# Install ntopng with Homebrew, Nix, apt Next generation version of the original ntop. Version 6.6 via Homebrew; verified 2026-06-25. ## Install ```sh sudo av install brew:ntopng ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install ntopng ``` Evidence: local Homebrew formula metadata ### Linux - Nix (92%): ```sh nix profile install nixpkgs#ntopng ``` Evidence: nixpkgs package indexes: pkgs/by-name/nt/ntopng/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Ubuntu apt (92%): ```sh sudo apt install ntopng ``` Evidence: Ubuntu 24.04 LTS package indexes: ntopng from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz ## Package facts - **Package key:** brew:ntopng - **Package manager:** Homebrew - **Package manager page:** - **Version:** 6.6 - **Source summary:** Next generation version of the original ntop - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** GPL-3.0-only - **Source archive:** - **Last updated:** 2026-06-25T13:37:57+02:00 - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - ntopng (cli) - ntopng (alias) ## Dependencies - hiredis - json-c - libmaxminddb - libsodium - mariadb-connector-c - ndpi - openssl@3 - rrdtool - sqlite - zeromq - zstd ## Build dependencies - autoconf - automake - cmake - libtool - pkgconf ## Uses from macOS - curl - expat - libpcap ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 6.6 - Package-manager updated: 2026-06-25 - Local data: ok - Upstream repository: https://github.com/ntop/ntopng - Upstream latest detected: 6.6 (current) ## Project history and usage ntopng is the next-generation branch of ntop's network traffic monitoring line: a web-based traffic and security monitor built for modern multi-Gbit, application-aware networks rather than the late-1990s assumptions of the original ntop. ### Project history ntop's own 2013-05-01 announcement framed ntopng as a restart 15 years after the first ntop release in 1998. The post says the old codebase had become too old, complicated, and bug-prone for newer requirements such as multi-Gbit links, mobile hosts, cloud/decentralized monitoring, and application-protocol visibility. The same announcement identified core design choices that still explain the package: open source, self-contained, Redis-backed caching, nDPI-centered protocol identification, PF_RING support for high-rate capture, C++ implementation, and a real-time monitoring focus. ### Adoption history ntopng sits in the broader ntop ecosystem with nDPI, PF_RING, nProbe, and related commercial/open-source traffic-analysis tools. Its GitHub repository was created on 2015-04-30 and the project is distributed through Homebrew, Linux packages, and ntop's own installation channels. Its adoption is strongest with network operators and homelab or appliance users who want a local web UI for interface traffic, flow collection, host/application visibility, and alerting without building a full observability stack from scratch. ### How it is used Package users generally run Redis, start `ntopng` against one or more interfaces or flow endpoints, then use the web UI on the configured HTTP port. The upstream docs show use as a flow collector with nProbe, hierarchies of ntopng instances, command-line access to REST/Lua endpoints, separate Redis database IDs for multiple local instances, and virtual interface views that aggregate physical interfaces. ### Why package nerds care The package is historically interesting because it is a rewrite born from operational scaling pressure: ntop had the name and user base, but ntopng is where the project adapted to DPI, flow collection, Redis-backed state, and web-first traffic analysis. ### Timeline - 1998: first ntop generation, according to ntop's 2013 ntopng announcement. - 2013-05-01: ntop announced ntopng as a new-generation replacement direction. - 2015-04-30: GitHub repository created. ### Related projects - ntop - nDPI - PF_RING - nProbe - n2disk ### Sources - - - - - - ## Security Notes narrow executable package without higher-risk signals. - **Geiger risk:** green / low - narrow executable package without higher-risk signals ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Linux: /etc/ntopng/ntopng.conf, /etc/ntopng/ntopng.start ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** ntopng - **Version Scheme:** 0 - **Revision:** 1 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Nix - ntopng: normalized package name match | nixpkgs package indexes: pkgs/by-name/nt/ntopng/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Ubuntu apt - ntopng - 5.2.1+dfsg1-1ubuntu4: normalized package name match | Ubuntu 24.04 LTS package indexes: ntopng from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | High-Speed Web-based Traffic Analysis and Flow Collection Tool | http://www.ntop.org/products/ntop/ - Ubuntu apt - ntopng-data - 5.2.1+dfsg1-1ubuntu4: normalized package name match | Ubuntu 24.04 LTS package indexes: ntopng-data from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | High-Speed Web-based Traffic Analysis and Flow Collection Tool (data files) | http://www.ntop.org/products/ntop/ - Ubuntu apt - ntopng-doc - 5.2.1+dfsg1-1ubuntu4: normalized package name match | Ubuntu 24.04 LTS package indexes: ntopng-doc from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | High-Speed Web-based Traffic Analysis and Flow Collection Tool (documentation) | http://www.ntop.org/products/ntop/ ## Related links - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Web development packages](https://www.automicvault.com/pkg/web-dev-tools/) - Matched web development metadata. - [Homebrew utility packages](https://www.automicvault.com/pkg/brew-utility-packages/) - Matched Homebrew package provider. - [libmaxminddb](https://www.automicvault.com/pkg/brew/libmaxminddb/) - Runtime dependency declared by Homebrew. - [mariadb-connector-c](https://www.automicvault.com/pkg/brew/mariadb-connector-c/) - Runtime dependency declared by Homebrew. - [ndpi](https://www.automicvault.com/pkg/brew/ndpi/) - Runtime dependency declared by Homebrew. - [openssl@3](https://www.automicvault.com/pkg/brew/openssl-3/) - Runtime dependency declared by Homebrew. - [rrdtool](https://www.automicvault.com/pkg/brew/rrdtool/) - Runtime dependency declared by Homebrew. - [autoconf](https://www.automicvault.com/pkg/brew/autoconf/) - Build dependency declared by Homebrew. - [automake](https://www.automicvault.com/pkg/brew/automake/) - Build dependency declared by Homebrew. - [cmake](https://www.automicvault.com/pkg/brew/cmake/) - Build dependency declared by Homebrew. - [libtool](https://www.automicvault.com/pkg/brew/libtool/) - Build dependency declared by Homebrew. - [fprobe](https://www.automicvault.com/pkg/brew/fprobe/) - Shares av.db curated category or tags: cli, monitoring, network-monitoring, networking, traffic-analysis. - [heartbeat](https://www.automicvault.com/pkg/brew/heartbeat/) - Shares av.db curated category or tags: cli, monitoring, network-monitoring, networking, observability. - [packetbeat](https://www.automicvault.com/pkg/brew/packetbeat/) - Shares av.db curated category or tags: cli, monitoring, network-monitoring, networking, observability. - [sniffer](https://www.automicvault.com/pkg/brew/sniffer/) - Shares av.db curated category or tags: cli, monitoring, network-monitoring, networking, traffic-analysis. - [sniffnet](https://www.automicvault.com/pkg/brew/sniffnet/) - Shares av.db curated category or tags: cli, monitoring, network-monitoring, networking, traffic-analysis. - [bmon](https://www.automicvault.com/pkg/brew/bmon/) - Shares av.db curated category or tags: cli, monitoring, network-monitoring, networking. - [bwm-ng](https://www.automicvault.com/pkg/brew/bwm-ng/) - Shares av.db curated category or tags: cli, monitoring, network-monitoring, networking. - [cloudprober](https://www.automicvault.com/pkg/brew/cloudprober/) - Shares av.db curated category or tags: cli, monitoring, networking, observability. ## Combined YAML source View the package source record on GitHub. [combined/ntopng.yml](https://github.com/automic-vault/db/blob/main/combined/ntopng.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph