---
title: ntopng — web-based traffic analysis
date: 2026-10-19
time: 12:00
model: admin
category: programs
author_type: human
summary: Enterprise open-source tool that collects packet mirrors, NetFlow, and SNMP for full-network visibility in a browser.
tags: program, Modern CLI Tools, ntopng
---

**💬 "ntopng install"**

ntopng is a **web-based network traffic analysis tool**. It is the successor to ntop from 1998, collecting traffic from packet mirrors, NetFlow, SNMP, firewall logs, and IDS, then showing it all in a browser dashboard.

Unlike terminal tools, you run it on a server and access it from a browser. It is a long-trusted enterprise-grade open-source project that records and analyzes host pools, bandwidth trends, and anomalous traffic over time.

- **Concept**: Acts as a traffic probe and collects data from multiple sources.
- **Main Feature**: Provides a live dashboard, host pools, traffic history, and anomaly detection.
- **Advantage**: Collects NetFlow and SNMP in addition to packet capture for full-network visibility.
- **Usage**: Suited for admins who need to continuously record and analyze all traffic on an internal network.
## Basic Usage

ntopng is used through a web browser after install. Unlike other tools that show results in the console, the UI is opened in a browser (default port 3000).

### 1. Start the service, then open the browser

Check dependencies (redis, rrdtool), start ntopng, and open it in a browser.

```
sudo systemctl start redis-server
sudo ntopng -i eth0                # set capture interface
# open http://localhost:3000 (default login admin/admin)
```

### 2. How to read the screen

- **Dashboard**: total bandwidth, flow count, and top conversations refresh in realtime.
- **Hosts**: list of communicating hosts. Click one to drill into its ports/protocols.
- **Flows**: per-session traffic (srcIP:port → dstIP:port). Most detailed view of who exchanged what.
- **Filters**: BPF filters to narrow to a specific host/port/protocol.
### 3. For server deployment

On headless servers run with `--daemon` in the background, and pass `--local-networks` so internal traffic is classified correctly.

```
sudo ntopng -i eth0 --http-port 3000 --local-networks 192.168.0.0/24 --daemon
```

## Installation and Download

ntopng installs via the official apt repository, Docker, or building from source. redis and rrdtool are required.

| Environment | Command |
| --- | --- |
| Ubuntu/Debian (official apt) | wget https://packages.ntop.org/stable/ubuntu24.04/all/apt-ntop-stable.deb && sudo apt install ./apt-ntop-stable.deb && sudo apt install ntopng |
| Start after install | sudo systemctl start ntopng |
| Dependencies (manual) | sudo apt install redis-server rrdtool |
| Docker | docker run -d --name ntopng -p 3000:3000 ntop/ntopng |
| Build from source | github.com/ntop/ntopng (doc/README.md) |

After installing, open `http://server-ip:3000` in a browser. Configure it in `/etc/ntopng/ntopng.conf`.

## Commonly Used Options

| Option | Description |
| --- | --- |
| -i eth0 | Specify the network interface to collect from |
| --http-port=3000 | Set the web dashboard port |
| --local-networks="192.168.0.0/16" | Declare local ranges to tell internal from external hosts |
| --data-dir=/var/lib/ntopng | Set the data storage location |
| --daemon | Run as a resident daemon |
| -G /run/ntopng.pid | Set the PID file location |

## Three Essential Command Combinations

- `sudo systemctl start ntopng` — start the service
- `sudo ntopng -i eth0 --http-port=3000` — serve a specific interface on web port 3000
- `sudo ntopng --interface=eth0 --local-networks="10.0.0.0/8" --daemon` — declare local ranges and run as a daemon
**💬 "Show me a real-world example of installing and accessing ntopng on a server"**

Situations you frequently meet on a production server, in order.

### Step 1 · Register the repo and install

Register the official apt repository and install ntopng.

```
wget https://packages.ntop.org/stable/ubuntu24.04/all/apt-ntop-stable.deb
sudo apt install ./apt-ntop-stable.deb
sudo apt install -y ntopng
```

### Step 2 · Configure and start

Declare local ranges and start the service.

```
echo "--local-networks=10.0.0.0/8 --interface=eth0 --http-port=3000" | sudo tee /etc/ntopng/ntopng.d/local.conf
sudo systemctl enable --now ntopng
```

### Step 3 · Access from a browser

Open the web dashboard and inspect traffic.

```
# Open in a browser
http://server-ip:3000
# Default login: admin / admin (change it on first login)
```

## How It Is Used in Practice

### 1. Rank hosts by bandwidth

**Situation** — Find the internal hosts using the most traffic.

**Result** — Check the *Top Talkers* view for per-host send/receive rankings.

**Key point** — Internal hostnames only resolve if `--local-networks` is set correctly.

### 2. Collect remote devices via NetFlow

**Situation** — Gather traffic from switches and routers.

```
# NetFlow receiver settings in ntopng.conf
--interface=none
--tshark-path=/usr/bin/tshark
# Then point the switch's NetFlow export at ntopng-server-ip:2055
```

**Result** — Flow data sent by the switch is consolidated into the dashboard.

**Key point** — NetFlow alone gives full visibility even without a packet mirror.

## Caveats

- The default port (3000) is reachable without auth if exposed — restrict it to an internal network with a firewall and change the password.
- It records traffic continuously, so plan for disk space. Give `--data-dir` enough room.
- Packet capture and running the service require root.
- Unlike terminal tools, it is a resident service, so give it dedicated server resources (CPU, disk).

---
Source (HTML): https://games.aidebatehub.com/programs/linux/modern/ntopng.html
This file is an auto-generated Markdown twin of the DevHub document.