[{"id":46263,"date":"2026-08-12T15:21:28","date_gmt":"2026-08-12T15:21:28","guid":{"rendered":"https:\/\/www.ntop.org\/?p=46263"},"modified":"2026-08-12T16:44:57","modified_gmt":"2026-08-12T16:44:57","slug":"howto-collect-flows-the-case-of-palo-alto-and-fortigate","status":"publish","type":"post","link":"https:\/\/www.ntop.org\/howto-collect-flows-the-case-of-palo-alto-and-fortigate\/","title":{"rendered":"HowTo Collect Flows: the Case of Palo Alto and Fortinet"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Network devices export flow data in many flavors. Some vendors stick closely to the NetFlow\/IPFIX standard, so collecting their flows is essentially plug-and-play. Others extend the standard with proprietary Information Elements (IEs) to expose vendor-specific details (e.g. application names, user identities, security verdicts, etc) which requires a bit of extra configuration on the collector side.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this post we revisit and update an&nbsp;older article on collecting proprietary flows with nProbe, using two widely deployed firewall vendors as concrete examples:&nbsp;Fortinet FortiGate&nbsp;and&nbsp;Palo Alto Networks.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Two Different Approaches, One Collector<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">FortiGate&nbsp;exports flow data using standard NetFlow\/IPFIX Information Elements. Because it doesn&#8217;t rely on proprietary fields for the core telemetry FortiGate typically reports, nProbe collects and decodes those flows out of the box with no special configuration is required on the nProbe side. Point nProbe at the FortiGate NetFlow\/IPFIX export and flows start showing up correctly. This is confirmed capturing a Fortigate template that contains all known fields (note that information elements 65 IPV6_SRC_MASK and 66 IPV6_DST_MASK are standard and not mapped inside Wireshark).<\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img fetchpriority=\"high\" decoding=\"async\" width=\"696\" height=\"912\" src=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/08\/FortigateTemplate.png\" alt=\"\" class=\"wp-image-46267\" style=\"width:333px;height:auto\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Palo Alto Networks, on the other hand, exports a number of fields as proprietary Information Elements identified by Palo Alto&#8217;s own Private Enterprise Number (PEN) rather than as standard IEs. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">nProbe and Proprietary Information Elements<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">nProbe Enterprise allows users to define custom Information Elements at runtime via the&nbsp;<code>--load-custom-fields<\/code>&nbsp;option, which loads a configuration file mapping vendor-specific field IDs to names, types, and (optionally) a standard field they correspond to. Each entry specifies: You can find configuration files for major vendors in the nProbe GitHub repository.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Field name: the label used in the export template and downstream outputs (MySQL, JSON, etc.).<\/li>\n\n\n\n<li>Standard alias: an optional mapping to an equivalent standard field, or&nbsp;NONE&nbsp;if there isn&#8217;t one.<\/li>\n\n\n\n<li>PEN: the vendor&#8217;s Private Enterprise Number (0 for standard fields).<\/li>\n\n\n\n<li>Field ID: the numeric identifier within the flow template.<\/li>\n\n\n\n<li>Length: the field size in bytes.<\/li>\n\n\n\n<li>Format: how the field should be represented on export.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Below you can find an example for PaloAlto devices.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#APP_ID\t\t\tNONE\t25461\t56701\t4\tdump_as_uint\nAPP_NAME\t\tNONE\t25461\t56701\t32\tdump_as_ascii\nUSER_NAME\t\tNONE\t25461\t56702\t64\tdump_as_ascii\nPOST_NAT_SRC_IPV6_ADDR\tNONE\t25461\t281\t16\tdump_as_ipv6_address\nPOST_NAT_DST_IPV6_ADDR\tNONE\t25461\t282\t16\tdump_as_ipv6_address\nENTREPRISE_NUMBER\tNONE\t25461\t346\t4\tdump_as_uint<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Once the custom fields are defined, they can be referenced like any native IE in the nProbe export template (-T&nbsp;option), so Palo Alto&#8217;s proprietary fields sit alongside standard fields such as&nbsp;%IPV4_SRC_ADDR,&nbsp;%L4_SRC_PORT, or&nbsp;%APPLICATION_ID&nbsp;in the same flow record.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is an example of a Palo Alto flow template as shown by Wireshark. As you can see at the bottom of the template there are two proprietary fields that have been mapped on the above configuration to APP_NAME and USER_NAME.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img decoding=\"async\" width=\"744\" height=\"1084\" src=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/08\/PaloAltoTemplate.png\" alt=\"\" class=\"wp-image-46264\" style=\"aspect-ratio:0.6863559193827637;width:297px;height:auto\"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">From nProbe to ntopng and ClickHouse<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Regardless of whether the flow comes from a device that speaks pure standard NetFlow\/IPFIX (like FortiGate) or one that needs custom field definitions (like Palo Alto), the result on the collection side is the same: nProbe normalizes the flow and forwards it to ntopng. All you need to do is to pass to nProbe the format of these proprietary fields by downloading the corresponding file (in the case of Palo Alto you can use this file) and passing it to nProbe as follows:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>nprobe --load-custom-fields paloalto_custom_fields.txt -3 2055 --zmq tcp:\/\/127.0.0.1:1234 -T \"@NTOPNG@ %APP_NAME %USER_NAME\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The above command tells nProbe to export the application and user name of a given flow to ntopng via ZMQ, this in addition to the standard ntopng template. In ntopng, these flows (including the proprietary Information Elements) are displayed correctly in the GUI, with vendor-specific fields shown alongside standard flow attributes. The same data is also written to the ClickHouse database, so proprietary fields are available for historical queries, dashboards, and long-term analysis just like any other flow attribute.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You do not need to do anything special at the ntopng side as nProbe will send via ZMQ the information about these mapping fields to ntopng that hence will be aware of their name and format. This means that you can start ntopng as usual, and eventually dumping flows in ClickHouse.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ntopng -i tcp:\/\/127.0.0.1:1234 -F clickhouse<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Inside ntopng live flows are reported as shown below: as you can see nDPI seems to wokr better that the native Palo Alto DPI that failed to identify this flow as TeamViewer, thing that instead works beautifully with nDPI.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" width=\"3218\" height=\"1858\" src=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/08\/PaloAltoFlow.png\" alt=\"\" class=\"wp-image-46284\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Of course this information is stored in ClickHouse historical flows as shown below. This means that all the proprietary fields are not just displayed live, but also saved on historical database.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"2040\" height=\"534\" src=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/08\/PaloAltoHistorical.png\" alt=\"\" class=\"wp-image-46273\"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Summary<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Not all flow exporters need special handling: vendors like Fortinet that rely on standard IEs work with nProbe with zero configuration.<\/li>\n\n\n\n<li>Vendors like Palo Alto that use proprietary fields require defining those fields via&nbsp;&#8211;load-custom-fields&nbsp;in nProbe.<\/li>\n\n\n\n<li>Once collected, both standard and proprietary flow data flow through the same pipeline into ntopng and ClickHouse, so nothing is lost and everything is queryable in one place.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Enjoy !<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">PS. nDPI rocks !<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Network devices export flow data in many flavors. Some vendors stick closely to the NetFlow\/IPFIX standard, so collecting their flows is essentially plug-and-play. Others extend the standard with proprietary Information Elements (IEs) to expose vendor-specific details (e.g. application names, user identities, security verdicts, etc) which requires a bit of extra configuration on the collector side. [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[671,677],"tags":[],"class_list":["post-46263","post","type-post","status-publish","format-standard","hentry","category-nprobe","category-ntopng"],"_links":{"self":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/46263","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/comments?post=46263"}],"version-history":[{"count":14,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/46263\/revisions"}],"predecessor-version":[{"id":46285,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/46263\/revisions\/46285"}],"wp:attachment":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/media?parent=46263"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/categories?post=46263"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/tags?post=46263"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}},{"id":46182,"date":"2026-08-05T10:55:48","date_gmt":"2026-08-05T10:55:48","guid":{"rendered":"https:\/\/www.ntop.org\/?p=46182"},"modified":"2026-08-05T10:55:48","modified_gmt":"2026-08-05T10:55:48","slug":"saying-goodbye-to-hierarchical-clusters-in-ntopng","status":"publish","type":"post","link":"https:\/\/www.ntop.org\/saying-goodbye-to-hierarchical-clusters-in-ntopng\/","title":{"rendered":"Saying Goodbye to Hierarchical Clusters in ntopng"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">The <a href=\"https:\/\/www.ntop.org\/creating-a-hierarchical-cluster-of-ntopng-instances\/\">hierarchical cluster architecture<\/a> was originally introduced to allow multiple ntopng instances to be organized in a parent\/child topology. Child instances collected and analyzed local traffic, while parent instances aggregated information from multiple children to provide a centralized view of the network.