Ntopng

Open source alternative to PRTG Network Monitor, SolarWinds Network Traffic Analyzer, Kentik, ManageEngine NetFlow Analyzer and Plixer Scrutinizer

8.3K stars
GPL-3.0
Active this week
Last commit today

Last verified Oct 31, 2026

Monitor network traffic and cybersecurity threats in real time through a web browser, with support for NetFlow, sFlow, IPFIX, eBPF, and SNMP.

Visit website GitHub8.3K Deploy on Hostinger

Read the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ

who it's for

Who Ntopng is for#

Network engineers auditing enterprise traffic patterns

Ntopng's flow ingestion gives network engineers a live view of top talkers, bandwidth hogs, and protocol distributions across the entire network without polling each device individually. Teams managing large WAN or campus networks can identify congestion sources and unusual routing behavior from a single browser dashboard.

Skip if:

If your network has fewer than a dozen devices and you primarily need uptime monitoring rather than traffic analysis, a simpler SNMP-only monitoring tool requires less setup.

Security operations teams investigating network anomalies

Security teams use ntopng's real-time flow data and cybersecurity detection to identify lateral movement, protocol anomalies, and unusual geographic traffic patterns. The eBPF integration adds per-process visibility on Linux hosts, giving analysts endpoint context alongside network-layer flows.

Skip if:

If your primary use case is log aggregation and SIEM correlation rather than real-time network flow analysis, a dedicated SIEM handles that workflow more directly.

Sysadmins running pfSense or OPNsense deployments

Ntopng runs natively on FreeBSD and is packaged for OPNsense and pfSense, making it a natural add-on for teams already using those firewall distributions. The web interface works alongside the existing firewall admin workflow without deploying a separate monitoring server.

Skip if:

If you are running a cloud-native environment with no on-premises network hardware, ntopng's flow-based approach requires physical or virtual network devices that can export flow data.

the problem

The problem it solves#

Network monitoring at scale has a cost problem. Paid tools like PRTG and SolarWinds price by monitored device or sensor count, so the bill grows directly with the size of the network. A team monitoring hundreds of interfaces faces significant per-device licensing costs, and those costs climb again at enterprise scale. Teams that cannot justify the expense often fall back to basic SNMP polling or no visibility at all, leaving traffic patterns and security anomalies undetected until something breaks.

The second pain point is data gravity. Sending flow data and packet samples to a cloud-hosted monitoring service means your traffic metadata leaves your infrastructure. For security teams, that trade-off is often unacceptable, because the traffic data that reveals lateral movement, unusual protocol usage, or high-volume transfers to unfamiliar addresses is exactly the data that should stay on-premises.

how Ntopng solves it

How it solves it#

Real-time flow analysis with NetFlow, sFlow, and IPFIX

Ingests NetFlow, sFlow, and IPFIX exports from routers and switches, showing per-host and per-protocol traffic breakdowns in a browser dashboard. Flow data updates continuously, so you see current top talkers, bandwidth consumers, and unusual protocol activity without waiting for a polling cycle.

eBPF host-level traffic monitoring

Uses eBPF to capture traffic at the Linux kernel level, which provides per-process and per-container visibility on Linux hosts without installing a separate agent. This complements flow-based data from network devices with endpoint-level detail that flow protocols alone cannot provide.

SNMP device monitoring and interface statistics

Polls network devices via SNMP to collect interface utilization, error rates, and device status. Combines this with flow data in the same dashboard, so you see both device-level health and which conversations are consuming bandwidth across your infrastructure.

Cybersecurity detection and alerting

Identifies network anomalies and security events including port scans, high-volume transfers to unusual destinations, and protocol violations. Security findings surface alongside traffic data in the web interface, giving operations teams a combined view of performance and threats without switching tools.

Browser-based interface with no client installation

The entire monitoring interface runs in a browser, so network teams access dashboards from any workstation without deploying monitoring clients. Traffic maps, flow tables, protocol charts, and security alerts are all accessible through a single web URL after deployment.

strengths · trade-offs

Strengths and trade-offs#

Strengths

GPL-3.0 license with no per-device or per-sensor feesNtopng is GPL-3.0 licensed, so self-hosted deployments carry no per-device or per-sensor licensing costs. A team monitoring 1,000 interfaces pays the same server costs as one monitoring 10 interfaces. Per-device licensing is replaced by hardware cost alone, which directly addresses the cost structure that makes commercial monitoring tools expensive at scale.
Cross-platform support including ARM and FreeBSDRuns on Debian/Ubuntu LTS, CentOS/Rocky/AlmaLinux, Windows x64, Raspberry Pi/Debian ARM, and FreeBSD/OPNsense/pfSense. Few commercial tools run on ARM hardware or FreeBSD appliances; ntopng's platform range makes it viable for firewall appliances and low-power embedded monitoring hardware.
Protocol depth across NetFlow, sFlow, IPFIX, eBPF, and SNMPSupports five major monitoring data sources in a single tool. Commercial monitoring tools typically focus on either flow analysis or SNMP polling; ntopng combines both alongside eBPF host-level data, reducing the number of monitoring tools a team needs to operate.
Long-running project with active developmentThe project has 8,317 GitHub stars and 774 forks, with its last push on October 30, 2026. The original ntop dates to 1998, meaning the codebase has been deployed and tested across enterprise networks for over two decades. Active development means security patches and protocol updates reach the project regularly.

