NetFlow and sFlow are the two industry standard for flow-based traffic Monitoring. You can use both ntop and nProbe for this purpose as they both support those protocols.
ntop can act as a flow collector. In order to activate it, it is necessary to create a virtual interface and send flows to it. You can do that in the menu Admin -> Plugins -> NetFlow (or sFlow) plugin, as depicted below.
nProbe can act as:
- Pure NetFlow/IPFIX Probe
In this case nProbe captures packets from a network interface and turns them into flows.
- Both Probe and Collector
While capturing packets, turning into flows, and exporting them towards a list of collectors, nProbe can also collect flows sent by remote probes and add them to the flow cache.
- Flow Proxy
It can collect flows and turn them into another format. For instance it can collect sFlow or NetFlow v5 flows and export them in IPFIX format towards a flow collector.
- Pure Flow Collector
It receives sFlow/NetFlow/IPFIX flows and dump them on disk or database
On a nutshell with nProbe all the possible combinations are supported You can also feed ntop with flows, in order to preprocess traffic and thus reduce load on ntop.