ntopng

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet and subnet in the target region.

Standard_B2s (2 vCPU, 4 GiB RAM) is a sensible starting size. Size up for busier links or larger flow volumes.

In the network security group, allow inbound 22/tcp from your management network and 3000/tcp for the web UI. Port 3000 serves the administrative interface, so restrict 3000/tcp to trusted networks and place TLS in front of it for encrypted access.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for ntopng by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22), then add a custom rule for 3000. Review the defaults, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms once per subscription, then create the VM:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:ntopng-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name ntopng \
  --image sac1647283583153:ntopng-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open the web UI port:

az vm open-port --resource-group <your-rg> --name ntopng --port 3000 --priority 900

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that Redis and ntopng are active.

ntopng requires Redis as its backing store, so both run as enabled systemd units. ntopng listens on port 3000 and Redis on loopback port 6379. Check the services, then the listening ports:

systemctl is-active redis-server ntopng ntopng-firstboot

sudo ss -tlnp | grep -E ':3000 |:6379 ' | awk '{print $1, $4}'

Step 4 - Retrieve your per-VM admin password

The SecureAnyCloud image ships with no usable login. On the first boot of every VM, ntopng-firstboot.service generates a unique administrator password, stores it in Redis and records it in a root-only credentials file. Read the file with sudo:

sudo cat /root/ntopng-credentials.txt

The file records the username (admin), the generated password, the port and the URL for this VM's own address.

Keep the file safe. You can change the password from the UI after you sign in.

Step 5 - Sign in to the traffic dashboard

Browse to http://<vm-public-ip>:3000/ and sign in as admin with the password from the credentials file.

ntopng opens on its traffic dashboard. It shows top flow talkers, top local and remote hosts, top applications and a live traffic classification, all updating in real time from the monitored interface.

Step 6 - Explore the host inventory

Open Hosts from the left navigation to see every host ntopng has observed on the monitored interface. Each host shows its traffic totals, throughput, the applications it uses and an activity breakdown.

Select any host to drill into its flows, ports, protocols and historical activity.

Step 7 - Inspect live flows with Layer-7 detection

Open Flows to watch active connections in real time. Each flow shows the client and server, the Layer-7 application detected by nDPI (for example TCP:SSH or TCP:HTTP), a risk score, duration and throughput.

Use the filters at the top to narrow the list by host, protocol, application or traffic type.

Step 8 - Review interface statistics

Open Interface to see the monitored interface's overall statistics: packet and byte counters, traffic distribution by protocol, throughput over time and interface-level charts.

This is the top-down view of everything crossing the interface that ntopng is watching.

Step 9 - Verify the stack

Check the installed ntopng community version, the build that the binary reports, and that the Redis backing store answers:

dpkg-query -W -f='${Version}\n' ntopng

ntopng --version | head -3

redis-cli ping

Step 10 - Confirm the secure-by-default login

You can prove from the command line that only your per-VM credential works and that the stock admin / admin login has been disabled. Test both logins against the ntopng REST API.

The per-VM password authenticates and returns 200. The default admin / admin is rejected and redirects to the login page (302):

curl -s -o /dev/null -w 'per-VM admin -> HTTP %{http_code}\n' -u 'admin:<ADMIN_PASSWORD>' http://127.0.0.1:3000/lua/rest/v2/get/ntopng/interfaces.lua

curl -s -o /dev/null -w 'default admin/admin -> HTTP %{http_code}\n' -u admin:admin http://127.0.0.1:3000/lua/rest/v2/get/ntopng/interfaces.lua

Step 11 - Choose the monitored interface (optional)

By default, ntopng monitors the VM's primary network interface. To change which interface or interfaces it watches, edit /etc/ntopng/ntopng.conf (the -i= line), then restart the service:

sudo systemctl restart ntopng

To collect flows exported by other devices instead of, or in addition to, live capture, add a collector interface such as -i=tcp://0.0.0.0:6343 for sFlow or a zmq endpoint. Open the corresponding port in the network security group.

Security notes

• The web UI serves on port 3000 over plain HTTP. Restrict 3000/tcp in the network security group to trusted networks, place a reverse proxy with TLS in front of it for encrypted access, and consider putting the UI behind your own VPN.
• The image ships with no usable login. A unique admin password is generated on first boot and stored in the root-only file /root/ntopng-credentials.txt, and the stock admin / admin login is disabled. Change the password from the UI after your first sign-in, and create additional per-user accounts as needed.
• ntopng captures traffic on the interface it monitors. Deploy it where it can see the traffic you care about (for example a mirrored or SPAN port, or as a flow collector), and consider the privacy implications of packet inspection on your network.
• Keep the VM patched. The image is patched at build time and ships with unattended security upgrades enabled.

Support

SecureAnyCloud provides 24/7 support for this image. For questions about ntopng or help with your deployment, contact us through the SecureAnyCloud website.

Deploy on Azure

Launch ntopng on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Secure by default - no shipped credentials

A stock ntopng ships with the well-known default administrator login admin / admin. This image locks that out: the shipped AMI has no working default login.