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">At the time, this approach addressed a common requirement: monitoring geographically distributed sites while maintaining a central point of visibility. However, networking environments and the ntop ecosystem have both evolved considerably since then.<\/p>\n\n\n\n<h5 class=\"wp-block-heading\">Building a distributed deployment with nProbe and ntopng<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">Today, the same use cases can be addressed without requiring ntopng instances to communicate with each other through a hierarchical architecture. Instead of forwarding aggregated information between ntopng instances,\u00a0<a href=\"https:\/\/www.ntop.org\/howto-implement-flow-relay-replication-and-fanout-with-nprobe\/\">nProbe can export the same flow stream to multiple destinations simultaneously<\/a>. This allows organizations to deploy:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>a&nbsp;<strong>local ntopng instance<\/strong>&nbsp;at each site, providing operators with immediate visibility into local traffic<\/li>\n\n\n\n<li>one or more&nbsp;<strong>centralized ntopng instances<\/strong>, receiving exactly the same flow data for enterprise-wide analysis and long-term monitoring<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This approach offers several advantages:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>each ntopng instance operates independently<\/li>\n\n\n\n<li>there is no hierarchy to configure or maintain<\/li>\n\n\n\n<li>failures in one instance do not impact the others<\/li>\n\n\n\n<li>deployments are simpler, more resilient, and easier to scale<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">In practice, every ntopng receives the original flow data directly from nProbe, eliminating the need for intermediate aggregation layers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, nProbe can publish flows using a ZMQ endpoint:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># nprobe -i eth0 --zmq \"tcp:\/\/*:5556\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Packet capture from a mirror has been used in the example above, however the same applies to Netflow collection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The local and centralized ntopng instances can then connect to the same ZMQ flow stream:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>local# ntopng -i \"tcp:\/\/10.0.10.10:5556\"<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>centralized# ntopng -i \"tcp:\/\/10.0.10.10:5556\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Additional ntopng instances can subscribe to the same endpoint as required. Each instance processes the received flows independently and maintains its own state.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When required by the network topology and deployment, replication can also be implemented at the Netflow level. For example  when you migrate to nProbe but you need to keep running your legacy monitoring system, you need to collect flows and send them to\u00a0<strong>multiple<\/strong>\u00a0NetFlow collectors. nProbe provides a solution also for this thanks to the\u00a0<strong>nfFanout<\/strong> companion tool. This application allows you to collect sFlow\/NetFlow\/IPFIX and send them to multiple collectors simultaneously.<br><br>Suppose you need to collect flows on port 2055 and send them to two collectors 192.168.0.1:1234 and 192.168.0.2:1234, all you need to do is to run the command below:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># nfFanout\u00a0-c\u00a02055\u00a0-a\u00a0192.168.0.1:1234\u00a0-a 192.168.0.2:1234<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">And you can use nProbe to collect NetFlow on a remote location:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># nprobe -i none -n none --collector-port 2055 --zmq \"tcp:\/\/*:5556\"<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\">Monitoring multiple ntopng instances with the Infrastructure Dashboard<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">One of the original motivations for hierarchical clusters was obtaining a centralized overview of multiple monitoring installations. Today, this requirement is fulfilled by the&nbsp;<strong><a href=\"https:\/\/www.ntop.org\/introducing-the-new-infrastructure-dashboard-in-ntopng\/\">ntopng Infrastructure Dashboard<\/a><\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Infrastructure Dashboard allows administrators to monitor multiple ntopng instances from a single interface, providing an overall view of the monitoring infrastructure, including:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>monitored instances<\/li>\n\n\n\n<li>traffic volumes<\/li>\n\n\n\n<li>system health<\/li>\n\n\n\n<li>resource utilization<\/li>\n\n\n\n<li>operational status<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Rather than aggregating traffic data through a hierarchy, the dashboard aggregates operational information, giving administrators a clear picture of the entire monitoring deployment while allowing each ntopng instance to remain autonomous.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"2442\" height=\"1964\" src=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/08\/infrastructure_dashboard.png\" alt=\"\" class=\"wp-image-46187\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">This model is simpler and better aligned with modern distributed deployments.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Since hierarchical clustering is no longer the recommended architecture, keeping obsolete functionality in the codebase adds maintenance effort and complexity, and can create confusion for users evaluating deployment options, we have decided to remove the feature from ntopng.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The ntop ecosystem continues to evolve toward modular components that can be combined to build scalable monitoring infrastructures.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The hierarchical cluster architecture was originally introduced to allow multiple ntopng instances to be organized in a parent\/child topology. Child instances collected and analyzed local traffic, while parent instances aggregated information from multiple children to provide a centralized view of the network. At the time, this approach addressed a common requirement: monitoring geographically distributed sites [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-46182","post","type-post","status-publish","format-standard","hentry","category-technologies-and-trends"],"_links":{"self":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/46182","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/comments?post=46182"}],"version-history":[{"count":6,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/46182\/revisions"}],"predecessor-version":[{"id":46190,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/46182\/revisions\/46190"}],"wp:attachment":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/media?parent=46182"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/categories?post=46182"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/tags?post=46182"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}},{"id":46130,"date":"2026-07-29T05:54:14","date_gmt":"2026-07-29T05:54:14","guid":{"rendered":"https:\/\/www.ntop.org\/?p=46130"},"modified":"2026-07-29T06:15:52","modified_gmt":"2026-07-29T06:15:52","slug":"supercharging-ntopng-engineering-a-fast-modern-network-gui","status":"publish","type":"post","link":"https:\/\/www.ntop.org\/supercharging-ntopng-engineering-a-fast-modern-network-gui\/","title":{"rendered":"Supercharging ntopng: Engineering a Fast, Modern Network GUI"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"46130\" class=\"elementor elementor-46130\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f359fdd e-flex e-con-boxed e-con e-parent\" data-id=\"f359fdd\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-87a7f93 elementor-widget elementor-widget-text-editor\" data-id=\"87a7f93\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>If you&#8217;ve opened ntopng recently, you may have noticed something feels a little different \u2014 a little faster. That&#8217;s not your imagination. We&#8217;ve rebuilt the main menu, footer and top header, interfaces selector and the preferences pages using <a href=\"https:\/\/vuejs.org\/\" target=\"_blank\" rel=\"noopener\">Vue.js<\/a>, the first step in a broader effort to modernize ntopng&#8217;s entire interface.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-c560e3f e-flex e-con-boxed e-con e-parent\" data-id=\"c560e3f\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-506d7a6 elementor-arrows-position-inside elementor-pagination-position-outside elementor-widget elementor-widget-image-carousel\" data-id=\"506d7a6\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;navigation&quot;:&quot;both&quot;,&quot;autoplay&quot;:&quot;yes&quot;,&quot;pause_on_hover&quot;:&quot;yes&quot;,&quot;pause_on_interaction&quot;:&quot;yes&quot;,&quot;autoplay_speed&quot;:5000,&quot;infinite&quot;:&quot;yes&quot;,&quot;speed&quot;:500}\" data-widget_type=\"image-carousel.