ntopng

AI

Previewing nAnalyst, the layer that finally explains your network
Today we have previewed out first AI-based tool named nAnalyst during out webinar taht we have run with support of the Alibaba Qwen team. This tool is designed to (finally) explain what happens in your network, and we’ll introduce it in September with bet starting on June 22nd. For those who missed the webinar can see the recording of the event. Below you can also find the presentation slides we have used today: Shall you be interested in providing us a feedback and willing to test nAnalyst beta, please fill …
nProbe

Observability: Enabling High-Resolution Timeseries in ntopng
Modern observability platforms are expected to answer questions that traditional monitoring systems were never designed to handle: Conventional network timeseries are excellent for long-term capacity planning and trend analysis, but they often smooth away the short-lived events that matter most during troubleshooting and incident analysis. With the introduction of High-Resolution Timeseries, ntopng closes this visibility gap by enabling historical traffic analysis at 15 second, or even lower, granularity, directly embedded into flow records.  Why High-Resolution Timeseries Matter Traditional flow records aggregate counters over the entire lifetime of a connection. While this approach …
Announce

AI-Powered Network Monitoring: Introducing ntopng MCP Server
AI-Powered Network Monitoring: Introducing ntopng MCP Server for Headless Security Connect your network monitoring directly to AI assistants. Query ClickHouse flows, pull live host stats, and automate security investigations—all through natural language. Table of Contents What is MCP? Why Headless Network Security? Generate Your API Token Add ntopng to Claude Code Available Tools Use Cases: SOC Analysts Use Cases: Network Managers Security Best Practices Troubleshooting FAQ What is MCP? The Model Context Protocol (MCP) exposes ntopng’s network data and tools to AI assistants like Claude Code, Cursor, and VS Code …
Cybersecurity

Merging ntopng Asset Inventory with Wazuh
Wazuh is a free, open-source security platform that combines SIEM (Security Information and Event Management) and XDR (Extended Detection and Response) capabilities. It is primarily used to monitor endpoints, cloud workloads, and containers to detect threats, ensure compliance, and respond to incidents in real-time. Integrating Wazuh with ntopng creates a powerful security layer by bridging the gap between host-based and network-based monitoring. The core value of this integration lies in comprehensive visibility. While Wazuh excels at monitoring what happens inside a machine, ntopng excels at monitoring what happens between machines. …
ntopng

HowTo Enable Passkey in ntopng
Passkey authentication is a passwordless sign-in method that allows you to log in to websites and apps using the same way you unlock your device—such as a fingerprint, face scan, or a screen lock PIN. It is designed to replace traditional passwords entirely, offering a significantly more secure and faster experience. In ntopng, it can be enabled to implement a multi-factor authentication method. Passkey will only work if selected conditions are met: Similar to MFA, you can enable Passkey in the user’s configuration page. As Passkey is a kind of …
ntopng

Building Custom ntopng Dashboards Using Grafana and ClickHouse
Modern network monitoring is no longer just about collecting data, it’s more about turning large volumes of time-series data into actionable insights. When enabling dump to ClickHouse, both for raw flow data and timeseries, users can build a highly scalable and flexible observability stack that goes far beyond traditional dashboards. In fact, in this post we explore the advantages of using Grafana to create custom dashboards on top of ntopng time-series data stored in ClickHouse. From ntopng to ClickHouse: A Scalable Time-Series Pipeline ntopng continuously generates rich time-series metrics, including: …
ntopng

Single Sign-On on ntopng with OpenID Connect (OIDC)
ntopng has always supported multiple authentication methods to fit different environments: local accounts, LDAP, RADIUS, HTTP basic auth, etc. Now it also supports OpenID Connect (OIDC), bringing native Single Sign-on (SSO) support for any standards-compliant Identity Provider (IdP), including Keycloak, Okta, Auth0, Azure AD / Entra ID, Google Workspace, and more. Why SSO? Managing separate credentials for every tool in a network operations centre is a maintenance burden and a security risk. Passwords get reused, accounts get forgotten, and off-boarding a staff member means hunting down every application they had …
ntopng

HowTo Enable Multi-Factor Authentication (MFA) in ntopng
Multi-Factor Authentication (MFA) is a security system that requires users to provide two or more verification factors to gain access to a resource such as an application, online account, or VPN. The use of MFA with sensitive information as network traffic is a key feature, in particular for the ntopng admin users. In the current dev branch (and soon stable) of ntopng we have introduced MFA. Once you have created a user, you need to click on the MFA tab and click on the blue button for enabling it. Using …
Artificial Intelligence

HowTo Use (Local) LLMs with ntopng: Part I
A Large Language Model  (LLM) is a type of artificial intelligence system that uses deep learning to  understand, generate, and manipulate human language.  Examples include Antropic Claude, OpenAI GPT, Meta Llama and Google Gemini. They can be used to answer questions and explain concepts, write and edit code, perform logical reasoning and summarize documents. At ntop we are making experiments with Artificial Intelligence (AI) and LLMs, and we’ll introduce new features in the coming months. For the time being we want to start introducing our community to the use of …
nProbe

Network Telemetry Demystified: Microscope vs Telescope
As an ntopng developer, I often hear from users who are confused about the building blocks of network monitoring. Today, I’ll explain three fundamental concepts that will help you understand what your monitoring tools are actually showing you. Introduction If you’ve ever looked at ntopng’s flow reports and wondered “What exactly am I looking at?” or “Why does this tool show me different information than my packet capture?”, you’re not alone. Network monitoring gives us two primary ways to observe traffic, each with its own strengths. Think of it like …
nProbe

Capacity Planning for IT Teams: A Practical Guide Using ntop Tools
Transform network data into actionable infrastructure decisions with ntopng Introduction Every IT team faces the same challenge: how much network capacity is enough? Too little, and applications grind to a halt during peak hours. Too much, and you’re wasting budget on infrastructure you don’t need. Capacity planning doesn’t have to be guesswork. With the right tools and methodology, you can predict growth, identify bottlenecks before they cause outages, and make data-driven decisions about infrastructure investments. ntopng—the high-performance network traffic analyzer—gives you the visibility needed for effective capacity planning . Whether you’re managing a …
Cybersecurity

Security Investigation for Beginners (using ntopng)
Introduction When I first started investigating network security incidents, I felt overwhelmed by the complexity. Packets flying everywhere, mysterious connections, alerts I didn’t understand—sound familiar? Whether you’re an IT professional new to security, a small business owner wearing multiple hats, or simply someone who wants to understand what’s really happening on your network, this guide is for you. ntopng is more than just a network monitoring tool—it’s your window into the invisible world of network traffic. And the best part? You don’t need to be a security veteran to start using …

High-performance network traffic monitoring and analysis tools.

Explore
Newsletter
Subscribe