed network monitoring and management for IT teams looking after devices across many sites.
ntopng is a self-hosted web traffic probe showing flows by host and application, so monitoring data stays on your own servers, with some paid features.
EtherApe
A graphical network monitor that draws live network activity as a diagram of hosts and links.
ntopng gives a web interface with real-time and historical flows by host and application, runs on more platforms, and has some paid features.
vnStat
A console network traffic monitor for Linux and BSD that logs interface usage over time.
ntopng adds a web interface with real-time and historical traffic by host and application, but some features are paid and it needs a mirror port or flow export.
Similar software
Related functionality, not necessarily a direct replacement.
GoFlow2
A NetFlow, IPFIX and sFlow collector written in Go that normalises flow data into one format.
Wireshark
The network protocol analyser: capture traffic and read it packet by packet, with dissectors for hundreds of protocols.
bandwhich
Terminal tool that shows current network use broken down by process and connection.
NetAlertX
A self-hosted network scanner that discovers devices on your networks and reports changes.
