ntopng — web-based traffic analysis

Linux / Modern CLI Tools / ntopng.html

Modern CLI ToolsOriginalRegistered 2026-10-19T17:00:00+09:00

💬 "ntopng install"

ntopng is a web-based network traffic analysis tool. It is the successor to ntop from 1998, collecting traffic from packet mirrors, NetFlow, SNMP, firewall logs, and IDS, then showing it all in a browser dashboard.

Unlike terminal tools, you run it on a server and access it from a browser. It is a long-trusted enterprise-grade open-source project that records and analyzes host pools, bandwidth trends, and anomalous traffic over time.

Concept: Acts as a traffic probe and collects data from multiple sources.
Main Feature: Provides a live dashboard, host pools, traffic history, and anomaly detection.
Advantage: Collects NetFlow and SNMP in addition to packet capture for full-network visibility.
Usage: Suited for admins who need to continuously record and analyze all traffic on an internal network.

Basic Usage

ntopng is used through a web browser after install. Unlike other tools that show results in the console, the UI is opened in a browser (default port 3000).

1. Start the service, then open the browser

Check dependencies (redis, rrdtool), start ntopng, and open it in a browser.

sudo systemctl start redis-server
sudo ntopng -i eth0                # set capture interface
# open http://localhost:3000 (default login admin/admin)

2. How to read the screen

Dashboard: total bandwidth, flow count, and top conversations refresh in realtime.
Hosts: list of communicating hosts. Click one to drill into its ports/protocols.
Flows: per-session traffic (srcIP:port → dstIP:port). Most detailed view of who exchanged what.
Filters: BPF filters to narrow to a specific host/port/protocol.

3. For server deployment

On headless servers run with --daemon in the background, and pass --local-networks so internal traffic is classified correctly.

sudo ntopng -i eth0 --http-port 3000 --local-networks 192.168.0.0/24 --daemon

Installation and Download

ntopng installs via the official apt repository, Docker, or building from source. redis and rrdtool are required.

Environment	Command
Ubuntu/Debian (official apt)	`wget https://packages.ntop.org/stable/ubuntu24.04/all/apt-ntop-stable.deb && sudo apt install ./apt-ntop-stable.deb && sudo apt install ntopng`
Start after install	`sudo systemctl start ntopng`
Dependencies (manual)	`sudo apt install redis-server rrdtool`
Docker	`docker run -d --name ntopng -p 3000:3000 ntop/ntopng`
Build from source	github.com/ntop/ntopng (doc/README.md)

After installing, open http://server-ip:3000 in a browser. Configure it in /etc/ntopng/ntopng.conf.

Commonly Used Options

Option	Description
`-i eth0`	Specify the network interface to collect from
`--http-port=3000`	Set the web dashboard port
`--local-networks="192.168.0.0/16"`	Declare local ranges to tell internal from external hosts
`--data-dir=/var/lib/ntopng`	Set the data storage location
`--daemon`	Run as a resident daemon
`-G /run/ntopng.pid`	Set the PID file location

Three Essential Command Combinations

sudo systemctl start ntopng — start the service
sudo ntopng -i eth0 --http-port=3000 — serve a specific interface on web port 3000
sudo ntopng --interface=eth0 --local-networks="10.0.0.0/8" --daemon — declare local ranges and run as a daemon

💬 "Show me a real-world example of installing and accessing ntopng on a server"

Situations you frequently meet on a production server, in order.

Step 1 · Register the repo and install

wget https://packages.ntop.org/stable/ubuntu24.04/all/apt-ntop-stable.deb
sudo apt install ./apt-ntop-stable.deb
sudo apt install -y ntopng

Step 2 · Configure and start

Declare local ranges and start the service.

echo "--local-networks=10.0.0.0/8 --interface=eth0 --http-port=3000" | sudo tee /etc/ntopng/ntopng.d/local.conf
sudo systemctl enable --now ntopng

Step 3 · Access from a browser

Open the web dashboard and inspect traffic.

# Open in a browser
http://server-ip:3000
# Default login: admin / admin (change it on first login)

How It Is Used in Practice

1. Rank hosts by bandwidth

Situation — Find the internal hosts using the most traffic.

Result — Check the Top Talkers view for per-host send/receive rankings.

Key point — Internal hostnames only resolve if --local-networks is set correctly.

2. Collect remote devices via NetFlow

Situation — Gather traffic from switches and routers.

# NetFlow receiver settings in ntopng.conf
--interface=none
--tshark-path=/usr/bin/tshark
# Then point the switch's NetFlow export at ntopng-server-ip:2055

Result — Flow data sent by the switch is consolidated into the dashboard.

Key point — NetFlow alone gives full visibility even without a packet mirror.

Caveats

The default port (3000) is reachable without auth if exposed — restrict it to an internal network with a firewall and change the password.
It records traffic continuously, so plan for disk space. Give --data-dir enough room.
Packet capture and running the service require root.
Unlike terminal tools, it is a resident service, so give it dedicated server resources (CPU, disk).