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-image-carousel-wrapper swiper\" role=\"region\" aria-roledescription=\"carousel\" aria-label=\"Image Carousel\" dir=\"ltr\">\n\t\t\t<div class=\"elementor-image-carousel swiper-wrapper\" aria-live=\"off\">\n\t\t\t\t\t\t\t\t<div class=\"swiper-slide\" role=\"group\" aria-roledescription=\"slide\" aria-label=\"1 of 5\"><a href=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/07\/new_menu_dashboard.png\"><figure class=\"swiper-slide-inner\"><img decoding=\"async\" class=\"swiper-slide-image\" src=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/07\/new_menu_dashboard.png\" alt=\"new_menu_dashboard\" \/><\/figure><\/a><\/div><div class=\"swiper-slide\" role=\"group\" aria-roledescription=\"slide\" aria-label=\"2 of 5\"><a href=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/07\/interfaces_dropdown.png\"><figure class=\"swiper-slide-inner\"><img decoding=\"async\" class=\"swiper-slide-image\" src=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/07\/interfaces_dropdown.png\" alt=\"interfaces_dropdown\" \/><\/figure><\/a><\/div><div class=\"swiper-slide\" role=\"group\" aria-roledescription=\"slide\" aria-label=\"3 of 5\"><a href=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/07\/Preferences_page.png\"><figure class=\"swiper-slide-inner\"><img decoding=\"async\" class=\"swiper-slide-image\" src=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/07\/Preferences_page.png\" alt=\"Preferences_page\" \/><\/figure><\/a><\/div><div class=\"swiper-slide\" role=\"group\" aria-roledescription=\"slide\" aria-label=\"4 of 5\"><a href=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/07\/menu_profile_card.png\"><figure class=\"swiper-slide-inner\"><img decoding=\"async\" class=\"swiper-slide-image\" src=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/07\/menu_profile_card.png\" alt=\"menu_profile_card\" \/><\/figure><\/a><\/div><div class=\"swiper-slide\" role=\"group\" aria-roledescription=\"slide\" aria-label=\"5 of 5\"><a href=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/07\/new_menu_sidebar-1.png\"><figure class=\"swiper-slide-inner\"><img decoding=\"async\" class=\"swiper-slide-image\" src=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/07\/new_menu_sidebar-1.png\" alt=\"new_menu_sidebar\" \/><\/figure><\/a><\/div>\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t\t\t<div class=\"elementor-swiper-button elementor-swiper-button-prev\" role=\"button\" tabindex=\"0\">\n\t\t\t\t\t\t<svg aria-hidden=\"true\" class=\"e-font-icon-svg e-eicon-chevron-left\" viewBox=\"0 0 1000 1000\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M646 125C629 125 613 133 604 142L308 442C296 454 292 471 292 487 292 504 296 521 308 533L604 854C617 867 629 875 646 875 663 875 679 871 692 858 704 846 713 829 713 812 713 796 708 779 692 767L438 487 692 225C700 217 708 204 708 187 708 171 704 154 692 142 675 129 663 125 646 125Z\"><\/path><\/svg>\t\t\t\t\t<\/div>\n\t\t\t\t\t<div class=\"elementor-swiper-button elementor-swiper-button-next\" role=\"button\" tabindex=\"0\">\n\t\t\t\t\t\t<svg aria-hidden=\"true\" class=\"e-font-icon-svg e-eicon-chevron-right\" viewBox=\"0 0 1000 1000\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M696 533C708 521 713 504 713 487 713 471 708 454 696 446L400 146C388 133 375 125 354 125 338 125 325 129 313 142 300 154 292 171 292 187 292 204 296 221 308 233L563 492 304 771C292 783 288 800 288 817 288 833 296 850 308 863 321 871 338 875 354 875 371 875 388 867 400 854L696 533Z\"><\/path><\/svg>\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t<div class=\"swiper-pagination\"><\/div>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-f4700a0 e-flex e-con-boxed e-con e-parent\" data-id=\"f4700a0\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-2000b05 elementor-widget elementor-widget-text-editor\" data-id=\"2000b05\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h3 style=\"font-size: 22px; font-weight: 600; margin: 1.4em 0 0.5em;\">What Changed<\/h3><p>The menu and preferences sections have historically been built on server-rendered HTML \u2014 reliable, but not built for speed. Every click meant a round trip to the server and a full page reload, even for something as simple as opening a settings panel.<\/p><p>With the move to Vue.js, both areas are now fully reactive. Menus expand, preferences update, and the interface responds instantly to your input, with no server round trip for every interaction. If you live in ntopng all day managing and troubleshooting networks, the difference is noticeable.<\/p><h3 style=\"font-size: 22px; font-weight: 600; margin: 1.4em 0 0.5em;\">Why Vue.js<\/h3><p>Vue.js is built around reactivity: the interface updates automatically as the underlying data changes, without reloading or re-rendering the whole page. For a network monitoring tool like ntopng, where users are constantly switching between live traffic views, alerts, and configuration screens, that responsiveness matters.<\/p><p>Vue.js also gives us a component-based architecture that&#8217;s easier to maintain and extend. As we port more of ntopng&#8217;s interface, this foundation means new features and UI improvements can ship faster and with fewer regressions.<\/p><h3 style=\"font-size: 22px; font-weight: 600; margin: 1.4em 0 0.5em;\">No More Full Page Reloads<\/h3><p>One of the more noticeable changes under the hood is Vue Router for client-side navigation. Previously, moving between menu sections meant a full HTML page refresh, even if only a small part of the screen actually needed to change.<\/p><p>With Vue Router, navigation happens entirely client-side. Moving between menu items and preference sections is now instant, no full-page reloads, no flash of a blank screen while the server responds. It&#8217;s a small detail on its own, but across dozens of clicks in a normal working session, it adds up to an interface that simply feels quicker.<\/p><h3 style=\"font-size: 22px; font-weight: 600; margin: 1.4em 0 0.5em;\">This Is Just the Beginning<\/h3><p>The menu and preferences update is phase one of a larger initiative to port ntopng&#8217;s interface to Vue.js. We&#8217;re continuing this work across the rest of the application with the same goal: faster, more reactive, more consistent navigation throughout.<\/p><p>This builds directly on our earlier move from <a href=\"https:\/\/webpack.js.org\/\">Webpack<\/a> to <a href=\"https:\/\/vite.dev\/\">Vite<\/a>, which already cut the UI bundle size by roughly 8.7x and made page loads about twice as fast. If you missed it: <a href=\"https:\/\/www.ntop.org\/ntopng-just-got-faster-heres-what-changed\/\">ntopng Just Got Faster \u2014 Here&#8217;s What Changed<\/a>. Together, the Vite build pipeline and the ongoing Vue.js migration are two halves of the same goal: a modern, fully reactive ntopng frontend.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-4a638c9 e-grid e-con-full e-con e-child\" data-id=\"4a638c9\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-1acc7ce9 elementor-widget elementor-widget-lte-button\" data-id=\"1acc7ce9\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"lte-button.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"lte-btn-wrap\">\r\n\t<a href=\"https:\/\/shop.ntop.org\"  target=\"_blank\"  class=\"lte-btn btn-main color-hover-default lte-icon-style-default\"><span class=\"lte-btn-inner\"><span class=\"lte-btn-before\"><\/span>Get a License<span class=\"lte-btn-after\"><\/span><\/span><\/a><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-36a6004a elementor-widget elementor-widget-lte-button\" data-id=\"36a6004a\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"lte-button.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"lte-btn-wrap\">\r\n\t<a href=\"https:\/\/www.ntop.org\/support\/documentation\/software-installation\/\"  class=\"lte-btn color-hover-default lte-icon-style-default\"><span class=\"lte-btn-inner\"><span class=\"lte-btn-before\"><\/span>Free ntopng Download<span class=\"lte-btn-after\"><\/span><\/span><\/a><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4eeabb29 elementor-widget elementor-widget-lte-button\" data-id=\"4eeabb29\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"lte-button.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"lte-btn-wrap\">\r\n\t<a href=\"mailto:sales@ntop.org\"  class=\"lte-btn color-hover-default lte-icon-style-default\"><span class=\"lte-btn-inner\"><span class=\"lte-btn-before\"><\/span>Talk With An Expert<span class=\"lte-btn-after\"><\/span><\/span><\/a><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-6f8d28e e-flex e-con-boxed e-con e-parent\" data-id=\"6f8d28e\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-84dac9d elementor-widget elementor-widget-text-editor\" data-id=\"84dac9d\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h3 style=\"font-size: 22px; font-weight: 600; margin: 1.4em 0 0.5em;\">Try It Out<\/h3>\n\n<p>The updated menu and preferences are available now in the latest ntopng release. If you haven&#8217;t upgraded recently, now&#8217;s a good time. As always, feedback and bug reports are welcome \u2014 let us know what you think.<\/p>\n\n<p>Enjoy monitoring your network!<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>If you&#8217;ve opened ntopng recently, you may have noticed something feels a little different \u2014 a little faster. That&#8217;s not your imagination. We&#8217;ve rebuilt the main menu, footer and top header, interfaces selector and the preferences pages using Vue.js, the first step in a broader effort to modernize ntopng&#8217;s entire interface. What Changed The menu [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[677,1],"tags":[],"class_list":["post-46130","post","type-post","status-publish","format-standard","hentry","category-ntopng","category-technologies-and-trends"],"_links":{"self":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/46130","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/comments?post=46130"}],"version-history":[{"count":23,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/46130\/revisions"}],"predecessor-version":[{"id":46179,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/46130\/revisions\/46179"}],"wp:attachment":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/media?parent=46130"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/categories?post=46130"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/tags?post=46130"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}},{"id":46137,"date":"2026-07-26T17:31:00","date_gmt":"2026-07-26T17:31:00","guid":{"rendered":"https:\/\/www.ntop.org\/?p=46137"},"modified":"2026-07-27T19:56:57","modified_gmt":"2026-07-27T19:56:57","slug":"who-is-eating-my-bandwidth","status":"publish","type":"post","link":"https:\/\/www.ntop.org\/who-is-eating-my-bandwidth\/","title":{"rendered":"Who Is Eating My Bandwidth ?"