Skip to content
SPECIFICTION
Get listed

ntopng

ntop.org

Free plan Open source WebWindowsmacOSLinuxAPISelf-hosted
Visit ntop.org
Spec score 8.9 #1 of 26 in Network Traffic Analysis Software

What it is

ntopng monitors network traffic gathered from traffic mirrors, NetFlow exporters, SNMP devices, firewall logs and intrusion detection systems. Its encrypted web interface supports real-time and historical traffic exploration. Protocol detection powered by nDPI covers more than 450 Layer-7 application protocols, while metrics include application latency, round-trip time, throughput, TCP retransmission, packet loss, and VoIP jitter and MOS. It captures packets with libpcap or PF_RING and collects flows from nProbe, NetFlow and sFlow exporters. An HTTP-based RESTful API and Lua scripting are listed. Platforms include Linux, FreeBSD, Windows x64, macOS and RaspbianOS; pfSense and OPNsense are also named among supported Unix platforms. The free Community edition suggests limits of 256 live local hosts, 128K live flows and eight monitored interfaces. Paid perpetual licenses include one year of maintenance: Pro is €299, paid once, Enterprise M is €699.95, paid once, Enterprise L is €899.95, paid once, and Enterprise XL is €1,499.95, paid once.

Spec sheet

What it does
ntopng is a web-based network traffic monitor that presents real-time and historical traffic information through an encrypted browser interface.Read 15 Oct 2026 · ntop.org
Product
ntopng is a network traffic probe for network visibility that gathers traffic information from traffic mirrors, NetFlow exporters, SNMP devices, firewall logs, and intrusion detection systems.Read 3 Oct 2026 · ntop.org
API
The technical specifications list an HTTP-based RESTful API and Lua scriptability.Read 3 Oct 2026 · ntop.org
Integrations
Documented integrations include OPNsense, pfSense, Suricata, ClickHouse, Kafka, syslog, Grafana and Wazuh.Read 15 Oct 2026 · ntop.org
Security
ntop says its packages are digitally signed with a PGP key and that users can verify package integrity with it.Read 3 Oct 2026 · ntop.org
Support
ntop offers paid consultancy, commercial-grade support by phone, email, or on-site, professional training, and customization; community support is described as best-efforts.Read 3 Oct 2026 · ntop.org
Headquarters
Italy and SwitzerlandRead 23 Sep 2026 · ntop.org
Founded
1998Read 23 Sep 2026 · ntop.org
Alerts
ntopng generates alerts for flows, hosts and interfaces and can notify through email, Discord, Telegram, webhooks, Slack, syslog or shell scripts.Read 15 Oct 2026 · ntop.org
Authentication
Documented authentication options include local accounts, MFA, passkeys, OpenID Connect, LDAP, RADIUS, HTTP authentication and token-based authentication.Read 15 Oct 2026 · ntop.org
Commercial licensing
Paid licenses are per server, perpetual, and include updates for one year; later releases require maintenance renewal or staying on the older version.Read 15 Oct 2026 · ntop.org
Company history
ntop began as an open-source web traffic-monitoring project in 1998 and describes itself as a small, engineering-led, profitable company.Read 15 Oct 2026 · ntop.org
Company profile
LinkedIn lists NTOP as founded in 1998, headquartered in Pisa, Italy, with 11–50 employees.Read 15 Oct 2026 · linkedin.com
Deployment platforms
The product specifications list Linux, FreeBSD, Windows x64, macOS, and RaspbianOS; the product page also names pfSense and OPNsense among supported Unix platforms.Read 3 Oct 2026 · ntop.org
Developer APIs
Developer documentation covers REST, Lua, Python, timeseries, alerts and recording APIs, plus endpoint and script examples.Read 15 Oct 2026 · ntop.org
Documentation depth
The documentation includes user guides, installation instructions, command-line options, interface guidance, authentication, integrations, advanced features and API references.Read 15 Oct 2026 · ntop.org
Extensibility
The product exposes Lua scriptability and documents host, flow, interface and network checks for custom extensions.Read 15 Oct 2026 · ntop.org
Flow sources
The documentation covers collecting remote interfaces and exporter data through nProbe, including NetFlow and sFlow sources.Read 15 Oct 2026 · ntop.org
Historical analysis
Community edition records and visualizes historical application-protocol timeseries for hosts.Read 15 Oct 2026 · ntop.org
IDS integration
It can ingest Suricata events and combine intrusion-detection data with traffic analytics and behavioral alerts.Read 15 Oct 2026 · ntop.org
Installation
Binary packages are provided for Linux and Windows, with additional installation guidance for macOS, FreeBSD, OPNsense, pfSense and containers.Read 15 Oct 2026 · ntop.org
Layer-7 detection
The product identifies more than 450 Layer-7 application protocols through nDPI.Read 15 Oct 2026 · ntop.org
Licence
The Community edition is open source under GNU GPLv3; Professional and Enterprise editions additionally use ntop's EULA.Read 15 Oct 2026 · ntop.org
