A popular question we receive from users is the type of ntop license that should be used in projects. Below we try to answer this question to ease your choice.
Packet Processing
For use cases where you need to capture raw packets and analyze them. Note that up to 1 Gbit you can use PF_RING (no ZC), however above that speed PF_RING ZC is required.
| Network Speed | ntopng (Standalone) | ntopng + nProbe | ntopng + nProbe Cento |
| < 1 Gbit | ✓ | ✓ | |
| < 5 Gbit | ✓ | ✓ | ✓ |
| < 10 Gbit | ✓ | ✓ | |
| 10+/25/40/100 Gbit | ✓ |
Flow Collection
For use cases where you need to collect sFlow/NetFlow/IPFIX flows and analyze them with ntopng.
| Network Speed | ntopng (Standalone) | ntopng + nProbe | ntopng + nProbe Cento |
| < 1 Gbit | ✓ | ||
| < 5 Gbit | ✓ | ||
| < 10 Gbit | ✓ | ||
| 10+/25/40/100 Gbit | ✓ |
In flow collection you need to pay attention to the number of exporter devices (e.g. a NetFlow-enabled router or sFlow switch) and number of collected flow interfaces. A large number of exporters introduced an overhead due to the number of various templates to support and number of exported interfaces that need to be polled via SNMP. Below in the listed references you can find an extensive discussion of various licenses limitations; for your convenience we summarize here the main version limits.
| Software License | Max Number of Exporters | Max Number of Exporters Interfaces |
| ntopng Ent L + nProbe Pro ntopng Ent Bundle L | 128 (ntopng) / 4 (nProbe) | 256 |
| ntopng Ent XL + nProbe Ent S ntopng Ent Bundle XL | 256 (ntopng) / 8 (nProbe) | 512 |
| ntopng Ent XL + nProbe Ent M | 256 (ntopng) / 32 (nProbe) | 512 |
| ntopng Ent XXL + nProbe Ent L | 512 (ntopng) / 256 (nProbe) | 8192 |
Note that these are limits per instance, but you are free to start multiple instances per host all sharing the same license. Example: if you have 512 exporters you can run one ntopng Enterprise XXL instance and load balance incoming flows across 2 nProbe Enterprise L instances. In general we encourage people to distribute collection workload across multiple instance to better exploit multicore architectures.
Enjoy !
References