Technologies and Trends

Today we held the webinar about ntopng 7.0 and it has been a great success with many attendees. Those who missed the event can find below the event recording as well the presentation slides. Enjoy ! …

Managing disk space is an important part of operating ntopng, especially in environments that collect large volumes of network traffic data. ntopng always allowed you to configure data retention in days, which provides a convenient way to control how long historical data is kept. However the actual disk space consumed by that data can vary significantly depending on traffic volume and monitoring activity, and in some case this led to instances filling up all the disk due to a miscalculation or unexpected traffic levels. To make storage management easier and …

ntopng has had a search box for a while, but it we made it better to allow search for menu entries too! This to speed up and improve the user experience and navigation in ntopng. We added a short guided tour so you know what it can do. What you can search for It’s one box for two jobs. First, it filters every entry of the ntopng menu, so you can jump to a page or a setting by typing a few letters instead of hunting through the sidebar. Second, …

If you’ve opened ntopng recently you may have noticed a new entry under the dashboards menu: AI Dashboards. Instead of picking a metric, a chart type and a time range from a form, you describe what you want to see in plain language and nAnalyst writes the query, picks the visualization and drops the widget on the page. This post walks through what they are, how to use them, and how to edit what you build. Similar to Grafana dashboards, we wanted to add a customizable interface to create custom …

A flow table tells you which hosts are talking. A map tells you where. ntopng has two geomap views built on the same idea: one for live flows, one for flow alerts and together they answer “who are we communicating with around the world” and “where are the alerts coming from”. Here’s how to use both. Live flows on a map First, pick the interface you want to look at. Use the interface dropdown at the top left of the page. Open Flows > Live Flows > Geo Map View. …

Starting September 1st, 2026 (ntopng 6.7.280831 and later), cleartext flow data over ZMQ is no longer accepted by default. CURVE encryption is now enabled by default on ZMQ collection interfaces in ntopng. The same change applies to nProbe and Cento, which now also send ZMQ data encrypted by default. If no dedicated encryption key has been configured, ntopng falls back to a public built-in key pair. This provides protection against accidental cleartext exposure and ensures that encryption is enabled out of the box. However, users are strongly encouraged to configure dedicated keys as soon as possible, especially in production …

We are pleased to announce the release of PF_RING 9.4, bringing new capabilities for packet capture and flow processing, along with important improvements across the PF_RING kernel module, capture drivers, flow tracking, and system integration. Multi-Timeline Extraction with nPCAP PF_RING 9.4 adds support for multi-timeline extraction from n2disk dump sets, with timestamp-based data aggregation through nPCAP. This makes it possible to work more efficiently with traffic distributed across multiple timelines (e.g. load-balanced to multiple streams or interfaces), allowing traffic to be correlated and reconstructed based on timestamps, even when dumped to different …

The hierarchical cluster architecture was originally introduced to allow multiple ntopng instances to be organized in a parent/child topology. Child instances collected and analyzed local traffic, while parent instances aggregated information from multiple children to provide a centralized view of the network. At the time, this approach addressed a common requirement: monitoring geographically distributed sites while maintaining a central point of visibility. However, networking environments and the ntop ecosystem have both evolved considerably since then. Building a distributed deployment with nProbe and ntopng Today, the same use cases can be …