Advanced Features

Advanced ntopng features such as logical interface aggregation and bridging are described in this section.

• 1. Bridging and Traffic Policing
• 2. IDS Acceleration
• 3. Interfaces
  • 3.1. Packet vs ZMQ Interfaces
    • 3.1.1. Packet Interfaces
    • 3.1.2. ZMQ Interfaces
    • 3.1.3. Traffic Analysis: Differences
    • 3.1.4. Packet vs ZMQ: Which One to use?
  • 3.2. View Interfaces
  • 3.3. Interfaces vs View Interfaces
  • 3.4. Interfaces Disaggregation
    • 3.4.1. Dynamic Disaggregation
    • 3.4.2. Custom Disaggregation
  • 3.5. Using nTap as Virtual Tap with ntopng
    • 3.5.1. ntopng Enterprise L
    • 3.5.2. All Other ntopng Editions
• 4. Light View
  • 4.1. Dashboard
  • 4.2. Report and Historical Flows
  • 4.3. Interface Details
  • 4.4. Alerts
  • 4.5. Search
• 5. Live Pcap Download
• 6. Flow Deduplication
• 7. OEM Customizations
• 8. Snapshots
• 9. Syslog Log Ingestion
  • 9.1. ntopng Configuration
  • 9.2. Logs Demultiplexing
  • 9.3. Syslog Relay Configuration (Optional)
  • 9.4. Hosts Log Ingestion
  • 9.5. nBox Log Ingestion
• 10. ClickHouse Timeseries
  • 10.1. Overview
  • 10.2. Configuration
    • 10.2.1. Deployment Modes
    • 10.2.2. Timeseries Driver Preference
    • 10.2.3. Data Retention
  • 10.3. Database Schema
    • 10.3.1. Table Definition
    • 10.3.2. Column Details
    • 10.3.3. Partitioning and Ordering
  • 10.4. Query Behaviour
    • 10.4.1. Counter vs. Gauge Metrics
  • 10.5. Comparison with Other Drivers
• 11. Observability
  • 11.1. Overview
  • 11.2. Data Flow
  • 11.3. nProbe Configuration
  • 11.4. ntopng Configuration
  • 11.5. ClickHouse Schema
  • 11.6. Visualizing HR Timeseries in ntopng
    • 11.6.1. Interface-Level HR Chart
    • 11.6.2. Host-Level HR Chart
    • 11.6.3. Historical Flow HR Chart
    • 11.6.4. Observability Page
  • 11.7. Grafana Dashboard