What Ntop does

Ntop is a privately held, bootstrapped Italian software company founded in 1998 by Luca Deri in Pisa, focused on enterprise network traffic monitoring and cybersecurity. Its portfolio centers on a proprietary, end-to-end stack — PF_RING and PF_RING ZC/FT for high-speed packet capture, nDPI for deep packet inspection across 450+ protocols, nProbe/nProbe Cento for NetFlow/IPFIX export at 100+ Gbps, n2disk/disk2n for lossless traffic recording and replay, ntopng as the web-based analytics console, and supporting tools nScrub (DDoS mitigation), nTap (virtual tap), nEdge (inline enforcement), and nBox hardware appliances. The stack is fully home-grown with no third-party dependencies, enabling rapid development and direct engineering support. ntop operates a hybrid go-to-market: a free open-source Community edition distributed via website, GitHub, and Linux distribution repositories, layered with paid Professional/Enterprise licenses, PF_RING ZC per-MAC licensing, nBox appliance sales, and add-on professional support and training services. It serves enterprise network operators, ISPs, industrial/OT environments, and security teams globally, with active channel presence in EMEA and APAC. Recent additions layer AI capabilities onto the platform: nAnalyst (built with Alibaba Qwen), the ntopng MCP Server for AI-assistant integration, and SBOM for supply-chain compliance.

Name

Ntop

Legal name

ntop

Website

https://ntop.org

Company type

Private

Founded year

1998

Operating status

Operating

Headcount range

11–50 employees

Short description

Ntop is a bootstrapped Italian software company (founded 1998, Pisa) that builds a home-grown open-source and commercial network monitoring and cybersecurity stack — including ntopng, nDPI, nProbe, PF_RING, and nBox appliances — serving enterprises, ISPs, industrial/OT operators, and security teams worldwide.

Ownership category

akta.pro rank

Product category

Network Monitoring Software

NAICS

Computer Facilities Management Services (541513)

SIC

Computer Communications Equipment (3576)

akta.pro primary industry

Fault & Performance Monitoring (SNMP/Telemetry/APM for Networks) (HDAFAMAA)

akta.pro secondary industry

Infrastructure & Network Monitoring (NPM/NPMD) (HDABAJAA)

Keywords

• Network monitoring software
• Deep packet inspection
• Flow analysis tools
• DDoS mitigation
• Packet capture

Headquarters

HQ city

Pisa

HQ country

Italy

HQ region

Europe

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure, Supply Chain

Revenue model

1. Software Licensing (Community vs. Enterprise): ntop software is available in both Community (free, open-source) and Professional/Enterprise (commercial) editions. Enterprise editions include additional features and support options not available in the Community version.
2. Professional Support Services: Round-the-clock technical assistance, priority issue handling, and custom development services. Offered as an add-on to commercial software editions.
3. Professional Training: Structured, hands-on training sessions taught directly by the ntop development team.
4. nBox Hardware Appliances: Pre-packaged hardware appliances running ntop software, sold as turn-key solutions for enterprise and industrial environments.
5. PF_RING ZC Licensing: PF_RING ZC user-space library requires a per-MAC license for commercial use, while the kernel driver is released in source format as part of the open-source PF_RING package.

Pricing tiers

Go-to-market motion1 record

Distribution channels5 records

Marketing channels7 records

Core offering

Ntop develops and sells an integrated network traffic monitoring and cybersecurity platform built around its proprietary nDPI deep packet inspection engine and PF_RING high-speed packet capture framework. The offering spans web-based traffic analysis (ntopng), NetFlow/IPFIX flow collection (nProbe/nProbe Cento), lossless traffic recording (n2disk/disk2n), on-premise DDoS mitigation (nScrub), inline edge enforcement (nEdge), and pre-configured nBox hardware appliances, delivered via both free open-source Community editions and paid Professional/Enterprise subscriptions with support, training, and licensing services.