On its first boot, each instance generates a unique administrator password, stores its hash in redis and writes the plaintext to a root-only credentials file at /root/ntopng-credentials.txt. No shared password exists in the image, and admin/admin is rejected.

Connecting to your instance

Connect over SSH on port 22 using the default login user for your operating system variant and the EC2 key pair you launched with.

• Ubuntu 24.04: the SSH login user is ubuntu. Example: ssh -i your-key.pem ubuntu@<instance-public-ip>

Replace <instance-public-ip> with your instance's public IPv4 address, or its private address if you reach it over a VPN or Direct Connect.

Open these ports in the instance's security group:

• Port 22 (TCP): SSH administration
• Port 3000 (TCP): ntopng web UI (HTTP)

Restrict port 3000 to trusted source ranges and put the UI behind TLS (see Putting the UI behind HTTPS).

Retrieve your administrator password

The unique per-instance password is written to a root-only file. Read the file over SSH:

sudo cat /root/ntopng-credentials.txt

The file looks like this:

# ntopng community — Per-instance Credentials ADMIN_USER=admin ADMIN_PASSWORD=<set-at-first-boot> PORT=3000 NTOPNG_URL=http://<instance-public-ip>:3000

Copy the ADMIN_PASSWORD value. You use it to sign in.

First sign-in

Open the ntopng web UI in your browser:

http://<instance-public-ip>:3000/

The ntopng login page opens. Sign in as admin with the password from the credentials file.

After you sign in, change the administrator password from Settings > Preferences > Manage Users. Create additional per-user accounts rather than sharing the admin login.

The traffic dashboard

The dashboard opens on the Traffic view. It summarises the monitored interface in real time: top flow talkers, top hosts (local and remote), top applications and a traffic classification breakdown.

The interface selector at the top left shows which NIC ntopng is monitoring, along with live throughput. First boot selects the instance's primary interface automatically.

Hosts

The Hosts view lists every active host ntopng has seen. Each host shows its flow counts, alert scores, geolocation, a sent and received traffic breakdown, and throughput.

Click any host to drill into its ports, peers, protocols and historical activity.

Flows and Layer-7 detection

The Flows view shows live flows with their source and destination, their ports and the nDPI Layer-7 application or protocol label for each flow (HTTP, TLS, GitHub and hundreds more). This classifies traffic by the actual application, not just the port number.

Use the filters at the top to narrow flows by protocol, application, host, status or AS number.

Collecting NetFlow, sFlow and IPFIX

Beyond monitoring its own interface, ntopng can aggregate flows exported by your routers, switches and firewalls. Point your exporters at the instance and add a flow-collection interface.

A common pattern uses ntop's nprobe collector feeding ntopng over ZMQ. For a quick start, ntopng can also open a collector interface directly. See the ntopng documentation for the collector setup that matches your exporter.

Open the exporter's UDP port in the security group and restrict it to your network devices.

Managing the services

Two systemd units run the stack:

# Check status systemctl status ntopng redis-server
# Which ports are listening (3000 = ntopng UI, 6379 = redis on loopback)
sudo ss -tlnp | grep -E ':3000|:6379'
# Restart ntopng (or redis)
sudo systemctl restart ntopng
sudo systemctl restart redis-server

ntopng depends on redis, so a systemd drop-in orders ntopng.service to start after redis-server.service. redis binds only to the loopback interface (127.0.0.1:6379) and is not reachable from the network.

The monitored interface and web port are configured in /etc/ntopng/ntopng.conf. To monitor a different interface or change the port, edit that file and restart ntopng.

The data volume

ntopng's data directory is a dedicated EBS volume mounted at /var/lib/ntopng, separate from the operating system disk:

df -h /var/lib/ntopng

Because it is a separate volume, you can snapshot it, encrypt it with EBS encryption at rest, and resize it independently of the root volume. The mount is recorded in /etc/fstab by filesystem UUID, so it survives reboots and relaunches.

Putting the UI behind HTTPS

ntopng serves plain HTTP on port 3000. Terminate TLS in front of it with a reverse proxy. A minimal nginx example:

server { listen 443 ssl; server_name your-domain.example.com; ssl_certificate /etc/letsencrypt/live/your-domain.example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/your-domain.example.com/privkey.pem; location / { proxy_pass http://127.0.0.1:3000; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; } }

Install nginx and certbot, then obtain a certificate with certbot --nginx -d your-domain.example.com.

Restrict port 3000 to loopback by binding ntopng with -w=127.0.0.1:3000 in /etc/ntopng/ntopng.conf, and expose only port 443 in the security group.

Upgrading ntopng

ntopng is installed from the official ntop apt-stable repository, so it upgrades with the rest of the system:

sudo apt-get update
sudo apt-get upgrade ntopng ntopng-data
sudo systemctl restart ntopng

Support

SecureAnyCloud provides 24/7 technical support for this image by email and live chat. Support covers deployment, upgrades, reverse-proxy and TLS termination, and flow-collector configuration.

• Email: sales@secureanycloud.com
• Live chat: available 24/7

ntopng is released under the GNU General Public License v3 (GPLv3) and is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of these names does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch ntopng with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com