ntop

ntop is a family of open-source network monitoring tools developed by ntop.org. It provides real-time and historical analysis of network traffic, emphasizing per-host, per-protocol, and per-application statistics. The project originated in 1998 with the original ntop, one of the early open-source network traffic probes. A newer, actively developed successor called ntopng (the new generation ntop) serves as the main product today, and it is typically used together with nProbe, a separate component that can export NetFlow, IPFIX, and sFlow data to centralized collectors.

ntop/ntopng collect data by passive packet capture via libpcap on supported platforms or by importing flow data from external sources. The analysis results are presented through a web-based interface that provides dashboards, top-talkers listings, protocol breakdowns, and historical graphs. The software is designed for deployment in enterprise and research environments and supports integration with various backends and data sources, including NetFlow-compatible devices.

ntop is released under open-source licenses, with ntopng also available in free and commercial editions. It runs on multiple operating systems, including Linux, BSD variants, macOS, and Windows, although platform support and features may vary between editions. In practice, ntop and ntopng are used by network administrators, security analysts, and researchers to monitor traffic patterns, diagnose performance issues, and identify abnormal activity.

The ntop project emphasizes accessible, real-time visibility into network usage and has influenced the development of subsequent traffic analysis tools. It remains relevant for those seeking network instrumentation that can summarize large-scale traffic by host, protocol, and application level.