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Every network administrator has, at some point, asked the same question: <em>who is eating my bandwidth?<\/em> On a typical corporate LAN connected via flat-rate fiber, the answer is mostly a curiosity \u2014 useful for capacity planning, less so for the monthly bill. But the moment your network relies on a metered link \u2014 a 4G\/5G mobile uplink, a VSAT satellite backhaul, an MPLS circuit billed by volume, or a roaming SIM in an IoT fleet \u2014 the same question becomes a cost-control problem, and getting the wrong answer can be expensive.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The complication is that &#8220;bandwidth used&#8221; is not a single number. A host that transfers 10 GB to a colleague&#8217;s workstation on the same LAN segment has a very different cost profile than a host that transfers 10 GB to a cloud endpoint over a pay-per-GB satellite link. Traditional top-talkers views lump the two together, which is exactly backwards for anyone trying to control WAN spend: it&#8217;s not <em>how much traffic<\/em> a host generates that matters, it&#8217;s <em>how much of that traffic left the building<\/em>.<\/p>\n\n\n\n<h5 class=\"wp-block-heading\">Local vs. Non-Local: A Distinction That Matters<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">To address this, we&#8217;ve enhanced ntopng to classify, on a per-host basis, the traffic exchanged over time into two categories:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Local traffic: traffic exchanged with other hosts belonging to the same local network(s), as defined by ntopng&#8217;s local network configuration. This traffic stays on-premises \u2014 switched or routed internally \u2014 and never touches a WAN uplink.<\/li>\n\n\n\n<li>Non-local traffic: traffic exchanged with hosts outside the local network(s). This is the traffic that actually crosses the WAN edge: the mobile modem, the satellite terminal, the metered circuit, or any other link where every megabyte has a cost attached.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This is a subtly different question than the usual &#8220;internal vs. external IP&#8221; split you&#8217;d get from a firewall log. ntopng already knows which subnets are &#8220;local&#8221; from its network configuration (the same concept used throughout the interface to distinguish local from remote hosts), so the classification is consistent with everything else you already see in host details, flows, and alerts. What&#8217;s new is that we now track and persist this breakdown over time, per host, rather than only exposing it as an instantaneous flow attribute.<\/p>\n\n\n\n<h5 class=\"wp-block-heading\">Why This Matters in Practice<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">Consider a few real-world scenarios where this distinction is the difference between a five-minute investigation and a five-figure invoice surprise:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Mobile\/cellular gateways<\/strong>: An IoT deployment where edge devices talk to each other over a local mesh but occasionally phone home to a cloud dashboard over a metered SIM. Aggregate bandwidth looks fine; non-local bandwidth tells you which device is silently uploading logs it shouldn&#8217;t.<\/li>\n\n\n\n<li><strong>Satellite links (VSAT)<\/strong>: Maritime, aviation, or remote-site connectivity where the WAN hop costs orders of magnitude more per byte than the LAN. A single misconfigured backup job or software update pulling updates over satellite instead of caching locally can dominate the monthly bill \u2014 and it&#8217;s invisible in a generic top-talkers chart.<\/li>\n\n\n\n<li><strong>Multi-site MPLS\/SD-WAN with metered backhaul<\/strong>: Branch offices where intra-site chatter (file shares, local backups, VoIP) is free, but the WAN circuit back to HQ or to the internet is billed by volume.<\/li>\n\n\n\n<li><strong>Cost attribution and chargeback<\/strong>: When bandwidth costs need to be attributed to specific departments, tenants, or devices, &#8220;local&#8221; traffic is effectively free and should be excluded from the calculation entirely.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">In all of these cases, the actionable metric isn&#8217;t total throughput \u2014 it&#8217;s WAN throughput, per host, sustained over time.<\/p>\n\n\n\n<h5 class=\"wp-block-heading\">What&#8217;s New in ntopng<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">To make this visible and actionable, we&#8217;ve added a dedicated page name Historical that lets you inspect, for any hlocal ost (or across all hosts), how local and non-local traffic volumes have evolved over time. <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"2566\" height=\"1334\" src=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-27-at-21.56.41.png\" alt=\"\" class=\"wp-image-46145\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Concretely, the page provides:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Time-series breakdown<\/strong> of local vs. non-local bytes (and packets) per host, so you can see not just <em>who<\/em> used the most WAN bandwidth, but <em>when<\/em> \u2014 a burst at 3 a.m. is a different story from steady daytime usage.<\/li>\n\n\n\n<li><strong>A ranked &#8220;top non-local users&#8221; view<\/strong>, which is really the metric that matters when the WAN link is pay-per-use: sorting by total bytes hides the hosts that are cheap-but-chatty locally and expensive-but-quiet on the WAN side.<\/li>\n\n\n\n<li><strong>Historical persistence<\/strong>, so the data survives beyond the retention window of raw flows, making it usable for monthly billing reconciliation, capacity trending, and anomaly detection rather than just live troubleshooting.<\/li>\n\n\n\n<li><strong>Per-(local)host drill-down<\/strong>, consistent with the rest of ntopng&#8217;s host details pages, so once you&#8217;ve identified a heavy non-local consumer you can immediately pivot to its flows, application breakdown (via nDPI), and remote peers to understand <em>why<\/em>.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Under the hood, the classification leverages the same local-network definition ntopng already uses elsewhere, so no additional configuration is required beyond having your local subnets correctly defined \u2014 something most deployments already have in place. The counters are accumulated incrementally as flows are processed, keeping the overhead low even on high-throughput monitoring points.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In every host you can see the local non\/local traffic breakdown <\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"1972\" height=\"862\" src=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/07\/host.png\" alt=\"\" class=\"wp-image-46140\" style=\"width:789px;height:auto\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">and you can see how local vs non-local changed over-time for every local host.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"2442\" height=\"1358\" src=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-26-at-16.46.39.png\" alt=\"\" class=\"wp-image-46139\" style=\"width:796px;height:auto\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h5 class=\"wp-block-heading\">Beyond Cost Control<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">While metered-link cost control is the primary motivation, the local\/non-local split has secondary benefits worth calling out:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Security visibility<\/strong>: a host that suddenly starts generating substantial non-local traffic \u2014 especially outbound \u2014 can be an early indicator of data exfiltration, a compromised device beaconing out, or unauthorized cloud sync tools bypassing local policy.<\/li>\n\n\n\n<li><strong>Architecture validation<\/strong>: it&#8217;s an easy way to verify that services which are <em>supposed<\/em> to communicate locally (e.g., a local cache, a local backup target) are actually doing so, rather than silently routing through the WAN due to misconfiguration.<\/li>\n\n\n\n<li><strong>Capacity planning for WAN upgrades<\/strong>: trending non-local traffic per host or per site over weeks or months gives a much more honest input for WAN sizing decisions than raw total traffic.<\/li>\n<\/ul>\n\n\n\n<h5 class=\"wp-block-heading\">Wrapping Up<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;Who are the top network users?&#8221; is a question every network team needs to answer \u2014 but on networks where WAN capacity has a price tag, the more useful question is &#8220;who are the top <em>WAN<\/em> users?&#8221; By separating local from non-local traffic at the host level and tracking it over time, ntopng gives you a direct answer, without needing to reverse-engineer it from raw flow exports or NetFlow records after the fact.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We&#8217;ll be following up with more detail on the underlying local-network classification logic and on how this integrates with alerting for sudden non-local traffic spikes. In the meantime, if you&#8217;re running ntopng on a link where every byte has a cost, this new page is worth a look.<br><br>Enjoy !