Professional Training

Master ntop Tools with Hands-On Guidance

Learn directly from the creators of ntop through structured, hands-on training sessions. Our courses cover traffic analysis, DPI, flow monitoring, packet capture, and performance optimization. Tailored for both enterprise and service provider environments.

ntop offers professional training in addition to periodic webinars, video tutorials, and community support.

ntop training mainly focus on ntopng, that leverages on most ntop tools, ranging from DPI, to packet capture and traffic analysis. Custom-tailored training content focusing on other ntop tools is offered as professional services.

Training topics Include:

• Network traffic monitoring with ntopng and nProbe
• Flow export and IPFIX customization
• Deep packet inspection with nDPI
• High-speed packet capture with PF_RING and n2disk
• DDoS detection and mitigation strategies
• Real-world deployment and troubleshooting labs

Training Contents

The training course lasts 6 hours and it is in English language. It is provided through the Microsoft Teams platform and it is divided in six parts broadcasted across two weeks. Attendees should have a basic networking knowledge in order to attend the training. The training package includes (free of charge) a full ntopng Pro license to be used during and after the training.

Program (subject to minor changes based on the latest software features and releases):

Part I (90 minutes) – Introduction

• Introduction to ntopng: main features and problems that can be tackled with it
• ntopng architecture: how it works, main components, interaction with external applications
• Traffic Analysis
  • Packets and Deep Packet Inspection (mirror ports, SPAN, TAP, nTAP)
  • Flow collection (sFlow, NetFlow, IPFIX)
  • Packets vs flows: discussion, pros and cons
• Supported platforms and operating systems
• ntopng installation
  • Linux (Ubuntu, Rocky Linux, …)
  • Windows
  • FreeBSD/OPNsense/pfSense
• Licenses
  • License model
  • Differences between versions (community vs Pro vs Enterprise M/L/…)
  • Maintenance
  • The system ID
  • Create and apply licenses
  • Licensing VMs and containers (e.g. Docker)
• Service configuration
  • Systemd and configuration files

Part II (90 minutes) – Network Intelligence

• Ping google.com
  • What does ntopng see?
  • Active hosts and flows, their lifecycle
• Alerts, anomalies, network and security issues
  • Checks and check configuration
  • Exclusion lists
• Analyzing a pcap file with bad DNS traffic
  • Alerts and associated risks
• The score indicator of compromise
• Delivering alerts to external recipients (mail, Discord, Telegram, Slack, ElasticSearch)
  • Endpoint and Recipients
  • Delivering alerts to a Discord channel
    

Part III (90 minutes) – Flow Collection

• Flow collection vs packet collection: pros and cons, sFlow and NetFlow/IPFIX
• How to collect flows sFlow and NetFlow/IPFIX. Integration of nProbe with ntopng
• Collecting NetFlow from nProbe
  • Configure nProbe to export NetFlow
  • Configure nProbe to collect NetFlow
  • Connecting ntopng with nProbe
• Flow collection behind NAT
  • Collector and probe mode
• Collecting from large sets of devices: Observation Points
• Continuous PCAP Recording
  • Drill down from charts and alerts to raw packets
• Hardware sizing, performances and tuning

Part IV (90 minutes) – Historical Data

• Historical data
  • Timeseries
  • Flows
  • Alerts
• Historical data configuration
  • Timeseries for interfaces and local hosts
• Timeseries data stores (RRD, ClickHouse, Influxdb)
• Flow data stores (ClickHouse, ElasticSearch)
• Looking at how data is stored on disk
  • The data directory
• Accessing historical data
  • Timeseries and flow explorer
  • Packets and data drill down (n2disk)
• Data retention
• Sizing

Part V (90 minutes) – Active Monitoring, SNMP, Autonomous Systems

• Network monitoring polling SNMP devices (switches and routers)
• LLDP and network topology
• Active monitoring (ICMP, Continuous ICMP, Speedtest, HTTP, throughput)
  • Monitor the infrastructure health
  • Get notified about the status of services
  • React: running custom actions
  • Vulnerability Scan
• Autonomous Systems traffic monitoring
• Open discussion: Q&A
• A certificate of proficiency (not attendance) can be requested and provided upon an exam run by the ntop team that verifies that you qualify for it.

Part VI (90 minutes) – AI-Assisted Analysis

• Introduction to nAnalyst
  • nAnalyst vs traditional ntopng analysis vs generic AI assistants
• Architecture and data flow, LLM against ntopng data
• Getting started and configuration
  • Configuring the LLM provider
  • Cloud vs local models
  • Model selection
  • Permission Model
• Asking Questions: from simple to advanced
  • Prompting techniques for network analysis
  • What Is Happening on My Network?
  • Security & Incident Investigation with interactive charting
• AI policies: from analysis to automation
  • Converting a natural-language requirement into a detection policy and alerts
• AI powered, grafana style, custom dashboards
• Advanced Integration with MCP
  • Exposing nAnalyst capabilities to external AI clients (e.g. Claude Code, Codex, Cursor)

Training Schedule

Training is performed periodically or on demand and it needs to be arranged according to time zone of the attendees. If interested in a custom training session, please contact us to arrange a date and eventually adapt the contents.

The next training will take place on November 2026:

Nov 10th, 2026 15:00 CEST
Nov 12th, 2026 15:00 CEST
Nov 17th, 2026 15:00 CEST
Nov 19th, 2026 15:00 CEST
Nov 24th, 2026 15:00 CEST
Nov 26th, 2026 15:00 CEST

Training will be held online in English language.

All registered attendees will receive, as part of the training, a license of ntopng Pro.

Registration and Attendance

You can register at this page by specifying the attendee(s) name(s). Ahead of the training, you need to settle the payment by purchasing the ticket (one per attendees) at the ntop shop or you can contact us for further payment methods.

As you know ntop offers all product and services free of charge to eligible people, hence the registration is free of charge for everyone. Ahead of the training, attendees NOT belonging to not-for-profit organizations, will be contacted to settle the training fee on the ntop shop. Discounts are available for 2 or more attendees belonging to the same organisation.

Shall you have questions or need personalised training content/schedule, please feel free to contact us.

Enhance your skills. Become an expert.