Network analytics · ntop
ntopng
Open-source real-time traffic analyzer that shows top talkers and application-level flow breakdowns on a network link.
ntopng captures traffic on an interface (or ingests NetFlow/sFlow) and shows real-time top talkers, protocol and application breakdowns, and host-to-host traffic maps — flow analytics measured inside the network, in the same category as Kentik but self-hosted and open source. The free Community edition covers single-interface, real-time visibility for a home lab or small network. Paid Pro and Enterprise M/L/XL/XXL editions add multi-interface aggregation, LDAP/SSO authentication, extended behavioral alerting, historical data and reporting, expanded SNMP polling, and NetFlow/sFlow exporter statistics for large ISP or enterprise deployments. It is built on the same team's packet-capture libraries (libpcap, PF_RING) used across the open-source networking ecosystem.
At a glance
| Vendor | ntop |
|---|---|
| Pricing model | Free tier + paid plans |
| Free tier | Yes |
| Deployment | Self-hosted |
| Open source | Yes (GPL-3.0) |
| Best for | Network admins who want free, self-hosted real-time traffic visibility with an optional paid upgrade path. |
Pricing
Community edition is free and open source; Pro and Enterprise M/L/XL/XXL editions are paid, priced per instance.
| Plan | Price | Notes |
|---|---|---|
| Pro | €299 | single instance; adds interface aggregation, LDAP auth, extended behavioral alerts |
| Enterprise M/L/XL/XXL | from €699 | adds historical data/reporting, expanded SNMP, NetFlow/sFlow exporter stats, identity/VPN |
Prices read from the vendor's own page on September 21, 2026. Vendors change prices; check the source before you budget.
Features
- Real-time top-talkers and traffic visualization
- Layer-7 application/protocol detection
- NetFlow/sFlow ingestion
- Historical traffic reporting (paid editions)
- Host and interface traffic maps
- REST API and Grafana integration
- Behavioral traffic alerting
Integrations
Profile last reviewed September 21, 2026