Product overview

Ntop offers an enterprise-grade network monitoring and cybersecurity platform built around open-source tools. The core portfolio centers on ntopng as the primary web-based traffic analyzer, complemented by nProbe/nProbe Cento for NetFlow/IPFIX flow collection, nDPI for deep packet inspection, and n2disk/disk2n for traffic recording and replay. The PF_RING family (including PF_RING ZC and PF_RING FT) provides packet capture acceleration at 100+ Gbps speeds. Supporting products include nScrub for DDoS mitigation, nTap for virtual tap functionality, and nEdge for inline traffic enforcement. Pre-configured nBox hardware appliances bundle these tools for enterprise deployment. The platform supports Linux, Windows, macOS, and embedded platforms including Raspberry Pi and OpenWRT. Recent additions include AI capabilities through nAnalyst (natural language network explanation) and ntopng MCP Server for AI assistant integration. SBOM is provided for vulnerability scanning compliance.

Differentiator

Problem solved

Functional benefit

Brands

• ntopng: Web-based network traffic analyzer with real-time and historical visibility, flow analytics, host and application tracking, and cybersecurity insights.
• nDPI
• nProbe
• nProbe Cento
• n2disk
• disk2n
• PF_RING
• nScrub
• nEdge
• nBox
• nTap

Products and services

• ntopng Web-based network traffic analyzer with a centralized console providing real-time and historical visibility, flow analytics, host and application tracking, and cybersecurity insights. Supports 450+ application protocols and 100+ behavioral checks. Designed for network administrators monitoring, troubleshooting, and optimizing enterprise and ISP infrastructure.
• nProbe Extensible flow exporter and collector supporting NetFlow v5/v9/IPFIX, JSON, and many other formats. Enables deep traffic monitoring, metadata enrichment, and integration with third-party systems including OPNsense and pfSense. Used by enterprises and ISPs for distributed flow collection.
• nProbe Cento High-performance software-based flow probe designed for 100+ Gbps environments. Leverages PF_RING ZC for zero-copy packet processing and exports enriched NetFlow/IPFIX for scalable monitoring. Targeted at ISPs, HSPs, and large-scale enterprise networks.
• n2disk Lossless network traffic recorder with on-the-fly indexing and nanosecond-precision timestamps. Supports Smart Recording for event-based capture prioritization. Used for troubleshooting, high-frequency trading optimization, lawful interception, and forensics by network operators, financial institutions, and law enforcement.
• disk2n PCAP traffic replay tool that injects previously captured packets back into the network. Useful for testing, simulation, and forensic reconstruction with accurate timing reproduction. Targeted at network engineers, QA teams, and security researchers.
• nDPI Open-source Deep Packet Inspection toolkit for Layer 7 protocol detection and metadata extraction. Powers ntop tools for advanced traffic classification, security analysis, and policy enforcement with 450+ supported protocols and 58+ flow risk categories. Used by developers integrating DPI into their own applications.
• PF_RING High-performance packet capture acceleration engine for Linux. Provides efficient zero-copy packet capture and transmission, supporting both software and hardware acceleration for high-speed monitoring. Used by network engineers and developers building monitoring and security applications.
• PF_RING ZC Zero-copy packet capture and transmission framework for PF_RING. Includes kernel drivers (open source) and user-space library (per-MAC licensed) for maximum performance in inline and monitoring applications. Targeted at high-performance network monitoring and security appliance developers.
• PF_RING FT PF_RING with hardware flow tracking support for NVIDIA BlueField and ConnectX adapters, plus Napatech SmartNIC Flow Manager FPGA integration for state-of-the-art hardware offloads. Designed for high-throughput, distributed monitoring deployments.
• nScrub On-premise DDoS scrubbing solution that detects and blocks volumetric attacks in real time. Designed for hosting service providers (HSPs) and large networks, filtering attack traffic to ensure clean traffic reaches protected services.
• nTap Virtual tap for monitoring and cybersecurity in physical and virtual/containerized environments. Captures and delivers packets via secure encrypted channel from remote hosts to a collector for analysis with Wireshark, Suricata, Zeek, or OpenvSwitch. Targeted at cloud, virtualized, and containerized network operators.
• nEdge Network edge monitoring, service segmentation, and security solution for wired and wireless edge deployments. Supports device policies, RADIUS integration for captive portal authentication, and Layer-7 traffic enforcement. Targeted at branch offices, hospitality, education, and edge network operators.
• nBox Appliances Pre-packaged hardware appliances (nBox Mini, nBox NetFlow, nBox Recorder) running ntop software for out-of-the-box traffic analysis, flow collection, and continuous traffic recording in enterprise and industrial environments. Sold as turn-key solutions to enterprise and industrial buyers.
• nAnalyst AI-based network analysis tool that explains network behavior using natural language. Built with Alibaba Qwen LLM, it provides intelligent insights into network traffic patterns and anomalies. Targeted at network operators, SOC teams, and IT managers seeking AI-augmented troubleshooting.
• ntopng MCP Server Model Context Protocol server that exposes ntopng network data and tools to AI assistants for headless security operations, live host stats queries, ClickHouse flow queries, and automated security investigations. Targeted at SOC teams and developers integrating AI workflows into network monitoring.

