ntopng

How Flow Deduplication Works in nProbe and ntopng
Flow deduplication is the process of identifying and removing duplicate flow records that appear in NetFlow/IPFIX data when the same traffic is monitored and exported by multiple observation points (typically network devices) in the network. Without deduplication there are various issues that can arise including: Common flows duplication scenarios include: Said that flow duplication needs to be avoided, ntopng (Enterprise XL and superior) and nProbe (Enterprise L and superior) implement flow deduplication. In ntopng you can enable it from preferences and it works only with flow collection (i.e. ZMQ) and …
ntopng

ntopng Direct Dump Mode for High-Speed Flow Collection
When ntopng receives flows from nProbe (NetFlow collector) or nProbe Cento (100 Gbit probe) over ZMQ or Kafka, each flow must go through several processing stages before it is finally stored in the database. These stages include metadata enrichment, classification, analytics, behavioural checks, and additional internal operations. While this processing pipeline is essential for ntopng’s real-time monitoring, it naturally adds latency between the moment a flow arrives and when it becomes queryable in the (ClickHouse) storage backend. In large deployments ingesting thousands or hundreds of thousands of flows per second, …
nDPI

Is JA4 Now Obsolete?
JA4 is a modern network fingerprinting standard used to identify and profile clients initiating encrypted TLS (Transport Layer Security) connections. JA4 it is the successor to the widely used but now deprecated JA3 standard. JA3 is considered obsolete because it cannot provide a stable identifier for modern browsers and is easily bypassed by attackers. Its reliance on the specific sequence of fields in the TLS ClientHello message makes it highly fragile in today’s networking environment. One (but not the only one) of the main limitations is JA3 is sensitivity to …
Webinar

ntop Winter Webinar: ntopng 6.6 and New ntop Software Releases
Last week, we released a new release of the ntop tools: ntopng 6.6, nProbe 11.0, nDPI 5.0, Cento 2.4, PF_RING 9.2, and nScrub 1.8. As we have implemented many new features, including a brand-new ntopng component designed for monitoring large networks, we would like to introduce all this with a webinar. The goal of this event is to go through the new features and show them live, in addition to Q&A at the end of the event. For those who missed the event, please find enclosed below the presentation slides …
Technologies and Trends

ntop License Sizing Guide
A popular question we receive from users is the type of ntop license that should be used in projects. Below we try to answer this question to ease your choice. Packet Processing For use cases where you need to capture raw packets and analyze them. Note that up to 1 Gbit you can use PF_RING (no ZC), however above that speed PF_RING ZC is required. Network Speed ntopng (Standalone) ntopng + nProbe ntopng + nProbe Cento < 1 Gbit ✓ ✓ < 5 Gbit ✓ ✓ ✓ < 10 Gbit …
nScrub

nScrub 1.8: Performance, Flexibility, and Hardware Support
We are excited to announce the release of nScrub 1.8, the latest version of our high-performance DDoS protection and traffic scrubbing solution. This update brings significant improvements to the engine, new configuration options, expanded hardware support, and broader packaging availability. Engine Enhancements The 1.8 release introduces several performance optimizations and functional upgrades across the nScrub engine: New Options API Improvements The REST API has been extended to give administrators finer control over traffic mirroring: Tools and Packaging Updates Miscellaneous Improvements nScrub 1.8 is now available! We recommend all users upgrade to …
Technologies and Trends

PF_RING 9.2: Extended Offloads On Napatech and NVIDIA
We are excited to announce the release of PF_RING 9.2. This release brings numerous improvements across the core library, kernel module, and drivers, with a strong focus on stability, performance, and compatibility with modern Linux kernels and hardware platforms. PF_RING Kernel Module and Library The user-space library has been refined to improve stability and compatibility, with improvements in IPv6 and GRE packet decoding, and compatibility with the latest nDPI library for Layer-7 detection. The kernel module introduces several important enhancements, including improved namespace and container support, enabling smoother operation in virtualized and …
ntopng

ntopng 6.6: IXP/Telco Traffic Observability, Faster Flow Collection
We’re excited to announce the release of ntopng 6.6, available today! This release focuses on Autonomous Systems (AS) analytics, a major rework of the flow collection engine to provide better correlations and improve performance, and a native ClickHouse Cloud integration. But, as usual, there are many other improvements. Key Breakthroughs Autonomous Systems Intelligence ntopng 6.6 introduces brand new Autonomous Systems dashboards, Sankey visualizations, and comprehensive AS statistics.You can now easily understand traffic relationships between transit and origin ASes, track top contributors, and visualize AS-level traffic flows in real time. The release also brings: These …
nProbe

nProbe 11.0: Smarter Flow Analysis, Deeper Protocol Visibility, Enhanced GTP Traffic Correlation
We’re excited to announce the release of nProbe 11.0. This release incorporates several improvements and brings major improvements in flow analysis, tunnel handling, and TCP statistics, along with new features that make nProbe even more flexible and robust for complex network monitoring environments. Key Highlights Advanced TCP Flags Analysis nProbe 11.0 introduces enhanced TCP flag analysis, enabling more precise insights into TCP session behavior and improving visibility into flow state transitions. Enhanced GTP-C/GTP-U Traffic Correlation With this new release we have enhanced our GTP traffic processing and correlation (GTP-C with GTP-U) architecture. …
cento

Cento 2.4: Flexible Export, Improved Telco Support
This is to announce the release of cento 2.4, a major update focused on boosting export flexibility, improving telco-grade encapsulation support, and strengthening performance and reliability across the entire data pipeline.This release brings architectural enhancements, new features for ntopng users, and improved compatibility with modern hardware and Linux distributions. Below is an overview of what’s new. Key Features Template-based serialization (JSON/TLV) Cento 2.4 introduces support for template-driven serialization also when exporting data using JSON and TLV (used by ntopng). Users can now define exactly which fields to export, reducing overhead and …
nDPI

nDPI 5.0: Enhanced Traffic Fingerprinting and FPC, Many new Protocols
We are proud to announce the release of nDPI 5.0, the latest major update to our open-source Deep Packet Inspection (DPI) toolkit. This release introduces a powerful new fingerprinting system, unlimited protocol support, and enhanced detection capabilities that go beyond traditional methods. Major Highlights A Unified nDPI Fingerprint With nDPI 5.0, we are introducing a new fingerprinting mechanism that combines multiple layers of flow metadata into a single, robust fingerprint. This unified fingerprint integrates: This new approach allows nDPI to identify and correlate encrypted or obfuscated traffic more accurately than ever before.You can read more about the …
nProbe

HowTo Dump Collected Flows and nTap Packets with nProbe
When nProbe collects data (both sFlow/NetFlow/IPFIX and nTap), it immediately discards collected data after processing. However sometimes it is useful to dump such data. A typical use-case include: Probe can dump collected data to a virtual network interface on top of which applications such as n2disk or tcpdump can be enabled. This can be enabled with --dump-collected-pkts <interface> for dumping collected data onto the specified network interface. In case of nTap raw collectd packets are dumped “as is” to the interface, whereas collected flows are dumped with a dummy ethernet/IP/UDP header. You …

High-performance network traffic monitoring and analysis tools.

Explore
Newsletter
Subscribe