License terms
The shop says software licenses are perpetual and include installation support, one year of maintenance, updates, and support for the duration of maintenance.Read 3 Oct 2026 · shop.ntop.org
Limit: FreeBSD complaint
A SourceForge reviewer reported that the software did not work on FreeBSD.Read 15 Oct 2026 · sourceforge.net
Limit: learning curve
A G2 reviewer said beginners may struggle to understand how nProbe and ntopng fit together and wanted more topic-specific videos.Read 15 Oct 2026 · g2.com
Limit: not automated mitigation
Flowtriq's analysis says ntopng is primarily a visibility and investigation tool rather than an automated DDoS detection or mitigation system.Read 15 Oct 2026 · whitelabel.flowtriq.com
Limit: resource intensity
An independent Flowtriq analysis reports users finding ntopng resource-hungry at high traffic rates and needing a powerful dedicated server.Read 15 Oct 2026 · whitelabel.flowtriq.com
Limit: self-hosting work
An independent Hysen Labs review says ntopng requires operators to run a long-lived service with infrastructure and administration, rather than using a managed SaaS.Read 15 Oct 2026 · hysenlabs.com
macOS limitation
The macOS package is unsigned, requires removing its quarantine attribute, and requires Redis before ntopng can start.Read 15 Oct 2026 · ntop.org
Maker history
ntop says its open-source project began in 1998 to create a web-based traffic monitoring platform.Read 3 Oct 2026 · ntop.org
Network discovery
The software discovers devices on a local network and reports hosts, IP addresses, MAC addresses, operating systems and traffic types.Read 15 Oct 2026 · virtualizationreview.com
Packet and flow sources
ntopng captures packets using libpcap or PF_RING and collects flows from nProbe, NetFlow, and sFlow exporters.Read 3 Oct 2026 · ntop.org
Paid edition features
The version comparison assigns LDAP and OpenID Connect login, multiple-interface aggregation, and sending alerts to Elasticsearch, Microsoft Teams, or Fail2Ban to Pro and higher editions.Read 3 Oct 2026 · ntop.org
Performance metrics
Features include application latency, round-trip time, throughput, TCP retransmission and packet-loss metrics, and VoIP jitter and MOS metrics.Read 3 Oct 2026 · ntop.org
Praise: community edition
Virtualization Review's hands-on author said the free Community edition supplied the basic LAN-monitoring and diagnostic features needed on a Raspberry Pi.Read 15 Oct 2026 · virtualizationreview.com
Praise: ease and DPI
A G2 reviewer praised ntopng as a simple, affordable deep-packet-inspection tool with a user-friendly interface and easy implementation.Read 15 Oct 2026 · g2.com
Praise: troubleshooting visibility
A SourceForge reviewer praised the ability to view network activity at a high level, drill into problems and use reports for baselining and documentation.Read 15 Oct 2026 · sourceforge.net
Protocol detection
Its nDPI-powered protocol detection supports more than 450 Layer-7 application protocols.Read 3 Oct 2026 · ntop.org
Rating on Capterra
0.0 out of 5 from 0 reviewsRead 15 Oct 2026 · capterra.com
Rating on G2
4.8 out of 5 from 2 reviewsRead 15 Oct 2026 · g2.com
Rating on Software Advice
No rating from 0 reviewsRead 15 Oct 2026 · softwareadvice.com
Rating on SourceForge
4.5 out of 5 from 8 reviewsRead 15 Oct 2026 · sourceforge.net
Release news
GitHub lists ntopng 7.0 as released in September 2026 with nAnalyst AI, Wazuh integration, BGP/BMP support, ClickHouse timeseries, OIDC/MFA/passkeys and a new Vue frontend.Read 15 Oct 2026 · github.com
REST API
The REST API exports interface, host, flow and raw PCAP data over HTTP and has version 1 and version 2 specifications with examples.Read 15 Oct 2026 · ntop.org
Security defaults
Fresh packages disable plain HTTP and enable HTTPS on port 3001 with a self-signed certificate by default.Read 15 Oct 2026 · ntop.org
Security reports
The security page says reports sent to [email protected] will receive a non-automated acknowledgment within three working days.Read 3 Oct 2026 · ntop.org
System sizing
Published sizing guidance lists 2 CPU cores and 2 GB RAM for 100 Mbps, 4 cores and 4 GB for 1 Gbps, and at least 8 cores and 16 GB for 10 Gbps or more.Read 15 Oct 2026 · ntop.org
Top talkers
Community edition includes minute-resolution identification of the hosts sending and receiving the most traffic.Read 15 Oct 2026 · ntop.org
Traffic analysis
It provides realtime and historical traffic exploration through an encrypted web user interface.Read 3 Oct 2026 · ntop.org
Traffic capture
It can inspect traffic from a physical interface connected to a switch mirror port or a TAP device, and can scale with nProbe or nProbe Cento.Read 15 Oct 2026 · ntop.org
Windows limitation
The current installation guide says only a development-build binary is available for Windows and that Npcap must be installed separately for capture.Read 15 Oct 2026 · ntop.org