Quantifiable outcome

• Reduces physics-based AI design optimization from weeks/months to hours (in the context of Luminary Cloud integration)
• +1 more outcomes

Segments3 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration10 records

AI capability6 records

Feature11 records

Partnerships

Three partnerships are on record, tiered core.

• Jupiter TechnologycoreChannel Partner/ Reseller/ Distributor · 1 June 2026Jupiter Technology is ntop's trusted partner in Japan, supporting the hosting of a specialized seminar during Interop Tokyo 2026. The partnership enabled a completely sold-out seminar session where ntop presented its core ecosystem and upcoming roadmap to a packed audience.
• NapatechcoreTechnology or IntegrationNapatech, a leading supplier of network analysis adapters, collaborates with ntop on accelerating time-to-market for high-performance network management and security appliances. The collaboration includes a 10 Gbps capture-to-disk solution demonstrated at RSA and Mobile World Congress, integrating Napatech SmartNICs with ntop's PF_RING and nProbe Cento for hardware-accelerated flow processing.
• Alibaba QwencoreStrategic or Co-development PartnerAlibaba Qwen team supported ntop in developing nAnalyst, ntop's first AI-based network analysis tool. The collaboration was conducted through a joint webinar where nAnalyst was previewed, and beta testing started June 22 with general availability planned for September.

Scale indicators4 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• Wireshark: The dominant open-source packet analyzer. Overlaps with ntop in traffic analysis and forensics workflows and is explicitly listed as an integration partner for nTap, making it a directly comparable network visibility tool.
• Plixer International: Flow-based network monitoring vendor that has been a ntop partner since 2010 (Scrutinizer 7.7 with nProbe support). Competes in the same flow analytics and NetFlow/IPFIX collection category.
• Paessler (PRTG Network Monitor): Commercial network monitoring suite with bandwidth, traffic, and infrastructure monitoring use cases overlapping directly with ntopng. Targets similar mid-market and enterprise IT teams.
• Kentik: Network observability platform for ISPs and enterprises offering flow analytics, DDoS detection, and traffic intelligence — directly comparable to nProbe Cento + ntopng for service-provider use cases.

Broad incumbents

• NetScout Systems: Established vendor of packet-based network performance management and cybersecurity solutions. A much larger incumbent competing in the same enterprise NPM and DDoS mitigation space where ntop operates.
• Cisco (ThousandEyes / Stealthwatch): Cisco's network visibility portfolio (ThousandEyes for digital experience, Stealthwatch for security analytics) competes broadly with ntop's enterprise monitoring and threat detection offerings, with vastly greater sales reach.
• SolarWinds: Broad IT monitoring vendor with NPM, NetFlow analysis, and security modules that overlap with ntopng and nProbe functionality for enterprise IT operations.
• ManageEngine (Zoho): Wide portfolio of IT management tools including network monitoring that compete for the same enterprise IT budget as ntop, particularly at the mid-market.

Emerging players

• Catchpoint: Network observability and digital experience monitoring vendor with overlapping Internet and enterprise path analytics use cases, often compared alongside ntop for ISP-grade visibility.

Others

• Napatech: SmartNIC and FPGA-based packet capture hardware vendor that is both a technology partner (PF_RING / nProbe Cento integration) and an adjacent infrastructure provider enabling 100+ Gbps monitoring — relevant from a hardware-acceleration ecosystem perspective.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks7 records

Key highlights7 records

Customer concentration

• GitHubgithub.com/ntop
• YouTubeyoutube.com/@ntopdotorg/videos
• Xx.com/ntop_org

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Ntop