Overview

ntopng is a network traffic probe for administrators who need to examine activity across packet and flow sources. It is a strong fit for teams that want protocol-level visibility and performance measures in a self-hosted tool, provided their network fits an edition’s suggested capacity.

Its breadth is useful, but edition limits matter: monitored-interface ceilings are explicit, and several access and alerting features start with Pro. Organizations that need those capabilities or larger network limits should weigh the paid perpetual licenses against the free Community edition.

For comparisons, see Network Traffic Analysis Software, Network Monitoring, and Bandwidth Monitoring Software.

Key features

Traffic collection and analysis

ntopng gathers traffic information from mirrors, NetFlow exporters, SNMP devices, firewall logs, and intrusion detection systems. It captures packets through libpcap or PF_RING and collects flows from nProbe, NetFlow, and sFlow exporters. That mix suits networks with several existing telemetry sources; the value depends on whether the sources in your stack are among those supported.

Real-time and historical exploration runs through an encrypted web interface. nDPI-powered detection recognizes more than 450 Layer-7 application protocols, helping administrators distinguish application activity instead of relying only on aggregate traffic volume.

Performance, integrations, and extensibility

Application latency, round-trip time, throughput, TCP retransmissions, packet loss, and VoIP jitter and MOS give teams measures to investigate service and voice performance alongside traffic composition. Export to Elasticsearch and big-data systems can connect traffic data to wider analysis workflows. Pro and higher editions add alert delivery to Elasticsearch, Microsoft Teams, and Fail2Ban; those are paid-edition capabilities, not a reason to assume the free edition offers the same workflow.

An HTTP-based RESTful API and Lua scriptability make ntopng relevant to teams that want to integrate or extend monitoring. Topology maps and synthetic checks are also supported. ntop says its packages are PGP-signed, with a key users can use to verify integrity.

Pricing

ntopng uses a freemium model. Community (Open Source) costs 0.00 USD per free and is aimed at home and network practitioners. Its suggested ceiling is 256 live local hosts, 128K live flows, and eight monitored interfaces. It is the sensible starting point for small deployments, but those caps can rule it out as a network grows.

Pro costs 299.00 EUR per once as a perpetual license and includes one year of maintenance. Designed for offices and small enterprises, it suggests up to 256 live local hosts and 1M live flows, with a maximum of eight interfaces. Pro and higher editions include LDAP and OpenID Connect login, multiple-interface aggregation, and alert sending to Elasticsearch, Microsoft Teams, or Fail2Ban.

Enterprise M costs 699.95 EUR per once, with a perpetual license and one year of maintenance. Its suggested limits are 1K live local hosts, 4M live flows, and 16 interfaces. Enterprise L costs 899.95 EUR per once on the same terms, with limits of 4K hosts, 8M flows, and 32 interfaces. Enterprise XL costs 1499.95 EUR per once, also perpetual with one year of maintenance, and raises the suggested limits to 32K hosts, 16M flows, and 64 interfaces. These tiers are for deployments that need the enterprise feature set and progressively more capacity.

Licenses are perpetual and include installation support, updates, and support during the one-year maintenance period. The included maintenance term is important when budgeting beyond the initial purchase. Community support is best-efforts; ntop also offers paid consultancy, commercial-grade phone, email, or on-site support, training, and customization.

Platforms

ntopng supports Linux, FreeBSD, Windows x64, macOS, and RaspbianOS; pfSense and OPNsense are also named among supported Unix platforms. It is self-hosted and offers a web interface, with API support. This suits teams that want to keep deployment within their own environment, rather than select a hosted-only service.

Who it's for

Choose ntopng when you need to combine traffic sources, identify application protocols, and inspect performance indicators in a self-hosted interface. Community is suited to home and small-network use within its suggested caps; Pro fits offices and small enterprises that need more flow capacity or paid-edition features. The Enterprise tiers are better aligned with larger networks, so long as their host, flow, and interface ceilings match the deployment.

Look elsewhere if you need a hosted service, or if you need greater capacity than the largest stated edition. Teams that require paid-edition authentication or alert integrations should also avoid assuming those capabilities are part of Community.

Pros and cons

Broad telemetry inputs: packets, exported flows, SNMP, firewall logs, and intrusion-detection data support visibility across several network sources.
Useful protocol and performance depth: detection across more than 450 Layer-7 protocols sits alongside latency, retransmission, loss, and VoIP measures.
Self-hosted integration options: a REST API, Lua scriptability, and export to Elasticsearch and big-data systems can fit existing operational workflows.
Clear capacity steps: the paid tiers raise suggested host, flow, and interface limits for larger deployments.
Edition boundaries require planning: LDAP/OIDC, interface aggregation, and alert delivery are assigned to Pro and higher, while Community has the lowest flow ceiling.
Maintenance is time-bounded: paid licenses include one year of maintenance, so teams should factor that term into ongoing support and update planning.

Alternatives

Consider bwmon if a free, MIT-licensed tool for a single self-hosted Linux host is enough; it is narrower in the deployment scope stated for its plan.

ElastiFlow is worth considering if its free Basic plan’s stated allowance of up to 4,000 records per second, 25 SNMP devices, dashboards, ML detections, and Slack and Forum support better matches your needs.

Nagios XI offers a free plan capped at seven nodes or 100 services, whichever comes first, with self-supported use; choose it when that scope and its Standard-feature emphasis suit the monitoring requirement.

Akvorado is another free, self-hosted option across Linux, macOS, and web platforms, developed by French ISP Free.

NetBalancer is an alternative for Windows users comparing a freemium product with a paid app-and-sync plan.

Intermapper is another cross-platform freemium option, with device-based licensing available by subscription or perpetual license.

Bandwidth Monitor is a free alternative with listed support across desktop, mobile, web, and self-hosted platforms.

Kentik Network Monitoring System is a paid alternative with a 30-day free trial and a Pro plan starting at 2000.00 USD per year.

Verdict

ntopng is a strong choice for administrators who need self-hosted traffic analysis across varied sources, with protocol identification and practical performance metrics in one interface. Its broad collection options and tiered capacity make it adaptable, but the suggested ceilings and paid-only authentication, aggregation, and alert integrations should shape the decision. Choose it when those capabilities and limits fit your network; look elsewhere if your deployment outgrows the stated tiers or requires a hosted service.

	Cisco ThousandEyes	ntopng
Free plan	No	Yes
Free trial	No	No
Paid from	—	Free
Open source	No	No
Platforms	Android, macOS, Web, Windows	api, Linux, macOS, self-hosted, Web, Windows
Free plan	No	Yes
Synthetic checks	Yes	Yes
Traffic monitoring	Yes	Yes
Topology maps	Yes	Yes
Deployment	hybrid	self_hosted

Cisco ThousandEyes vs ntopng

Cisco ThousandEyes

ntopng