This feature is available only from Enterprise L license.
Using SNMP Device rules, ntopng can generate an alert when an interface of a SNMP device crosses a threshold (either absolute or in percentage).
The idea is to compare the metric value with respect to a period of time and check the difference. If you use the percantage (%) you can easily spot situations where a host/interface doubles its traffic for instance.
Thresholds can be configured for SNMP metrics such as packets, bytes, and errors. When selecting packets or errors as the metric. The threshold can be specified as a percentage or absolute value with respect to the check frequency. Example if you set a traffic threshold of > 1 MB and 5 minutes frequency, an alert is triggered when the value of traffic in the last 5 minutes is greater then 1 MB. If instead you set the threshold to > 20% and 1 day frequency, an alert is triggered when the counter value with respect of the previous day is 20% (or more) bigger.
On the other hand, if bytes is chosen as the metric, the threshold can also be expressed in terms of volume (KB, MB, GB). These checks are performed at frequencies of every 5 minutes, every hour, and every day.
these checks are useful for spotting misbehaving interfaces that instead would not have been noticed otherwise.