<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Every network administrator has, at some point, asked the same question: who is eating my bandwidth? On a typical corporate LAN connected via flat-rate fiber, the answer is mostly a curiosity \u2014 useful for capacity planning, less so for the monthly bill. But the moment your network relies on a metered link \u2014 a 4G\/5G [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[677,1],"tags":[],"class_list":["post-46137","post","type-post","status-publish","format-standard","hentry","category-ntopng","category-technologies-and-trends"],"_links":{"self":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/46137","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/comments?post=46137"}],"version-history":[{"count":5,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/46137\/revisions"}],"predecessor-version":[{"id":46166,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/46137\/revisions\/46166"}],"wp:attachment":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/media?parent=46137"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/categories?post=46137"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/tags?post=46137"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}},{"id":45796,"date":"2026-07-03T14:56:59","date_gmt":"2026-07-03T14:56:59","guid":{"rendered":"https:\/\/www.ntop.org\/?p=45796"},"modified":"2026-07-03T14:57:59","modified_gmt":"2026-07-03T14:57:59","slug":"discussing-of-llm-and-intelligent-monitoring-at-grnog-20","status":"publish","type":"post","link":"https:\/\/www.ntop.org\/discussing-of-llm-and-intelligent-monitoring-at-grnog-20\/","title":{"rendered":"Discussing of LLM and Intelligent Monitoring at GRNOG 20"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Earlier this week ntop attended the <a href=\"https:\/\/grnog.gr\">GRNOG<\/a> 20, the annual meeting of Greek Network Operators. This has been a great place to discuss about network visibility in large networks, understand what are the problems network operators face with, and see what ntop can do in terms of visibility. ntop has been traditionally a company based on opens open source, and this has been the location where we have demonstrated how ntopng has been enhanced with BGP (Border Gateway Protocol), ASN and infrastructure visibility. <\/p>\n\n\n\n<figure class=\"wp-block-gallery has-nested-images columns-default is-cropped wp-block-gallery-1 is-layout-flex wp-block-gallery-is-layout-flex\">\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"960\" height=\"1280\" data-id=\"45798\" src=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/07\/HMLBgxeXYAAJBsZ.jpeg\" alt=\"\" class=\"wp-image-45798\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"3072\" height=\"4096\" data-id=\"45797\" src=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/07\/17422-IMG20260630131351.jpg\" alt=\"\" class=\"wp-image-45797\"\/><figcaption class=\"wp-element-caption\">oplus_262176<\/figcaption><\/figure>\n<\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">One of the main topics of the talk (<a href=\"https:\/\/grnog.indico.nogalliance.org\/event\/13\/contributions\/184\/attachments\/122\/204\/The%20Future%20of%20Network%20Visibility_%20LLM%20and%20Intelligent%20Monitoring.pdf\">here you can find the presentation slides<\/a>) has been how AI can be merged with network visibility, to view what traditional dashboard or alerts cannot show. This is the idea behind our <a href=\"https:\/\/www.ntop.org\/previewing-nanalyst-the-layer-that-finally-explains-your-network\/\" data-type=\"post\" data-id=\"45766\">nAnalyst<\/a> tool that we have previewed weeks ago. If you re interested to deploy it while we finalize it, and willing to send us a feedback, please <a href=\"https:\/\/www.ntop.org\/support\/need-help\/contacts\/\" data-type=\"page\" data-id=\"45204\">contact us<\/a> and we&#8217;ll be in touch with you.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Enjoy !<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Earlier this week ntop attended the GRNOG 20, the annual meeting of Greek Network Operators. This has been a great place to discuss about network visibility in large networks, understand what are the problems network operators face with, and see what ntop can do in terms of visibility. ntop has been traditionally a company based [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[772,1],"tags":[],"class_list":["post-45796","post","type-post","status-publish","format-standard","hentry","category-ai","category-technologies-and-trends"],"_links":{"self":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/45796","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/comments?post=45796"}],"version-history":[{"count":2,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/45796\/revisions"}],"predecessor-version":[{"id":45800,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/45796\/revisions\/45800"}],"wp:attachment":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/media?parent=45796"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/categories?post=45796"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/tags?post=45796"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}},{"id":45790,"date":"2026-06-26T05:31:53","date_gmt":"2026-06-26T05:31:53","guid":{"rendered":"https:\/\/www.ntop.org\/?p=45790"},"modified":"2026-06-26T05:32:11","modified_gmt":"2026-06-26T05:32:11","slug":"introducing-ntop-sbom-software-bom","status":"publish","type":"post","link":"https:\/\/www.ntop.org\/introducing-ntop-sbom-software-bom\/","title":{"rendered":"Introducing ntop SBOM (Software BOM)"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">A Software Bill of Materials (SBOM) is a formal, machine-readable inventory that lists every component, library, and dependency included within a software application. Think of it as a digital &#8220;ingredient label&#8221; that tells you exactly what went into building the software, which versions are running, and where each piece originated. Typically, it documents:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Component Name: The specific name of the software package or open-source library.<\/li>\n\n\n\n<li>Version Number: The exact version of the component currently in use.<\/li>\n\n\n\n<li>Source\/Supplier: The developer, vendor, or open-source community that created it.<\/li>\n\n\n\n<li>License Information: The legal license governing that component (e.g., MIT, Apache, GPL).<\/li>\n\n\n\n<li>Dependency Relationships: How different components connect and link to one another<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">SBOMs are increasingly becoming a legal requirement. For instance, governments and strict regulatory frameworks (e.g. the <a href=\"https:\/\/www.nist.gov\/itl\/executive-order-14028-improving-nations-cybersecurity\">U.S. Executive Order on Improving the Nation&#8217;s Cybersecurity<\/a> and the <a href=\"https:\/\/digital-strategy.ec.europa.eu\/en\/policies\/cyber-resilience-act\">EU Cyber Resilience Act<\/a>) mandate that software vendors provide SBOMs to maintain compliance and sell to public or critical sectors.<\/p>\n\n\n\n<h6 class=\"wp-block-heading\">Why SBOMs are Crucial for Cybersecurity ?<\/h6>\n\n\n\n<p class=\"wp-block-paragraph\">Modern software is rarely written entirely from scratch; developers rely heavily on third-party and open-source frameworks. While this speeds up production, it introduces risks. SBOMs solve this by providing: <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Rapid Vulnerability Response: When a new security flaw is discovered in a popular library (like Log4j or XZ Utils), an SBOM allows security teams to instantly see if their applications are affected without manually digging through code.<\/li>\n\n\n\n<li>License Compliance: It prevents organizations from accidentally using open-source code with restrictive licenses that could spark legal or financial disputes.<\/li>\n\n\n\n<li>Supply Chain Transparency: It helps organizations verify the integrity of the software they buy or build, ensuring malicious code or backdoors haven&#8217;t slipped into the development pipeline.<\/li>\n<\/ul>\n\n\n\n<h6 class=\"wp-block-heading\">SBOMs in ntop Tools<\/h6>\n\n\n\n<p class=\"wp-block-paragraph\">Our decision to release a Software Bill of Materials (SBOM) is highly important due to the critical role these tools play in modern infrastructure. Because ntop tools operate at the foundational layer of network observability and security, their transparency directly impacts the security of the entire organization. The ntop ecosystem blends open-source development with commercial licensing (such as Enterprise L bundles). This hybrid model can make license tracking complex for enterprise legal teams. Providing a machine-readable SBOM clearly maps out the licensing boundaries of every integrated sub-component, preventing accidental compliance violations or legal risks for the organizations hosting the software.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As SBOMs are platform dependent (i.e. for the same ntopng version, the SBOM for Ubuntu 22.04 and Ubuntu 26.04 is different due different versions of the underlying libraries), ntop packages (dev branch at the moment, but soon also the stable branch) now include SBOMs. When you install ntopng packages you will find them under \/usr\/share\/ntop\/sbom\/ with name &lt;application>.json. The only exception to this rules is ntopng for which there are two SBOMs: one for the binary application (ntopng.json) and one for the user interface (ntopng-gui.json).<\/p>\n\n\n\n<h6 class=\"wp-block-heading\">Searching Vulnerabilities using SBOMs<\/h6>\n\n\n\n<p class=\"wp-block-paragraph\">You can use SBOMs to check vulnerabilities using tools such as <a href=\"https:\/\/github.com\/anchore\/grype\">grype<\/a>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Environment detection\n---------------------\n&#91;INFO] Architecture: x86_64 \u2192 amd64\n&#91;INFO] OS: Linux \/ Ubuntu 24.04.4 LTS\n&#91;INFO] Distro flag: --distro ubuntu:24.04\n&#91;INFO] SBOM: nprobe.json\n&#91;INFO] App:  nprobe 7e1bb19b\n&#91;INFO] Components in SBOM: 1\n\nPrerequisites\n-------------\n&#91; OK ] grype: 0.114.0\n&#91; OK ] python3: Python 3.12.3\n\nUpdating vulnerability database\n-------------------------------\n&#91;INFO] Current DB: Built:     0001-01-01T00:00:00Z\nunknown\nVulnerability database updated to latest version!\n&#91; OK ] Vulnerability DB updated\n\nScanning nprobe 7e1bb19b (amd64 \/ ubuntu:24.04)\n-----------------------------------------------\n&#91;INFO] Running grype...