nfdump vs ntopng
nfdump
github.com
ntopng
ntop.orgSide by side
| Figure | nfdump | ntopng |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Web | — | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 7 |
| Spec score · Network Traffic Analysis Software | 7.5 (#15) | 8.9 (#1) |
| Integrations | The project documents metric export through nfinflux for InfluxDB and nfexporter for Prometheus-compatible tools, and says it is compatible with NfSen. | Documented integrations include OPNsense, pfSense, Suricata, ClickHouse, Kafka, syslog, Grafana and Wazuh. |
| Security | The documentation says nfcapd has no built-in access control, so host-level security should filter source IP addresses. | ntop says its packages are digitally signed with a PGP key and that users can verify package integrity with it. |
| Support | The project points users to its man pages, GitHub issues and pull requests, and the email address in AUTHORS for questions. | ntop offers paid consultancy, commercial-grade support by phone, email, or on-site, professional training, and customization; community support is described as best-efforts. |
Plans
ntopng
- CommunityFree
- Community (Open Source)Free
- Pro€299, paid once
- Pro€299.95, paid once
- Enterprise M€699.95, paid once
- Enterprise L€899.95, paid once
- Enterprise XL€1,499.95, paid once
In their own words
nfdump
nfdump is free BSD-licensed software for collecting, processing, and analyzing network-flow data in Linux self-hosted deployments. It handles NetFlow versions 1, 5, 7, and 9, IPFIX, and sFlow versions 4 and 6, and can convert live or PCAP-file traffic into flow data. Analysis includes tcpdump-like filtering, user-defined aggregation, flow statistics, conversation analysis, and bandwidth monitoring. Optional databases can add geolocation, autonomous-system, and Tor exit-node details. Results can be written as text, CSV, JSON, or user-defined formats. The suite includes nfcapd, sfcapd, nfdump, nfanon, nfexpire, and nfreplay. Collected files support LZO, LZ4, ZSTD, and bzip2 compression; ZSTD and bzip2 need system libraries. Metric export is documented through nfinflux for InfluxDB and nfexporter for Prometheus-compatible tools, and compatibility with NfSen is documented. Root privileges are unnecessary unless binding below port 1024. nfcapd has no built-in access control, so host-level filtering should protect source addresses. Version 1.7.x reads files from nfdump 1.6.18 or newer.
ntopng
ntopng monitors network traffic gathered from traffic mirrors, NetFlow exporters, SNMP devices, firewall logs and intrusion detection systems. Its encrypted web interface supports real-time and historical traffic exploration. Protocol detection powered by nDPI covers more than 450 Layer-7 application protocols, while metrics include application latency, round-trip time, throughput, TCP retransmission, packet loss, and VoIP jitter and MOS. It captures packets with libpcap or PF_RING and collects flows from nProbe, NetFlow and sFlow exporters. An HTTP-based RESTful API and Lua scripting are listed. Platforms include Linux, FreeBSD, Windows x64, macOS and RaspbianOS; pfSense and OPNsense are also named among supported Unix platforms. The free Community edition suggests limits of 256 live local hosts, 128K live flows and eight monitored interfaces. Paid perpetual licenses include one year of maintenance: Pro is €299, paid once, Enterprise M is €699.95, paid once, Enterprise L is €899.95, paid once, and Enterprise XL is €1,499.95, paid once.