Overview

ntopng is a network traffic probe for people who need to inspect activity across more than one kind of traffic source. It is best suited to network practitioners and IT teams comfortable choosing a self-hosted edition to fit their scale. Its breadth of collection and analysis is compelling, but the interface and flow caps make plan selection consequential.

It can gather data from traffic mirrors, NetFlow exporters, SNMP devices, firewall logs, and intrusion detection systems, then present real-time and historical traffic exploration in an encrypted web interface. The open-source project began in 1998 with the aim of building a web-based traffic monitoring platform.

For comparisons across Network Traffic Analysis Software, ntopng is a traffic-analysis-centered option; it also belongs in broader Network Monitoring and Bandwidth Monitoring Software searches.

Key features

Traffic sources and protocol identification

ntopng captures packets with libpcap or PF_RING and collects flows from nProbe, NetFlow, and sFlow exporters. Its nDPI-powered protocol detection recognizes more than 450 Layer-7 application protocols, which gives administrators a more useful view of application activity than traffic totals alone. That range is valuable in mixed environments, though it also makes ntopng a specialized monitoring tool rather than a simple bandwidth meter.

Performance and integrations

Alongside throughput, ntopng tracks application latency, round-trip time, TCP retransmissions, packet loss, and VoIP jitter and MOS. These measures can help teams examine both volume and performance symptoms in one interface. Export to Elasticsearch and big-data systems extends its use in environments that already analyze traffic data elsewhere.

An HTTP-based RESTful API and Lua scriptability give technical teams ways to work with the product programmatically. Pro and higher editions add LDAP and OpenID Connect login, multiple-interface aggregation, and alert delivery to Elasticsearch, Microsoft Teams, or Fail2Ban. Those features matter most to organizations with centralized identity, combined interface views, or alert workflows; they are not part of the free edition.

ntop says its packages are digitally signed with a PGP key so users can verify package integrity. It also accepts security reports by email and says it will acknowledge them within three working days. Community support is best-efforts; paid consultancy, commercial-grade phone, email, or on-site support, training, and customization are available.

Pricing

ntopng uses a freemium model, with a free Community edition and perpetual paid licenses priced once. Paid licenses include one year of maintenance, updates, and support during that maintenance period, as well as installation support. The stated prices and suggested scale ceilings make the choice more than a feature comparison: each edition has explicit host, flow, and interface limits.

Plan	Price	Suggested scale and interfaces
Community (Open Source)	Free	256 live local hosts, 128K live flows, 8 monitored interfaces
Pro	299.00 EUR per once	256 live local hosts, 1M live flows, 8 monitored interfaces
Enterprise M	699.95 EUR per once	1K live local hosts, 4M live flows, 16 monitored interfaces
Enterprise L	899.95 EUR per once	4K live local hosts, 8M live flows, 32 monitored interfaces
Enterprise XL	1499.95 EUR per once	32K live local hosts, 16M live flows, 64 monitored interfaces

Community is aimed at home users and network practitioners with small networks. Its 128K suggested live-flow ceiling is the main trade-off against Pro, which raises that cap to 1M while retaining the same suggested host and interface limits. Pro suits offices and small enterprises; Enterprise M, L, and XL progressively raise suggested host, flow, and interface capacity for larger networks. The license is perpetual rather than a recurring subscription, but the included maintenance period lasts one year.

Platforms

ntopng is self-hosted and supports Linux, FreeBSD, Windows x64, macOS, and RaspbianOS; pfSense and OPNsense are also named among supported Unix platforms. Its encrypted web interface and API add browser-based and programmatic access, while self-hosting leaves deployment in the hands of the organization.

Who it's for

ntopng fits administrators who need to combine traffic from mirrors, flow exporters, SNMP, logs, or intrusion detection systems and then inspect protocol and performance detail. Its free edition offers a credible starting point for a small network, while higher editions provide more capacity and selected identity, aggregation, and alert features. It is less suitable for teams that want a hosted service or whose scale exceeds the relevant edition's suggested limits.

Pros and cons

Pros: Multiple packet and flow sources plus logs and SNMP make it useful in varied network environments.
Pros: Detection across more than 450 application protocols and detailed latency, loss, retransmission, and VoIP metrics go beyond basic traffic totals.
Pros: Perpetual paid licenses include a year of maintenance, updates, and support, avoiding a mandatory recurring license charge.
Cons: The free edition's suggested 128K live-flow and eight-interface limits can constrain larger deployments.
Cons: LDAP/OIDC, interface aggregation, and named alert integrations require Pro or a higher edition.
Cons: Community support is best-efforts, so organizations needing commercial-grade help must turn to paid support.

Alternatives

SoftPerfect Bandwidth Manager is a better fit for readers focused on bandwidth rules and usage monitoring: its free Lite plan provides five rules or streams, usage reports, a live usage monitor, and penalties for heavy downloads and uploads.

Nagios XI is worth considering when broader monitoring is the priority; its free plan covers seven nodes or 100 services, whichever comes first, and is self-supported.

ElastiFlow may suit teams prioritizing flow records and built-in dashboards or detections: its free Basic plan supports up to 4,000 records per second and 25 SNMP devices, with 40-plus dashboards and 120-plus ML detections.

GlassWire offers a more limited free option for readers who need one day of bandwidth usage, 24 hours of network history, and current-day alert logs on its supported platforms.

sFlowTrend is another option for readers comparing traffic-monitoring tools.

FlowViewer is a free alternative for readers seeking a Linux- and web-based option that requires a Unix server.

Intermapper is an alternative for readers who prefer device-based licensing with subscription or perpetual options.

ManageEngine NetFlow Analyzer is another freemium option, with a free edition capped at two interfaces.

Verdict

Choose ntopng if you need self-hosted visibility across varied traffic sources, application protocols, and network-performance measures, and can match your deployment to its edition limits. Its strongest case is the breadth of traffic analysis paired with a free entry point and capacity-scaled perpetual licenses. Look elsewhere if you need a hosted service, broader capacity than its suggested caps, or commercial support without an additional paid arrangement.

	NetTraffic	ntopng
Free plan	Yes	Yes
Paid from	Free	Free
Platforms	Windows	api, Linux, macOS, self-hosted, Web, Windows
Free plan	Yes	Yes
Synthetic checks	No	Yes
Traffic monitoring	Yes	Yes
Topology maps		Yes
Deployment		self_hosted

NetTraffic vs ntopng

NetTraffic

ntopng