\n\nResults\n-------\n\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n  Vulnerability Report\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n  App:          nprobe 7e1bb19b\n  Architecture: amd64\n  Distro:       ubuntu:24.04\n  Scan time:    2026-06-26 05:01 UTC\n  SBOM file:    nprobe.json\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n  Severity       Count   Status\n  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 \u2500\u2500\u2500\u2500\u2500   \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 \u2500\u2500\u2500\u2500\u2500\n  No vulnerabilities found\n\n  Fix status:\n\n  Clean \u2014 no vulnerabilities detected.\n\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n  Full table: nprobe-vulns.txt\n  Full JSON:  nprobe-vulns.json\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Enjoy !<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A Software Bill of Materials (SBOM) is a formal, machine-readable inventory that lists every component, library, and dependency included within a software application. Think of it as a digital &#8220;ingredient label&#8221; that tells you exactly what went into building the software, which versions are running, and where each piece originated. Typically, it documents: SBOMs are [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[658,674,1],"tags":[],"class_list":["post-45790","post","type-post","status-publish","format-standard","hentry","category-cybersecurity","category-news","category-technologies-and-trends"],"_links":{"self":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/45790","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/comments?post=45790"}],"version-history":[{"count":1,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/45790\/revisions"}],"predecessor-version":[{"id":45791,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/45790\/revisions\/45791"}],"wp:attachment":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/media?parent=45790"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/categories?post=45790"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/tags?post=45790"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}},{"id":45778,"date":"2026-06-23T17:48:49","date_gmt":"2026-06-23T17:48:49","guid":{"rendered":"https:\/\/www.ntop.org\/?p=45778"},"modified":"2026-07-25T04:07:23","modified_gmt":"2026-07-25T04:07:23","slug":"interop-tokyo-2026-showcasing-the-future-of-network-visibility-and-ai","status":"publish","type":"post","link":"https:\/\/www.ntop.org\/interop-tokyo-2026-showcasing-the-future-of-network-visibility-and-ai\/","title":{"rendered":"Interop Tokyo 2026: Showcasing the Future of Network Visibility and AI"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">We just returned from an incredible week in Japan! <a href=\"https:\/\/www.interop.jp\/2026\/en\/\">Interop Tokyo 2026<\/a> is the region\u2019s premier computing and networking event. This year&#8217;s experience exceeded all our expectations. Connecting with our vibrant community always fuels our passion. It helps us shape the future of network traffic analysis. Here is a look at what went down and what is coming next.<\/p>\n\n\n\n<h6 class=\"wp-block-heading\">A Sold-Out Seminar with Jupiter Technology<\/h6>\n\n\n\n<p class=\"wp-block-paragraph\">We owe a massive thank you to our trusted partner, <a href=\"https:\/\/www.jtc-i.co.jp\/index.php\">Jupiter Technology<\/a>. Thanks to their support, we hosted a specialized seminar during the event. The response was overwhelming, resulting in a&nbsp;completely sold-out session. During the presentation, we dove deep into the core ecosystem of ntop tools. We walked the audience through our upcoming roadmap. The energy in the room confirmed that the demand for deep packet inspection and network visibility is stronger than ever.<\/p>\n\n\n\n<h6 class=\"wp-block-heading\">Sneak Peek: AI Extensions Arriving This Summer<\/h6>\n\n\n\n<p class=\"wp-block-paragraph\">The highlight of our seminar was unveiling our new&nbsp;Artificial Intelligence extensions. Network environments are growing more complex every day. Because of this, we are embedding smart AI capabilities directly into our software. These features will help you:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Detect anomalies faster&nbsp;using predictive pattern analysis.<\/li>\n\n\n\n<li>Automate root-cause analysis&nbsp;for complex network slowdowns.<\/li>\n\n\n\n<li>Simplify traffic troubleshooting&nbsp;with intelligent insights.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">These breakthrough AI tools are not far off. They are officially part of our next stable release dropping&nbsp;this summer.<\/p>\n\n\n\n<h6 class=\"wp-block-heading\">Insights from the Exhibition Floor<\/h6>\n\n\n\n<p class=\"wp-block-paragraph\">When we weren&#8217;t on stage, we were at our busy exhibition booth. Meeting hundreds of engineers, sysadmins, and tech enthusiasts face-to-face was invaluable. We shared our long-term vision for the network monitoring industry. More importantly, we listened. Your real-world challenges give us the exact blueprints we need. We took detailed notes on requested features and unique use cases. Our team is already evaluating how to implement this feedback to make our tools even more effective for you.<\/p>\n\n\n\n<h6 class=\"wp-block-heading\">Access the Slides &amp; Join Us on the Next Stop<\/h6>\n\n\n\n<p class=\"wp-block-paragraph\">Did you miss the live session? No problem. We believe in keeping our community informed.<\/p>\n\n\n\n<div data-wp-interactive=\"core\/file\" class=\"wp-block-file\"><object data-wp-bind--hidden=\"!state.hasPdfPreview\" hidden class=\"wp-block-file__embed\" data=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/06\/Interop_Japan_0626_all.pdf\" type=\"application\/pdf\" style=\"width:100%;height:600px\" aria-label=\"Embed of Interop_Japan_0626_all.\"><\/object><a id=\"wp-block-file--media-86d1f415-a46f-42c1-91ca-2bd86c6affc5\" href=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/06\/Interop_Japan_0626_all.pdf\">Interop_Japan_0626_all<\/a><a href=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/06\/Interop_Japan_0626_all.pdf\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-86d1f415-a46f-42c1-91ca-2bd86c6affc5\">Download<\/a><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Our Summer Tour 2026 is just getting started. Next week, we are packing our bags and heading to&nbsp;<a href=\"https:\/\/grnog.indico.nogalliance.org\/event\/13\/timetable\/\">Greece<\/a>! Meeting our global user base is the best part of what we do. We want to hear from you. What features are you most excited to see in the upcoming summer release? Please drop your comments, ideas, and feedback or <a href=\"https:\/\/www.ntop.org\/support\/need-help\/contacts\/\" data-type=\"page\" data-id=\"45204\">reach out to us directl<\/a>y.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Enjoy the slides, and see you on the road!<\/p>\n\n\n\n<figure class=\"wp-block-gallery has-nested-images columns-default is-cropped wp-block-gallery-2 is-layout-flex wp-block-gallery-is-layout-flex\">\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1920\" height=\"1440\" data-id=\"45780\" src=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/06\/Outlook-PXL_202606-1.jpg\" alt=\"\" class=\"wp-image-45780\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1920\" height=\"1445\" data-id=\"45781\" src=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/06\/Outlook-IMG_202606.jpg\" alt=\"\" class=\"wp-image-45781\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1920\" height=\"1445\" data-id=\"45782\" src=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/06\/Outlook-IMG_202606-1.jpg\" alt=\"\" class=\"wp-image-45782\"\/><\/figure>\n<\/figure>\n\n\n\n\n\n<ul class=\"wp-block-list\">\n<li><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>We just returned from an incredible week in Japan! Interop Tokyo 2026 is the region\u2019s premier computing and networking event. This year&#8217;s experience exceeded all our expectations. Connecting with our vibrant community always fuels our passion. It helps us shape the future of network traffic analysis. Here is a look at what went down and [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[772,771,674],"tags":[],"class_list":["post-45778","post","type-post","status-publish","format-standard","hentry","category-ai","category-artificial-intelligence","category-news"],"_links":{"self":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/45778","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/comments?post=45778"}],"version-history":[{"count":9,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/45778\/revisions"}],"predecessor-version":[{"id":46136,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/45778\/revisions\/46136"}],"wp:attachment":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/media?parent=45778"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/categories?post=45778"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/tags?post=45778"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}},{"id":45766,"date":"2026-06-09T20:40:31","date_gmt":"2026-06-09T20:40:31","guid":{"rendered":"https:\/\/www.ntop.org\/?p=45766"},"modified":"2026-06-09T20:40:31","modified_gmt":"2026-06-09T20:40:31","slug":"previewing-nanalyst-the-layer-that-finally-explains-your-network","status":"publish","type":"post","link":"https:\/\/www.ntop.org\/previewing-nanalyst-the-layer-that-finally-explains-your-network\/","title":{"rendered":"Previewing nAnalyst, the layer that finally explains your network"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Today we have previewed out first AI-based tool named nAnalyst during out webinar taht we have run with support of the Alibaba Qwen team. This tool is designed to (finally) explain what happens in your network, and we&#8217;ll introduce it in September with bet starting on June 22nd.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For those who missed the webinar can see the recording of the event.<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe title=\"ntop Webinar - AI in ntopng\" width=\"1140\" height=\"641\" src=\"https:\/\/www.youtube.com\/embed\/nEXrITvOsfk?