Get a License
Announce

Introducing JA5: A Stable, Collision-Resistant Successor to JA4
TLS client fingerprinting has become one of the workhorse techniques in network security, and JA4 (FoxIO) has been the de facto standard for identifying TLS clients from their ClientHello messages. But recent production experience at ntop surfaced two real limitations, and today we’re announcing JA5, an open, patent-free extension of JA4 that addresses both. Ephemeral Extensions Break Hash Stability JA4 builds its fingerprint from the full set of TLS extensions a client presents, hashed together with the cipher suite list. The trouble is that not every extension reflects something stable …
ntopng

ntopng User Interface: Introducing the New Navigation Bar
In our continuous effort to improve user experience and make network monitoring more intuitive, we have completely redesigned the ntopng Navigation Bar. As our feature set expands—with crucial additions like the nAnalyst automated pipeline, specialized AI Dashboards, and high-resolution Observability analytics—the legacy menu structure needed a logical evolution to reduce deep nesting and facilitate daily operations. We have completely rearranged the main categories to help you find what you need faster, drawing a clear line between operational network monitoring, analysis tools, and security/alerting policies. Key Structural Updates Dashboard & Advanced …
Technologies and Trends

Elevate Your Network Visibility with ntop Professional Training November 2026
As network architectures evolve, staying ahead of performance issues and modern cybersecurity threats requires deep visibility and mastery of your tools. Here at ntop, our product range spans from high-speed packet capture to advanced traffic analysis. With our continuous updates and feature additions, keeping up with the ecosystem can be a challenge. Whether you are configuring large enterprise installations or looking to minimize the learning curve for new team members, this structured training will equip you with everything you need to build a tailored monitoring infrastructure. What’s New? Mastering ntopng …
Announce

Cento 2.6: ClickHouse Support, Enhanced Tunnel Visibility, PQC, and more
We are pleased to announce the release of cento 2.6, bringing a broad set of new capabilities and improvements to high-performance traffic processing and flow export. This release expands cento’s integration with the ntop ecosystem, adds new visibility into tunneled traffic, introduces Post-Quantum Cryptography (PQC) support, and delivers important improvements across protocol dissection, security, and performance. ClickHouse Export Cento 2.6 introduces ClickHouse export support, using a schema compatible with ntopng. This makes it easier to feed high-volume flow data into ClickHouse-based deployments and integrate cento into existing ntopng-oriented data pipelines. ClickHouse settings …
Cybersecurity

ntop and the EU Cyber Resilience Act
Under the EU Cyber Resilience Act (CRA), it has become compulsory for manufacturers of products sold on the EU market to report exploited vulnerabilities and severe incidents. As a result, ntop is fully committed to compliance with these new requirements. Since September 11, 2026, Article 14 of the CRA requires ntop to report security issues directly to the ENISA Single Reporting Platform (SRP). When a report is submitted here, it is simultaneously routed to both ENISA and the relevant national Computer Security Incident Response Team (CSIRT). We are required to report two …
Announce

nProbe 11.2: BGP/BMP Support, OT Protocols, Faster Flow Collection
We are pleased to announce the release of nProbe 11.2, bringing major new capabilities for network visibility, routing intelligence, flow analysis, and OT monitoring. This release significantly expands nProbe beyond traditional flow collection and export, adding BGP/BMP route enrichment, OT protocols support, collection deduplication, enhanced IPv6 handling. Flow collection has also been optimized to deliver higher performance with respect to version 11. Furthermore the export of information elements has been aligned with Cento, making them interchangeable. BGP/BMP Support and Route Enrichment One of the highlights of nProbe 11.2 is native support for BGP …
AI

Welcome to ntopng 7.0: Modern GUI, nAnalyst, Sites, Observability, BGP/BMP, PQC, Wazuh…
We are excited to announce the release of ntopng 7.0, the most significant update to ntopng in years. This release touches nearly every part of the product: nAnalyst: AI-Assisted Traffic Analysis The headline feature of ntopng 7.0 is nAnalyst, a new layer that brings AI directly into traffic and security analysis. nAnalyst adds: nAnalyst is available starting from Enterprise M and above, and requires ClickHouse to be enabled. It’s also been wired into the Wazuh alerts page and into flow details, so AI-assisted analysis is available wherever you’re already looking …
Technologies and Trends

Secure ZMQ Flow Collection Now Enabled by Default
Starting September 1st, 2026 (ntopng 6.7.280831 and later), cleartext flow data over ZMQ is no longer accepted by default. CURVE encryption is now enabled by default on ZMQ collection interfaces in ntopng. The same change applies to nProbe and Cento, which now also send ZMQ data encrypted by default. If no dedicated encryption key has been configured, ntopng falls back to a public built-in key pair. This provides protection against accidental cleartext exposure and ensures that encryption is enabled out of the box. However, users are strongly encouraged to configure dedicated keys as soon as possible, especially in production …
nDPI

Introducing nDPI 6.0: Licensing Update, Slow DoS Detection and Smarter Fingerprints
We are proud to announce the release of nDPI 6.0, the latest major update to our open-source Deep Packet Inspection (DPI) toolkit. This release brings an important licensing update, a brand-new detection logic for Slow DoS attacks, more flexible and reliable traffic fingerprints, and zero-overhead runtime observability via USDT tracepoints — on top of new protocols and dozens of improvements and fixes. Updated Licensing Terms With nDPI 6.0 we have updated the licensing terms of the project, introducing a distinction between for-profit and not-for-profit usage of some components. Full details …
Technologies and Trends

Introducing PF_RING 9.4: Expanding Capabilities Across Capture, Flow Processing and Hardware Support
We are pleased to announce the release of PF_RING 9.4, bringing new capabilities for packet capture and flow processing, along with important improvements across the PF_RING kernel module, capture drivers, flow tracking, and system integration. Multi-Timeline Extraction with nPCAP PF_RING 9.4 adds support for multi-timeline extraction from n2disk dump sets, with timestamp-based data aggregation through nPCAP. This makes it possible to work more efficiently with traffic distributed across multiple timelines (e.g. load-balanced to multiple streams or interfaces), allowing traffic to be correlated and reconstructed based on timestamps, even when dumped to different …
nDPI

Announcing nDPI Dual License Change
A License Change for nDPI: Protecting the Project We Started in 2012 When we began nDPI back in 2012, the idea was simple: build an open source, high-performance Deep Packet Inspection engine that anyone could use as a foundation layer for network applications. No gatekeeping or strings attached, but just a solid piece of infrastructure that the community could build on, improve, and share back. In order to protect this idea, we have registered the nDPI trademark both in the US and EU to prevent people from using the word …
nProbe

HowTo Collect Flows: the Case of Palo Alto and Fortinet
Network devices export flow data in many flavors. Some vendors stick closely to the NetFlow/IPFIX standard, so collecting their flows is essentially plug-and-play. Others extend the standard with proprietary Information Elements (IEs) to expose vendor-specific details (e.g. application names, user identities, security verdicts, etc) which requires a bit of extra configuration on the collector side. In this post we revisit and update an older article on collecting proprietary flows with nProbe, using two widely deployed firewall vendors as concrete examples: Fortinet FortiGate and Palo Alto Networks. Two Different Approaches, One Collector FortiGate exports flow data …

High-performance network traffic monitoring and analysis tools.

Explore
Newsletter
Subscribe