To monitor data from a mirror/SPAN port or from a tap, refer to Monitoring a Port Mirror/TAP.
PF_RING Zero Copy licenses may be required when the traffic is above 1Gbps. In this case, see Operating ntopng on large networks and blog post Best Practices for Efficiently Running ntopng.
nTap is ntop’s implementation of a remote/virtual/cloud tap natively embedded in ntopng. You can read more about it here