Plans and prices

Community Free real-time visibility · Layer-7 detection · historical host timeseries · alerts · active monitoring · network discovery Read 15 Oct 2026 · ntop.org
Community (Open Source) Free Designed for home and network practitioners · Network size: Small · Suggested maximum 256 live local hosts · Suggested maximum 128K live flows · Maximum 8 monitored interfaces Read 3 Oct 2026 · ntop.org
Pro €299, paid once Perpetual license; includes one year maintenance Designed for offices and small enterprises · Network size: Small/Medium · Suggested maximum 256 live local hosts · Suggested maximum 1M live flows · Maximum 8 monitored interfaces Read 3 Oct 2026 · ntop.org
Pro €299.95, paid once perpetual license; one year of updates included Linux/Windows/FreeBSD x64 · interface aggregation · LDAP · extended alerts · network-matrix timeseries Read 15 Oct 2026 · shop.ntop.org
Enterprise M €699.95, paid once perpetual license; one year of updates included Linux/Windows/FreeBSD x64 · SNMP · advanced alerts · nAnalyst Read 15 Oct 2026 · shop.ntop.org
Enterprise L €899.95, paid once perpetual license; one year of updates included Linux/Windows/FreeBSD x64 · enterprise features · extended capacity Read 15 Oct 2026 · shop.ntop.org
Enterprise XL €1,499.95, paid once perpetual license; one year of updates included Linux/Windows/FreeBSD x64 · higher host, SNMP-device and flow-collector limits Read 15 Oct 2026 · shop.ntop.org

Every ntopng plan and price →

Strong points and limits

Strong points

  • Encrypted web interface for real-time and historical traffic
  • Detects more than 450 Layer-7 protocols
  • Reports latency, throughput, loss and VoIP metrics
  • RESTful API and Lua scripting are listed
  • Free Community edition is available

Limits

  • Community edition caps monitored interfaces at eight
  • LDAP and OpenID Connect login require Pro or higher
  • Paid licenses include only one year of maintenance

Who it suits

The free Community edition is described for home and network practitioners with small networks. Pro is aimed at offices and small enterprises, while the Enterprise editions list larger suggested network capacities.

ntopng in depth

Read the full write-up

Overview

ntopng is a network traffic probe for administrators who need to examine activity across several data sources and protocols. It suits home practitioners through enterprise teams that can choose an edition sized to their network. Its broad collection and analysis capabilities are balanced by firm interface and capacity limits, with some useful operational features reserved for paid editions.

Traffic mirrors, NetFlow exporters, SNMP devices, firewall logs, and intrusion detection systems can all feed the probe. Real-time and historical exploration in an encrypted web interface makes it useful for investigating both current activity and past patterns, rather than just tracking aggregate bandwidth.

It belongs in comparisons of Network Traffic Analysis Software, Bandwidth Monitoring Software, and broader Network Monitoring. The right fit is a team that values protocol-level visibility and can work within ntopng’s suggested scale for its chosen plan.

Key features

Traffic and protocol analysis

ntopng captures packets through libpcap or PF_RING and collects flows from nProbe, NetFlow, and sFlow exporters. Its nDPI-powered detection recognizes more than 450 Layer-7 application protocols, helping administrators distinguish application activity instead of treating traffic as a single volume. Export to Elasticsearch and other big-data systems can extend where traffic data is handled.

Performance and operations

Metrics include application latency, round-trip time, throughput, TCP retransmissions, packet loss, and VoIP jitter and MOS. That breadth is valuable when investigating service quality as well as traffic mix. An HTTP-based RESTful API and Lua scriptability make ntopng more adaptable for teams that want to integrate or extend monitoring workflows.

Pro and higher editions add LDAP and OpenID Connect login, aggregation across multiple interfaces, and alert delivery to Elasticsearch, Microsoft Teams, or Fail2Ban. Those capabilities matter in organizations with centralized identity or established alerting workflows; they are not part of the Community edition.

Deployment and support

Deployment is self-hosted, with platforms including Linux, FreeBSD, Windows x64, macOS, RaspbianOS, pfSense, and OPNsense. The product also identifies API and web support. ntop says its packages are digitally signed with a PGP key so users can verify their integrity. Community support is best-efforts; paid options include consultancy, commercial support by phone, email, or on-site, professional training, and customization.

