ntopng
Italy and Switzerland
What it is
ntopng is a network traffic probe for monitoring and exploring network activity. It collects traffic information from traffic mirrors, NetFlow exporters, SNMP devices, firewall logs, and intrusion detection systems. An encrypted web interface provides real-time and historical traffic exploration, while nDPI-powered detection identifies more than 450 Layer-7 application protocols. Performance metrics include application latency, round-trip time, throughput, TCP retransmissions, packet loss, and VoIP jitter and MOS. The software captures packets with libpcap or PF_RING and gathers flows from nProbe, NetFlow, and sFlow exporters. Its HTTP-based REST API and Lua scriptability support integration and customization. The free Community edition is suggested for up to 256 live local hosts, 128K live flows, and eight monitored interfaces. Paid licenses are perpetual and include one year of maintenance; Pro is €299, paid once. LDAP and OpenID Connect login, multiple-interface aggregation, and specified alert integrations are for Pro and higher editions.
For and against
For
- Encrypted interface offers real-time and historical exploration.
- Detects more than 450 Layer-7 protocols.
- Tracks latency, throughput, packet loss, and VoIP metrics.
- Includes an HTTP-based REST API and Lua scriptability.
Against
- Community suggests a maximum of eight monitored interfaces.
- Community suggests a maximum of 128K live flows.
- LDAP and OpenID Connect login are for Pro and higher.
- Pro costs €299, paid once.
The verdict
ntopng combines traffic collection, protocol identification, and performance metrics in a web interface. The free Community edition has suggested size limits, while paid editions add capabilities including multi-interface aggregation and selected alert integrations.
Who it suits
The Community edition is aimed at home and network practitioners with smaller networks. Offices and enterprises can consider the paid editions, which have higher suggested network limits and add features such as multiple-interface aggregation.
Plans and prices
Community
real-time visibility · Layer-7 detection · historical host timeseries · alerts
Read 15 Oct 2026 · ntop.org
Pro
Linux/Windows/FreeBSD x64 · interface aggregation · LDAP · extended alerts
Read 15 Oct 2026 · shop.ntop.org
Enterprise M
Linux/Windows/FreeBSD x64 · SNMP · advanced alerts · nAnalyst
Read 15 Oct 2026 · shop.ntop.org
Enterprise L
Linux/Windows/FreeBSD x64 · enterprise features · extended capacity
Read 15 Oct 2026 · shop.ntop.org
Enterprise XL
Linux/Windows/FreeBSD x64 · higher host, SNMP-device and flow-collector limits
Read 15 Oct 2026 · shop.ntop.org
Community (Open Source)
Designed for home and network practitioners · Network size: Small · Suggested maximum 256 live local hosts · Suggested maximum 128K live flows
Read 3 Oct 2026 · ntop.org
On the record
- Alerts
- ntopng generates alerts for flows, hosts and interfaces and can notify through email, Discord, Telegram, webhooks, Slack, syslog or shell scripts.ntop.org · read 15 Oct 2026
- API
- The technical specifications list an HTTP-based RESTful API and Lua scriptability.ntop.org · read 3 Oct 2026
- Authentication
- Documented authentication options include local accounts, MFA, passkeys, OpenID Connect, LDAP, RADIUS, HTTP authentication and token-based authentication.ntop.org · read 15 Oct 2026
- Commercial licensing
- Paid licenses are per server, perpetual, and include updates for one year; later releases require maintenance renewal or staying on the older version.ntop.org · read 15 Oct 2026
- Company history
- ntop began as an open-source web traffic-monitoring project in 1998 and describes itself as a small, engineering-led, profitable company.ntop.org · read 15 Oct 2026
- Company profile
- LinkedIn lists NTOP as founded in 1998, headquartered in Pisa, Italy, with 11–50 employees.linkedin.com · read 15 Oct 2026
- Deployment platforms
- The product specifications list Linux, FreeBSD, Windows x64, macOS, and RaspbianOS; the product page also names pfSense and OPNsense among supported Unix platforms.ntop.org · read 3 Oct 2026
- Developer APIs
- Developer documentation covers REST, Lua, Python, timeseries, alerts and recording APIs, plus endpoint and script examples.ntop.org · read 15 Oct 2026
- Documentation depth
- The documentation includes user guides, installation instructions, command-line options, interface guidance, authentication, integrations, advanced features and API references.ntop.org · read 15 Oct 2026
- Extensibility
- The product exposes Lua scriptability and documents host, flow, interface and network checks for custom extensions.ntop.org · read 15 Oct 2026
- Flow sources
- The documentation covers collecting remote interfaces and exporter data through nProbe, including NetFlow and sFlow sources.ntop.org · read 15 Oct 2026
- Historical analysis
- Community edition records and visualizes historical application-protocol timeseries for hosts.ntop.org · read 15 Oct 2026
- IDS integration
- It can ingest Suricata events and combine intrusion-detection data with traffic analytics and behavioral alerts.ntop.org · read 15 Oct 2026
- Installation
- Binary packages are provided for Linux and Windows, with additional installation guidance for macOS, FreeBSD, OPNsense, pfSense and containers.ntop.org · read 15 Oct 2026
- Integrations
- Documented integrations include OPNsense, pfSense, Suricata, ClickHouse, Kafka, syslog, Grafana and Wazuh.ntop.org · read 15 Oct 2026
- Layer-7 detection
- The product identifies more than 450 Layer-7 application protocols through nDPI.ntop.org · read 15 Oct 2026
- Licence
- The Community edition is open source under GNU GPLv3; Professional and Enterprise editions additionally use ntop's EULA.ntop.org · read 15 Oct 2026
- License terms
- The shop says software licenses are perpetual and include installation support, one year of maintenance, updates, and support for the duration of maintenance.shop.ntop.org · read 3 Oct 2026