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Below you can also find the presentation slides we have used today:<\/p>\n\n\n\n<div data-wp-interactive=\"core\/file\" class=\"wp-block-file\"><object data-wp-bind--hidden=\"!state.hasPdfPreview\" hidden class=\"wp-block-file__embed\" data=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/06\/AI_Webinar_Introduction.pdf\" type=\"application\/pdf\" style=\"width:100%;height:600px\" aria-label=\"Embed of AI_Webinar_Introduction.\"><\/object><a id=\"wp-block-file--media-c1b0fb03-71df-428d-ad5a-8731fd0f1133\" href=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/06\/AI_Webinar_Introduction.pdf\">AI_Webinar_Introduction<\/a><a href=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/06\/AI_Webinar_Introduction.pdf\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-c1b0fb03-71df-428d-ad5a-8731fd0f1133\">Download<\/a><\/div>\n\n\n\n<div data-wp-interactive=\"core\/file\" class=\"wp-block-file\"><object data-wp-bind--hidden=\"!state.hasPdfPreview\" hidden class=\"wp-block-file__embed\" data=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/06\/Ntop_Qwen_0626.pdf\" type=\"application\/pdf\" style=\"width:100%;height:600px\" aria-label=\"Embed of Ntop_Qwen_0626.\"><\/object><a id=\"wp-block-file--media-2a59eeb0-429b-4b3f-bb2f-a9adb28525b6\" href=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/06\/Ntop_Qwen_0626.pdf\">Ntop_Qwen_0626<\/a><a href=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/06\/Ntop_Qwen_0626.pdf\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-2a59eeb0-429b-4b3f-bb2f-a9adb28525b6\">Download<\/a><\/div>\n\n\n\n<div data-wp-interactive=\"core\/file\" class=\"wp-block-file\"><object data-wp-bind--hidden=\"!state.hasPdfPreview\" hidden class=\"wp-block-file__embed\" data=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/06\/nAnalyst_webinar.pdf\" type=\"application\/pdf\" style=\"width:100%;height:600px\" aria-label=\"Embed of nAnalyst_webinar.\"><\/object><a id=\"wp-block-file--media-6df993eb-0b7e-422f-8116-2e0599d3277c\" href=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/06\/nAnalyst_webinar.pdf\">nAnalyst_webinar<\/a><a href=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/06\/nAnalyst_webinar.pdf\" class=\"wp-block-file__button wp-element-button\" download aria-describedby=\"wp-block-file--media-6df993eb-0b7e-422f-8116-2e0599d3277c\">Download<\/a><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Shall you be interested in providing us a feedback and willing to test nAnalyst beta, please <a href=\"https:\/\/forms.gle\/qHG98cpUMpdfMraN6\">fill up this form<\/a> and we&#8217;ll contact you.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Enjoy !<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Today we have previewed out first AI-based tool named nAnalyst during out webinar taht we have run with support of the Alibaba Qwen team. This tool is designed to (finally) explain what happens in your network, and we&#8217;ll introduce it in September with bet starting on June 22nd. For those who missed the webinar can [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[772,681,677],"tags":[],"class_list":["post-45766","post","type-post","status-publish","format-standard","hentry","category-ai","category-announce","category-ntopng"],"_links":{"self":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/45766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/comments?post=45766"}],"version-history":[{"count":1,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/45766\/revisions"}],"predecessor-version":[{"id":45770,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/45766\/revisions\/45770"}],"wp:attachment":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/media?parent=45766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/categories?post=45766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/tags?post=45766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}},{"id":45700,"date":"2026-06-04T10:17:24","date_gmt":"2026-06-04T10:17:24","guid":{"rendered":"https:\/\/www.ntop.org\/?p=45700"},"modified":"2026-06-04T10:17:24","modified_gmt":"2026-06-04T10:17:24","slug":"observability-enabling-high-resolution-timeseries-in-ntopng","status":"publish","type":"post","link":"https:\/\/www.ntop.org\/observability-enabling-high-resolution-timeseries-in-ntopng\/","title":{"rendered":"Observability: Enabling High-Resolution Timeseries in ntopng"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Modern observability platforms are expected to answer questions that traditional monitoring systems were never designed to handle:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><em>What exactly happened during that 20-second congestion spike?<\/em><\/li>\n\n\n\n<li><em>Which application caused the transient burst?<\/em><\/li>\n\n\n\n<li><em>Why did users report latency even though 5-minute averages look normal?<\/em><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Conventional network timeseries are excellent for long-term capacity planning and trend analysis, but they often smooth away the short-lived events that matter most during troubleshooting and incident analysis.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With the introduction of&nbsp;<strong>High-Resolution Timeseries<\/strong>, ntopng closes this visibility gap by enabling historical traffic analysis at&nbsp;15 <strong>second<\/strong>, or even lower, <strong>granularity<\/strong>, directly embedded into flow records.&nbsp;<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Why High-Resolution Timeseries Matter<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Traditional flow records aggregate counters over the entire lifetime of a connection. While this approach is compact and efficient, it also hides traffic dynamics occurring inside the flow itself.<br>For example, a 10 minutes flow, carrying GBs of data, may appear perfectly stable. In reality, the traffic could have consisted of several bursts separated by idle periods. This becomes a problem for observability because modern operational workflows increasingly rely on micro-congestion analysis, transient anomaly identification, application responsiveness correlation.<br>High-resolution timeseries address this limitation by preserving throughput evolution, within each flow, at the second level.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">High-Resolution Data Pipeline<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">In order to implement High-Resolution timeseries, ntopng required a source of traffic counters able to export 15 (or less) second buckets for each flow record, rather than only final cumulative counters. nProbe, which is tightly integrated with ntopng, has been extended for this, minimizing architectural complexity.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1952\" height=\"814\" src=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/05\/ntopng-nprobe-hr-pipeline.png\" alt=\"\" class=\"wp-image-45698\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The processing pipeline is:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Traffic is captured by nProbe.<\/li>\n\n\n\n<li>nProbe periodically accumulates byte counters into 15-second slots (soon configurable).<\/li>\n\n\n\n<li>HR data is exported to ntopng according to the Information Elements in the template (e.g. HR_SRC_TO_DST_BYTES, HR_DST_TO_SRC_BYTES)..<\/li>\n\n\n\n<li>ntopng automatically detects HR fields.<\/li>\n\n\n\n<li>Consolidated flow records are written into ClickHouse.<\/li>\n\n\n\n<li>ntopng, or Grafana, can query high-resolution historical flows and build timeseries.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">ClickHouse is particularly well suited for this workload because it is optimized for analytical timeseries processing and high-throughput inserts, and being already used by ntopng for storing historical flow records, extending it for HR data has been a natural evolution.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Embedding Timeseries In Raw Flows<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Embedding HR data directly into flow records rather than storing them in a separate timeseries database provides several advantages:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Context Preservation: traffic evolution remains tied to flow metadata:<\/li>\n\n\n\n<li>Simplified Correlation: no external joins are required between flows and metrics.<\/li>\n\n\n\n<li>Better Query Semantics: analysts can query \u201cshow flows with throughput spikes\u201d using a single dataset.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This model resembles modern observability systems where rich events encapsulate both metadata and time-evolving measurements.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Configuration<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">HR timeseries require:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>ntopng Enterprise with Historical Flows support (Enterprise M and superior).<\/li>\n\n\n\n<li>ClickHouse enabled as flow backend (-F clickhouse).<\/li>\n\n\n\n<li>nProbe configured to export High Resolution Information Elements.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">nProbe configuration example to export HR byte counters:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>nprobe -i enp1s0 \\\n-n none \\\n--zmq \"tcp:\/\/*:5556\" \\\n-T \"@NTOPNG@ %HR_DST_TO_SRC_BYTES %HR_SRC_TO_DST_BYTES\"<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">HR_SRC_TO_DST_BYTES and HR_DST_TO_SRC_BYTES fields in the example contain arrays of byte counters sampled every 15 seconds by default. No additional nProbe options are required.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Note: in order to produce High-Resolution counters, nProbe should be configured to capture traffic from a mirror\/SPAN\/TAP, as it requires packet analysis. When collecting Netflow, it is not possible to extract High-Resolution data as counters are already aggregated by the exporter.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On the ntopng side, no special HR-specific configuration is necessary. ntopng automatically detects HR fields, maps them to ClickHouse columns, stores the consolidated flow records. The only requirement is enabling ClickHouse as the flow dump backend.