Pricing

The Community (Open Source) edition costs nothing. It is aimed at home and network practitioners, with a suggested maximum of 256 live local hosts and 128K live flows, and a maximum of 8 monitored interfaces. That is a substantial starting point for smaller deployments, but its caps and lack of paid-edition identity and alert integrations make it less suitable for teams needing enterprise workflows.

Pro costs €299, paid once as a perpetual license and includes one year of maintenance. It is designed for offices and small enterprises, with suggested maximums of 256 live local hosts and 1M live flows and a maximum of 8 interfaces. It is the step up for small networks that need the paid feature set without a higher interface ceiling.

Enterprise M costs €699.95, paid once, Enterprise L costs €899.95, paid once, and Enterprise XL costs €1,499.95, paid once. Each is a perpetual license with one year of maintenance and an enterprise feature set. M suggests up to 1K live hosts and 4M live flows across 16 interfaces; L raises those figures to 4K hosts, 8M flows, and 32 interfaces; XL reaches 32K hosts, 16M flows, and 64 interfaces. These are suggested maximums, so buyers should match the plan to their expected scale rather than assume unlimited growth.

Licenses are perpetual and include installation support, updates, and support for the duration of the one-year maintenance period. Renewal terms or post-maintenance pricing are not provided here, so organizations that depend on ongoing updates should account for that uncertainty when budgeting.

Platforms

ntopng runs as self-hosted software on Linux, FreeBSD, Windows x64, macOS, and RaspbianOS, with pfSense and OPNsense also named among supported Unix platforms. The encrypted web interface provides a browser-based way to explore traffic, while the HTTP API supports programmatic access. This favors teams able to operate network software themselves over those seeking a hosted service.

Who it's for

ntopng is a strong fit for network practitioners and administrators who need to combine packet or flow collection with application identification and performance metrics. The Community plan fits smaller environments within its interface, host, and flow ceilings. Pro suits offices and small enterprises that need more flow headroom or paid-edition integrations; the Enterprise tiers are the more appropriate choice as interface count and monitored network scale rise.

It is a weaker fit for buyers who need a cloud-hosted deployment, a plan without stated capacity boundaries, or guaranteed community support. Larger organizations should also account for the cost of moving from Community to a paid edition to gain centralized login and alert integrations.

Pros and cons

Pros: Collects from packet, flow, device, firewall, and intrusion-detection sources, giving mixed environments several ways to contribute traffic data.

Pros: More than 450 Layer-7 protocols plus latency, loss, retransmission, and VoIP metrics support both traffic identification and service-quality investigation.

Pros: The free edition has a stated capacity and costs nothing, while perpetual paid tiers provide progressively higher suggested capacities.

Cons: The free edition stops at 8 interfaces and suggested maxima of 256 hosts and 128K flows, which can constrain even otherwise capable smaller deployments.

Cons: LDAP, OpenID Connect, multi-interface aggregation, and several alert integrations require Pro or higher, adding a paid-plan decision for operational features.

Cons: Software is self-hosted and community support is best-efforts, so teams wanting managed operations or assured support need another arrangement.

Alternatives

Choose Nagios XI if a broader monitoring product is a better match: its free tier is capped at 7 nodes or 100 services, whichever comes first, while its paid Standard plan is 2595.00 USD.

Caligare Flow Inspector is another freemium flow-analysis option. Choose it if its free edition’s non-commercial, two-device, 24-hour-history, and 250-flows-per-second limits fit your needs.

Choose ManageEngine NetFlow Analyzer if a two-interface free edition or paid monthly tiers priced per interface better suit your scale and budget.

ElastiFlow is a freemium alternative whose free Basic tier supports up to 4,000 records per second and 25 SNMP devices, with dashboards, ML detections, and Slack and forum support.

Intermapper is an alternative for readers comparing device-based licensing with subscription or perpetual options.

Riverbed Aternity is an enterprise offering for readers evaluating digital experience management instead.

SparrowIQ is a paid alternative with monthly or annual subscriptions and quote-based pricing.

FlowViewer is a free option for readers who want software that runs on a Unix server.

Verdict

Choose ntopng if you need self-hosted traffic visibility that joins broad source collection, deep protocol identification, and network-performance metrics, and you can select a plan within its interface and flow limits. Its Community edition makes it practical to start on smaller networks, while paid editions add scale and integrations. Look elsewhere if you need hosted operation, assured support without a paid service arrangement, or a simpler plan without explicit capacity ceilings.

Verdict

ntopng combines traffic collection, protocol identification and performance metrics with web-based exploration. The free edition has stated network limits, while paid editions add features and higher suggested capacities.

Where Specifiction places it

Alternatives to ntopngAll alternatives →