Get a License

ntopng

nProbe

HowTo Collect Flows: the Case of Palo Alto and Fortinet
Network devices export flow data in many flavors. Some vendors stick closely to the NetFlow/IPFIX standard, so collecting their flows is essentially plug-and-play. Others extend the standard with proprietary Information Elements (IEs) to expose vendor-specific details (e.g. application names, user identities, security verdicts, etc) which requires a bit of extra configuration on the collector side. In this post we revisit and update an older article on collecting proprietary flows with nProbe, using two widely deployed firewall vendors as concrete examples: Fortinet FortiGate and Palo Alto Networks. Two Different Approaches, One Collector FortiGate exports flow data …
ntopng

Supercharging ntopng: Engineering a Fast, Modern Network GUI
If you’ve opened ntopng recently, you may have noticed something feels a little different — a little faster. That’s not your imagination. We’ve rebuilt the main menu, footer and top header, interfaces selector and the preferences pages using Vue.js, the first step in a broader effort to modernize ntopng’s entire interface. What Changed The menu and preferences sections have historically been built on server-rendered HTML — reliable, but not built for speed. Every click meant a round trip to the server and a full page reload, even for something as …
ntopng

Who Is Eating My Bandwidth ?
Every network administrator has, at some point, asked the same question: who is eating my bandwidth? On a typical corporate LAN connected via flat-rate fiber, the answer is mostly a curiosity — useful for capacity planning, less so for the monthly bill. But the moment your network relies on a metered link — a 4G/5G mobile uplink, a VSAT satellite backhaul, an MPLS circuit billed by volume, or a roaming SIM in an IoT fleet — the same question becomes a cost-control problem, and getting the wrong answer can be …
AI

Previewing nAnalyst, the layer that finally explains your network
Today we have previewed out first AI-based tool named nAnalyst during out webinar taht we have run with support of the Alibaba Qwen team. This tool is designed to (finally) explain what happens in your network, and we’ll introduce it in September with bet starting on June 22nd. For those who missed the webinar can see the recording of the event. Below you can also find the presentation slides we have used today: Shall you be interested in providing us a feedback and willing to test nAnalyst beta, please fill …
nProbe

Observability: Enabling High-Resolution Timeseries in ntopng
Modern observability platforms are expected to answer questions that traditional monitoring systems were never designed to handle: Conventional network timeseries are excellent for long-term capacity planning and trend analysis, but they often smooth away the short-lived events that matter most during troubleshooting and incident analysis. With the introduction of High-Resolution Timeseries, ntopng closes this visibility gap by enabling historical traffic analysis at 15 second, or even lower, granularity, directly embedded into flow records.  Why High-Resolution Timeseries Matter Traditional flow records aggregate counters over the entire lifetime of a connection. While this approach …
Announce

AI-Powered Network Monitoring: Introducing ntopng MCP Server
AI-Powered Network Monitoring: Introducing ntopng MCP Server for Headless Security Connect your network monitoring directly to AI assistants. Query ClickHouse flows, pull live host stats, and automate security investigations—all through natural language. Table of Contents What is MCP? Why Headless Network Security? Generate Your API Token Add ntopng to Claude Code Available Tools Use Cases: SOC Analysts Use Cases: Network Managers Security Best Practices Troubleshooting FAQ What is MCP? The Model Context Protocol (MCP) exposes ntopng’s network data and tools to AI assistants like Claude Code, Cursor, and VS Code …
Cybersecurity

Merging ntopng Asset Inventory with Wazuh
Wazuh is a free, open-source security platform that combines SIEM (Security Information and Event Management) and XDR (Extended Detection and Response) capabilities. It is primarily used to monitor endpoints, cloud workloads, and containers to detect threats, ensure compliance, and respond to incidents in real-time. Integrating Wazuh with ntopng creates a powerful security layer by bridging the gap between host-based and network-based monitoring. The core value of this integration lies in comprehensive visibility. While Wazuh excels at monitoring what happens inside a machine, ntopng excels at monitoring what happens between machines. …
ntopng

HowTo Enable Passkey in ntopng
Passkey authentication is a passwordless sign-in method that allows you to log in to websites and apps using the same way you unlock your device—such as a fingerprint, face scan, or a screen lock PIN. It is designed to replace traditional passwords entirely, offering a significantly more secure and faster experience. In ntopng, it can be enabled to implement a multi-factor authentication method. Passkey will only work if selected conditions are met: Similar to MFA, you can enable Passkey in the user’s configuration page. As Passkey is a kind of …
ntopng

Building Custom ntopng Dashboards Using Grafana and ClickHouse
Modern network monitoring is no longer just about collecting data, it’s more about turning large volumes of time-series data into actionable insights. When enabling dump to ClickHouse, both for raw flow data and timeseries, users can build a highly scalable and flexible observability stack that goes far beyond traditional dashboards. In fact, in this post we explore the advantages of using Grafana to create custom dashboards on top of ntopng time-series data stored in ClickHouse. From ntopng to ClickHouse: A Scalable Time-Series Pipeline ntopng continuously generates rich time-series metrics, including: …
ntopng

Single Sign-On on ntopng with OpenID Connect (OIDC)
ntopng has always supported multiple authentication methods to fit different environments: local accounts, LDAP, RADIUS, HTTP basic auth, etc. Now it also supports OpenID Connect (OIDC), bringing native Single Sign-on (SSO) support for any standards-compliant Identity Provider (IdP), including Keycloak, Okta, Auth0, Azure AD / Entra ID, Google Workspace, and more. Why SSO? Managing separate credentials for every tool in a network operations centre is a maintenance burden and a security risk. Passwords get reused, accounts get forgotten, and off-boarding a staff member means hunting down every application they had …
ntopng

HowTo Enable Multi-Factor Authentication (MFA) in ntopng
Multi-Factor Authentication (MFA) is a security system that requires users to provide two or more verification factors to gain access to a resource such as an application, online account, or VPN. The use of MFA with sensitive information as network traffic is a key feature, in particular for the ntopng admin users. In the current dev branch (and soon stable) of ntopng we have introduced MFA. Once you have created a user, you need to click on the MFA tab and click on the blue button for enabling it. Using …
Artificial Intelligence

HowTo Use (Local) LLMs with ntopng: Part I
A Large Language Model  (LLM) is a type of artificial intelligence system that uses deep learning to  understand, generate, and manipulate human language.  Examples include Antropic Claude, OpenAI GPT, Meta Llama and Google Gemini. They can be used to answer questions and explain concepts, write and edit code, perform logical reasoning and summarize documents. At ntop we are making experiments with Artificial Intelligence (AI) and LLMs, and we’ll introduce new features in the coming months. For the time being we want to start introducing our community to the use of …

High-performance network traffic monitoring and analysis tools.

Explore
Newsletter
Subscribe