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ntopng configuration example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ntopng -i \"tcp:\/\/127.0.0.1:5556\" -F \"clickhouse\"<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Data Visualization<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Once data is available in ClickHouse, this is immediately available for drawing high-resolution charts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Charts are available at different places in ntopng:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The Interface Details page includes an historical chart aggregating traffic across every flow seen on that interface, showing the total throughput per direction with 15 seconds resolution.<\/li>\n\n\n\n<li>The Host Details page shows the host per-direction throughput at high granularity, aggregating all flows where the host appears as client or server.<\/li>\n\n\n\n<li>Drilling down to a specific historical flow through the Historical Flows page and jumping to a single Flow Details page, a dedicated per-flow high resolution chart is available. This chart plots the exact bidirectional throughput profile of that single connection at 15-second resolution, annotated with the flow 5-tuple. This is particularly powerful for observability: it makes it possible to answer questions such as &#8220;was the traffic bursty or flat?&#8221;, &#8220;did the throughput drop midway through the connection?&#8221;, or &#8220;which direction dominated?&#8221;, all at a granularity that a simple\/standard flow record cannot provide.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"2594\" height=\"1752\" src=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/05\/ht-timeseries-flow.png\" alt=\"\" class=\"wp-image-45746\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><br>Furthermore, a dedicated <em>High-Resolution Timeseries<\/em> page is available, this brings together filtering and aggregation in a single interactive view. In fact this page includes a <strong>filter<\/strong> bar that lets you narrow the dataset by any flow field supported by the historical flow search (e.g. source IP, destination IP, source port, destination port, L4 protocol, L7 application protocol, VLAN,<br>ASN, etc.), a <strong>high-resolution chart<\/strong> <strong>aggregates<\/strong> the high-resolution counters of all flows matching the active filters.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"2728\" height=\"1600\" src=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/05\/hr-timeseries-aggregation.png\" alt=\"\" class=\"wp-image-45744\"\/><\/figure>\n\n\n\n<h4 class=\"wp-block-heading\">Grafana Integration<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Grafana can also be used to draw High Resolution data by means of the ClickHouse plugin. A <a href=\"https:\/\/github.com\/ntop\/ntopng\/tree\/dev\/httpdocs\/misc\/grafana\">sample Grafana dashboard<\/a> is available on <a href=\"https:\/\/github.com\/ntop\/ntopng\/tree\/dev\/httpdocs\/misc\/grafana\">GitHub at this URL<\/a> as starting point.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To import the dashboard into Grafana:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>In Grafana, go to Dashboards \u2192 Import.<\/li>\n\n\n\n<li>Upload hr-flow-throughput-dashboard.json or paste its contents.<\/li>\n\n\n\n<li>When prompted, select the ClickHouse datasource that points to the ntopng database. <\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"2230\" height=\"1492\" src=\"https:\/\/www.ntop.org\/wp-content\/uploads\/2026\/05\/grafana-hr.png\" alt=\"\" class=\"wp-image-45699\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">This sample dashboard provides two panels:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Service Flow Throughput \u2014 bidirectional throughput for a specific flow, filtered by source IP, destination IP, and destination port.<\/li>\n\n\n\n<li>Application Protocol Throughput (All Traffic) \u2014 aggregated throughput broken down by application protocol.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">with the aim of demonstrating how, High-Resolution data, can be grouped by different criteria to build any higher level metric.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Higher telemetry fidelity naturally introduces tradeoffs. HR timeseries increase storage usage and ingestion volume as additional metadata is included in exported flows. However, this is in most cases negligible as most of the space is used for Layer 7 metadata and other metrics, HR counters represent a small portion. For large deployments, administrators should carefully evaluate retention policies and ClickHouse sizing, which applies to storing raw flows, regardless of HR counters being enabled. Observability in most cases benefits outweigh the additional cost, especially for environments where short-lived traffic anomalies matter.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Enjoy!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Modern observability platforms are expected to answer questions that traditional monitoring systems were never designed to handle: Conventional network timeseries are excellent for long-term capacity planning and trend analysis, but they often smooth away the short-lived events that matter most during troubleshooting and incident analysis. With the introduction of&nbsp;High-Resolution Timeseries, ntopng closes this visibility gap [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[671,677,1],"tags":[],"class_list":["post-45700","post","type-post","status-publish","format-standard","hentry","category-nprobe","category-ntopng","category-technologies-and-trends"],"_links":{"self":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/45700","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/comments?post=45700"}],"version-history":[{"count":7,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/45700\/revisions"}],"predecessor-version":[{"id":45759,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/45700\/revisions\/45759"}],"wp:attachment":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/media?parent=45700"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/categories?post=45700"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/tags?post=45700"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}},{"id":45735,"date":"2026-05-29T05:19:56","date_gmt":"2026-05-29T05:19:56","guid":{"rendered":"https:\/\/www.ntop.org\/?p=45735"},"modified":"2026-05-29T06:00:00","modified_gmt":"2026-05-29T06:00:00","slug":"ntop-summer-tour-interop-japan-italy-greece-norway-croatia","status":"publish","type":"post","link":"https:\/\/www.ntop.org\/ntop-summer-tour-interop-japan-italy-greece-norway-croatia\/","title":{"rendered":"ntop Summer Tour: Interop Japan, Italy, Greece, Norway, Croatia&#8230;"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">This summer we are touring to present all the latest development and enhancements to our tool suite. In particular we will be focusing on:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>High-definition visibility.<\/li>\n\n\n\n<li>Post-quantum traffic analysis.<\/li>\n\n\n\n<li>Monitoring large networks.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.ntop.org\/webinar-ntop-and-ai-june-9th-1600-cet-10am-est\/\">Artificial Intelligence in network observability<\/a>.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For those who cannot meet us in person can follow us in <a href=\"https:\/\/www.ntop.org\/observability-and-large-networks-monitoring-webinar-video-and-slides\/\">webinars<\/a>, but we definitively prefer to see you in person. Below you can see some of our 2026 summer tour dates and places:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.itnog.it\/itnog10\/\">ITNOG 2026<\/a>, Bologna, Italy, April 21st.<\/li>\n\n\n\n<li><a href=\"https:\/\/conf26.garr.it\/it\/programma\">GARR 26<\/a>, Pisa, Italy, May 19-21st.<\/li>\n\n\n\n<li><a href=\"https:\/\/neacademy.it\/agenda\/\">Neacademy<\/a>, Napoli, Italy, June 3rd.<\/li>\n\n\n\n<li><a href=\"https:\/\/www.interop.jp\/2026\/en\/\">Interop 26 Tokyo<\/a>, Japan, June 10-12th.<br>We will be present at the <a href=\"https:\/\/www.jtc-i.co.jp\/index.php\">Jupiter Technology booth<\/a> (J3-07), and<br>give a 1 hour seminar on June 12th at 15:10 on Classroom J, Hall 7.<\/li>\n\n\n\n<li><a href=\"https:\/\/grnog.indico.nogalliance.org\/event\/13\/overview\">GRNOG 20<\/a>, Athens. Greece, June 30th.<\/li>\n\n\n\n<li><a href=\"https:\/\/nonog.net\/\">NONOG-8 \/ NIX-2026<\/a>, Oslo, Norway, September 9th.<\/li>\n\n\n\n<li><a href=\"https:\/\/nog.hr\/en\/\">NOG.HR 7<\/a>, Zagreb, Croatia, September 10th.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">We would like to meet our community in person so we invite you to show up. We are planning to attend other events after the summer, so stay tuned for updates.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">See you !<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>This summer we are touring to present all the latest development and enhancements to our tool suite. In particular we will be focusing on: For those who cannot meet us in person can follow us in webinars, but we definitively prefer to see you in person. Below you can see some of our 2026 summer [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[674,1],"tags":[],"class_list":["post-45735","post","type-post","status-publish","format-standard","hentry","category-news","category-technologies-and-trends"],"_links":{"self":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/45735","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/comments?post=45735"}],"version-history":[{"count":8,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/45735\/revisions"}],"predecessor-version":[{"id":45743,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/posts\/45735\/revisions\/45743"}],"wp:attachment":[{"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/media?parent=45735"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/categories?post=45735"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ntop.org\/wp-json\/wp\/v2\/tags?post=45735"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}]