Monitor Backbone Traffic, Subscribers, and Service Quality at Scale
ISPs run some of the highest-throughput, most performance-sensitive networks in existence — where visibility gaps translate directly into service degradation, churn, and security exposure. ntop’s suite of tools gives ISPs the scale, granularity, and speed to monitor backbone links, subscriber traffic, and service quality without becoming a bottleneck themselves.
Why ISPs Need Purpose-Built Monitoring
Standard monitoring tools break down at ISP scale. Common challenges include:
- Backbone and peering links running at 10, 40, or 100+ Gbps, where most monitoring tools can’t keep up without dropping packets or losing accuracy.
- Millions of subscriber sessions to track individually for service quality, abuse detection, and usage-based billing.
- Volumetric DDoS attacks that can saturate links and degrade service for entire subscriber segments if not mitigated at the edge.
- Regulatory and lawful intercept requirements demanding accurate, timestamped traffic records.
The Solution: High-Performance Monitoring Built for Carrier Scale
- Line-rate flow export (nProbe Cento) — capture and export enriched NetFlow/IPFIX at 100+ Gbps using zero-copy PF_RING ZC processing, with no packet loss even at peak load.
- Centralized traffic analytics (ntopng) — aggregate flow data across backbone and edge links into real-time dashboards for capacity, performance, and anomaly monitoring.
- Application-aware subscriber insight (nDPI) — classify subscriber traffic by application, even encrypted, for service quality monitoring, usage analysis, and policy enforcement.
- On-premise DDoS scrubbing (nScrub) — detect and filter volumetric attacks at the network edge in real time, protecting service availability without waiting on upstream mitigation.
- Lossless recording for compliance (n2disk) — record and timestamp traffic with nanosecond precision to meet lawful intercept and forensic requirements.
Real Use Cases
Monitoring peering and backbone links
An ISP deploys nProbe Cento at core peering points to export enriched flow data at full line rate, giving network operations real-time visibility into traffic composition and capacity across the backbone.
Tracking subscriber quality of service
Using nDPI-based classification, an ISP identifies which applications are consuming bandwidth per subscriber segment, helping troubleshoot complaints and plan capacity by actual usage rather than aggregate throughput alone.
Mitigating a DDoS attack against a customer
A hosting customer comes under a volumetric attack that threatens to saturate the ISP’s shared infrastructure. nScrub detects and filters the attack traffic on-premise, protecting both the targeted customer and other subscribers sharing the link.
Supporting lawful intercept requests
n2disk’s lossless, timestamped packet recording provides the accurate traffic records regulators and law enforcement require, without needing a separate recording infrastructure.
Usage-based billing and reporting
Flow analytics from nProbe and ntopng provide granular, per-subscriber bandwidth data, supporting accurate usage-based billing and capacity planning.
Why ISPs Choose ntop
- Carrier-grade throughput — 100+ Gbps monitoring with zero-copy packet processing.
- Subscriber-level granularity — application and usage visibility down to the individual session.
- Built-in DDoS defense — mitigate attacks at the edge, on-premise, in real time.
- Compliance-ready — lossless recording for lawful intercept and forensic needs.
Related Use Cases
- Flow Collection & Traffic Analytics
- Threat Detection & Network Security
- Capacity Planning & Troubleshooting