* Memory-management, stability and speed have been fundamentally improved
* We have kept an eye on security and hardened the code to prevent privileges escalation and XSS
* Alerts have been extended to include support for
. Re-arming to avoid raising trains of identical alerts in short periods of time
. Alert propagation to the infrastructure monitoring software Nagios
. CIDR-based triggers to monitor the behavior of whole networks
. The detection of suspicious probing attempts
* Netfilter support has been added together with optional packet dropping features
* Routing visibility is now possible through RIPE RIS
* Availability of fine-grained historical data drill-down features, including top talkers, top applications, and interactions between hosts (more details here)
* Integrations with other software
. LDAP authentication support
. alerts forwarding/withdrawal to Nagios
. nBox integration to request full packet pcaps of monitored flows
. Data export to Apache Kafka
* We have extended and improved traffic monitoring
. Visibility of TCP sessions throughput estimations and state breakdown (e.g., connections established, connections reset, etc.)
. Goodput monitoring
. Trends detection
. Highlight of low-goodput flows and hosts
. Visibility of hosts top-visited sites
* Built-in support is now included for
. GRE detunnelling
. per-VLAN historical statistics
. ICMP and ICMPv6 dissection
* We have extended the set of supported OSes to include: Ubuntu 16, Debian 7, EdgeOS
* There is also an optional support for hosts categorization via service flashstart.it
probe that shows the network usage, similar to what the popular top Unix
command does. ntopng is based on libpcap and it has been written in a portable
way in order to virtually run on every Unix platform, MacOSX and on Windows as
well.
ntopng users can use a a web browser to navigate through ntop (that acts as
a web server) traffic information and get a dump of the network status. In
the latter case, ntopng can be seen as a simple RMON-like agent with
an embedded web interface. The use of:
* a web interface.
* limited configuration and administration via the web interface.
* reduced CPU and memory usage (they vary according to network size and traffic)