Trade-offs

-Flow collection requires configuring network device exportsCollecting NetFlow, sFlow, or IPFIX data requires configuring each router, switch, or firewall to export flows to the ntopng server. This is standard work for network engineers but is a setup step that does not exist with agent-based monitoring tools. Teams without management access to switch and router configurations cannot use the flow-based features.
-308 open issues in the repositoryThe repository had 308 open issues at last data collection. For a widely deployed tool this reflects active use and ongoing feature requests rather than instability, but teams evaluating specific capabilities should check the issue tracker to confirm their use case is not affected by known gaps.
-Lua is the primary scripting languageNtopng's core and extension layer use Lua as the primary language. Operations teams familiar with Python or Bash may find Lua unfamiliar when customizing alert logic or building integrations. The learning curve is real for teams planning significant customization beyond the default configuration.

versus alternatives

Ntopng vs alternatives#

Ntopng vs PRTG Network Monitor

PRTG Network Monitor from Paessler is a widely used commercial network monitoring tool with proprietary per-sensor pricing. Each monitored interface, circuit, or device attribute counts as a sensor, so licensing costs scale directly with infrastructure size.

Feature	Ntopng	PRTG Network Monitor
License	GPL-3.0	Proprietary
Server platform	Linux, Windows, FreeBSD, ARM	Windows Server required
Pricing	Free (self-hosted)	Per-sensor licensing

Ntopng is the better fit when your team needs Linux-native or ARM deployment, when the number of monitored interfaces makes per-sensor pricing prohibitive, or when keeping all flow data on-premises is a security requirement. PRTG is worth evaluating when your team already runs Windows Server infrastructure, needs its broad library of pre-built sensor templates for non-flow monitoring (disk, CPU, application health), and prefers a commercial support contract.

Ntopng vs SolarWinds Network Performance Monitor

SolarWinds Network Performance Monitor is an enterprise monitoring platform with proprietary annual licensing. It focuses on automated topology discovery, integrated alerting, and deep SNMP polling across large enterprise networks.

Feature	Ntopng	SolarWinds NPM
License	GPL-3.0	Proprietary
Server platform	Linux, Windows, FreeBSD, ARM	Windows Server required
Pricing	Free (self-hosted)	Enterprise annual subscription

Ntopng suits teams that need cross-platform deployment, protocol-level flow analysis, and zero per-device licensing cost. SolarWinds NPM remains the stronger fit for large enterprise environments that rely on its automated topology discovery, tight integration with the broader SolarWinds IT management suite, and dedicated vendor support with service level agreements.

install · quick start

Quick start#

bash

Download platform-specific packages for Debian/Ubuntu LTS, CentOS/Rocky, Windows x64, Raspberry Pi, and FreeBSD from GitHub Releases: https://github.com/ntop/ntopng/releases/latest

tech stack · detected from GitHub

What it's built on#

Languages: CC++JavaScriptLuaPython
Infrastructure: DockerKubernetes

frequently asked

FAQ#

Is ntopng free to use?

Yes. Ntopng is released under the GPL-3.0 license, which means the self-hosted version is free to run on your own hardware with no usage fees. GPL-3.0 requires that any modifications you distribute must also be released under GPL-3.0, but running it internally for your own organization imposes no such requirement.

What flow protocols does ntopng support?

Ntopng supports NetFlow, sFlow, and IPFIX for ingesting flow data from routers, switches, and firewalls. It also uses eBPF for host-level traffic capture on Linux endpoints and supports SNMP for device polling. This covers the main flow export formats used by enterprise network hardware from Cisco, Juniper, and most managed switches.

What operating systems can I install ntopng on?

Pre-built packages are available for Debian/Ubuntu LTS x64, CentOS/RedHat/RockyLinux/AlmaLinux x64, Windows x64, Raspberry Pi/Debian ARM, and FreeBSD/OPNsense/pfSense. This breadth of platform support is broader than most commercial monitoring tools, which typically require a Windows server.

Do I need to configure my routers and switches to use ntopng?

For flow-based monitoring you need to configure your network devices to export NetFlow, sFlow, or IPFIX data to the ntopng server. For eBPF-based host monitoring on Linux endpoints, no device configuration is needed. SNMP polling works with any SNMP-enabled device using read-only community strings.

How do I access ntopng after installation?

Ntopng provides a browser-based interface accessible after installation without any client software. The dashboard shows flow data, protocol analysis, geographic traffic maps, and security alerts in a single view accessible from any workstation that can reach the monitoring server.

also worth a look