Technologies and Trends

  • Home
  • Technologies and Trends
Technologies and Trends

ntop License Sizing Guide
A popular question we receive from users is the type of ntop license that should be used in projects. Below we try to answer this question to ease your choice. Packet Processing For use cases where you need to capture raw packets and analyze them. Note that up to 1 Gbit you can use PF_RING (no ZC), however above that speed PF_RING ZC is required. Network Speed ntopng (Standalone) ntopng + nProbe ntopng + nProbe Cento < 1 Gbit ✓ ✓ < 5 Gbit ✓ ✓ ✓ < 10 Gbit …
nScrub

nScrub 1.8: Performance, Flexibility, and Hardware Support
We are excited to announce the release of nScrub 1.8, the latest version of our high-performance DDoS protection and traffic scrubbing solution. This update brings significant improvements to the engine, new configuration options, expanded hardware support, and broader packaging availability. Engine Enhancements The 1.8 release introduces several performance optimizations and functional upgrades across the nScrub engine: New Options API Improvements The REST API has been extended to give administrators finer control over traffic mirroring: Tools and Packaging Updates Miscellaneous Improvements nScrub 1.8 is now available! We recommend all users upgrade to …
Technologies and Trends

PF_RING 9.2: Extended Offloads On Napatech and NVIDIA
We are excited to announce the release of PF_RING 9.2. This release brings numerous improvements across the core library, kernel module, and drivers, with a strong focus on stability, performance, and compatibility with modern Linux kernels and hardware platforms. PF_RING Kernel Module and Library The user-space library has been refined to improve stability and compatibility, with improvements in IPv6 and GRE packet decoding, and compatibility with the latest nDPI library for Layer-7 detection. The kernel module introduces several important enhancements, including improved namespace and container support, enabling smoother operation in virtualized and …
ntopng

ntopng 6.6: IXP/Telco Traffic Observability, Faster Flow Collection
We’re excited to announce the release of ntopng 6.6, available today! This release focuses on Autonomous Systems (AS) analytics, a major rework of the flow collection engine to provide better correlations and improve performance, and a native ClickHouse Cloud integration. But, as usual, there are many other improvements. Key Breakthroughs Autonomous Systems Intelligence ntopng 6.6 introduces brand new Autonomous Systems dashboards, Sankey visualizations, and comprehensive AS statistics.You can now easily understand traffic relationships between transit and origin ASes, track top contributors, and visualize AS-level traffic flows in real time. The release also brings: These …
nProbe

nProbe 11.0: Smarter Flow Analysis, Deeper Protocol Visibility, Enhanced GTP Traffic Correlation
We’re excited to announce the release of nProbe 11.0. This release incorporates several improvements and brings major improvements in flow analysis, tunnel handling, and TCP statistics, along with new features that make nProbe even more flexible and robust for complex network monitoring environments. Key Highlights Advanced TCP Flags Analysis nProbe 11.0 introduces enhanced TCP flag analysis, enabling more precise insights into TCP session behavior and improving visibility into flow state transitions. Enhanced GTP-C/GTP-U Traffic Correlation With this new release we have enhanced our GTP traffic processing and correlation (GTP-C with GTP-U) architecture. …
cento

Cento 2.4: Flexible Export, Improved Telco Support
This is to announce the release of cento 2.4, a major update focused on boosting export flexibility, improving telco-grade encapsulation support, and strengthening performance and reliability across the entire data pipeline.This release brings architectural enhancements, new features for ntopng users, and improved compatibility with modern hardware and Linux distributions. Below is an overview of what’s new. Key Features Template-based serialization (JSON/TLV) Cento 2.4 introduces support for template-driven serialization also when exporting data using JSON and TLV (used by ntopng). Users can now define exactly which fields to export, reducing overhead and …
nDPI

nDPI 5.0: Enhanced Traffic Fingerprinting and FPC, Many new Protocols
We are proud to announce the release of nDPI 5.0, the latest major update to our open-source Deep Packet Inspection (DPI) toolkit. This release introduces a powerful new fingerprinting system, unlimited protocol support, and enhanced detection capabilities that go beyond traditional methods. Major Highlights A Unified nDPI Fingerprint With nDPI 5.0, we are introducing a new fingerprinting mechanism that combines multiple layers of flow metadata into a single, robust fingerprint. This unified fingerprint integrates: This new approach allows nDPI to identify and correlate encrypted or obfuscated traffic more accurately than ever before.You can read more about the …
cento

HowTo Measure the Status and Performance of Network Flows
NetFlow has been originally designed to monitor network traffic using simple bytes/packets metrics. For TCP, it is also possible to know what TCP flags (that indicate the connection state) have been used on a flow, as NetFlow/IPFIX exports them as a cumulative OR of all TCP flags of the flow. This allows you to know if a SYN flag has been observed on a flow but not the number of SYN flags that have been reported for a flow. No other information elements have been implemented to report detailed TCP flow …
Features

Simplifying Packages Installation with ntop-installer
Depending on your Linux distribution, you can install ntop packages using your platform packager (apt on Debian/Ubuntu and yum/dnf on RedHat/RockyLinux). Some users asked us a simplified installation tool, for networkers not acquainted with packages and installers. For this reason we have created a new tool named ntop-installer that allows ntop packages to be installer/removed using a text-based GUI rather than using apt/dnf. This new tool can be installed as follows: One that you just need to start ntop-installer and install/remove packages graphically. Below you can find some examples of …
Cybersecurity

When SNIs Cannot be Trusted
SNI (Server Name Indication) is an optional extension in TLS/QUIC that contains the symbolic host name we’re connecting to. For instance, during the TLS handshake, the SNI allows the server to identify the correct TLS certificate of a server hosting multiple websites. nDPI reports SNIs in order to make it possible to detect name-based services deployed on the same server IP address. Below you can see an example of how nDPI reports SNIs in encrypted traffic. Client applications use the SNI to verify that the website it is connecting to matches …
Technologies and Trends

Announcing ntop Professional Training: November 2025
ntop tools range from packet capture, traffic analysis and processing, and sometimes it is not easy to keep up on product updates as well master all the tools. This has been the driving force for organising ntop professional training. This is to announce that in October we have scheduled the next ntop Professional Training session. It will take place online (Microsoft Teams) on 13th, 18th, 20th, 25th, 27th of November, 2025 at 3.00 PM CET (9.00 AM EDT). Training will be held in English language and each session lasts 90 …

High-performance network traffic monitoring and analysis tools.

Explore
Newsletter
Subscribe