Technologies and Trends

ntopng has had a search box for a while, but it we made it better to allow search for menu entries too! This to speed up and improve the user experience and navigation in ntopng. We added a short guided tour so you know what it can do. What you can search for It’s one box for two jobs. First, it filters every entry of the ntopng menu, so you can jump to a page or a setting by typing a few letters instead of hunting through the sidebar. Second, …

If you’ve opened ntopng recently you may have noticed a new entry under the dashboards menu: AI Dashboards. Instead of picking a metric, a chart type and a time range from a form, you describe what you want to see in plain language and nAnalyst writes the query, picks the visualization and drops the widget on the page. This post walks through what they are, how to use them, and how to edit what you build. Similar to Grafana dashboards, we wanted to add a customizable interface to create custom …

A flow table tells you which hosts are talking. A map tells you where. ntopng has two geomap views built on the same idea: one for live flows, one for flow alerts and together they answer “who are we communicating with around the world” and “where are the alerts coming from”. Here’s how to use both. Live flows on a map First, pick the interface you want to look at. Use the interface dropdown at the top left of the page. Open Flows > Live Flows > Geo Map View. …

Starting September 1st, 2026 (ntopng 6.7.280831 and later), cleartext flow data over ZMQ is no longer accepted by default. CURVE encryption is now enabled by default on ZMQ collection interfaces in ntopng. The same change applies to nProbe and Cento, which now also send ZMQ data encrypted by default. If no dedicated encryption key has been configured, ntopng falls back to a public built-in key pair. This provides protection against accidental cleartext exposure and ensures that encryption is enabled out of the box. However, users are strongly encouraged to configure dedicated keys as soon as possible, especially in production …

We are pleased to announce the release of PF_RING 9.4, bringing new capabilities for packet capture and flow processing, along with important improvements across the PF_RING kernel module, capture drivers, flow tracking, and system integration. Multi-Timeline Extraction with nPCAP PF_RING 9.4 adds support for multi-timeline extraction from n2disk dump sets, with timestamp-based data aggregation through nPCAP. This makes it possible to work more efficiently with traffic distributed across multiple timelines (e.g. load-balanced to multiple streams or interfaces), allowing traffic to be correlated and reconstructed based on timestamps, even when dumped to different …

The hierarchical cluster architecture was originally introduced to allow multiple ntopng instances to be organized in a parent/child topology. Child instances collected and analyzed local traffic, while parent instances aggregated information from multiple children to provide a centralized view of the network. At the time, this approach addressed a common requirement: monitoring geographically distributed sites while maintaining a central point of visibility. However, networking environments and the ntop ecosystem have both evolved considerably since then. Building a distributed deployment with nProbe and ntopng Today, the same use cases can be …