ntopng

ntopng -i <if>

Sets up network monitoring with the ntopng web interface, visualizing traffic, hosts, and flows in real time.

Run it when you want network visibility with a GUI: ntopng analyzes traffic from the interface (or exported NetFlow) and presents it in the browser — hosts with their traffic, flows, protocols, ports, and behavioral alerts (scans, spikes, hosts talking to weird destinations). It's the SOC tool for a network snapshot without setting up a SIEM: host ranking by volume, the host talking to a rare external IP, the unusual protocol. In hunting, ntopng is the visual starting point: the anomaly shows up on the dashboard, and you dig deeper with the flows.

Don't use it for deep analysis: ntopng gives the network view (metadata), not the content — for the payload, use pcap and Zeek. On busy interfaces, the process consumes resources proportional to the analyzed traffic; capturing a full production interface requires sizing the host. And watch out for the tool's own security: the web interface exposes network data — deploy it with authentication and restrict it to the management network, not exposed. For long-term history, export flows to nProbe/Elastic; ntopng only keeps the window you configure.