Secure ZMQ Flow Collection Now Enabled by Default

Starting September 1st, 2026 (ntopng 6.7.280831 and later), cleartext flow data over ZMQ is no longer accepted by default. CURVE encryption is now enabled by default on ZMQ collection interfaces in ntopng.

The same change applies to nProbe and Cento, which now also send ZMQ data encrypted by default.

If no dedicated encryption key has been configured, ntopng falls back to a public built-in key pair. This provides protection against accidental cleartext exposure and ensures that encryption is enabled out of the box. However, users are strongly encouraged to configure dedicated keys as soon as possible, especially in production environments.

Configuring encryption in ntopng

A dedicated key pair can be configured on the ntopng side in either of the following ways:

• Add --zmq-encryption to let ntopng automatically generate a key pair. The generated public key is displayed on the interface status page.
• Add --zmq-encryption-key-priv <key> to specify a private key of your choice.

Please refer to the ntopng User’s Guide for complete configuration details.

Compatibility with older nProbe versions

This change may affect existing deployments.

Recent nProbe releases also enable ZMQ encryption by default and use the same public built-in key when no dedicated key has been configured.

However, older nProbe versions continue to send ZMQ data in cleartext. Such cleartext flows are now discarded by ntopng and therefore will no longer appear in the ntopng UI.

For this reason, we highly recommend upgrading nProbe and Cento to the latest available releases and configuring dedicated encryption keys on both sides of the ZMQ connection.

If you need to temporarily maintain compatibility with an older, unencrypted ZMQ sender, encryption can be disabled in ntopng using:

--zmq-disable-encryption

This should be considered a temporary compatibility measure, as this is exposing flow data in cleartext.

Action required

Users with existing ZMQ-based deployments should:

1. Upgrade ntopng, nProbe, and Cento to recent versions.
2. Configure dedicated CURVE encryption keys on the communicating endpoints.
3. Verify the ZMQ interface status in ntopng and ensure that encrypted flows are being received correctly.
4. Avoid using --zmq-disable-encryption except when required for compatibility with legacy deployments.

Thank you.