Is JA4 Now Obsolete?
JA4 is a modern network fingerprinting standard used to identify and profile clients initiating encrypted TLS (Transport Layer Security) connections. JA4 it is the successor to the widely used but now deprecated…
Author: admin
- Home
- Articles by: admin
ntop Winter Webinar: ntopng 6.6 and New ntop Software Releases
Last week, we released a new release of the ntop tools: ntopng 6.6, nProbe 11.0, nDPI 5.0, Cento 2.4, PF_RING 9.2, and nScrub 1.8. As we have implemented many new features, including…
ntop License Sizing Guide
A popular question we receive from users is the type of ntop license that should be used in projects. Below we try to answer this question to ease your choice. Packet Processing…
HowTo Dump Collected Flows and nTap Packets with nProbe
When nProbe collects data (both sFlow/NetFlow/IPFIX and nTap), it immediately discards collected data after processing. However sometimes it is useful to dump such data. A typical use-case include: nProbe collects packets sent…
HowTo Measure the Status and Performance of Network Flows
NetFlow has been originally designed to monitor network traffic using simple bytes/packets metrics. For TCP, it is also possible to know what TCP flags (that indicate the connection state) have been used…
How ntop Accelerated Network Telescope at Georgia Tech
If you are wondering what is a network telescope and how ntop tools have been used in research, we're pleased to publish a guest post from Prof. A. Dainotti that describes the…
Debian/piOS 13 and RedHat 10 ntop Packages Now Available
This is to announce that we build packages for new platforms: Debian 13 (x64) rPI OS 13 (Raspberry, ARM) RedHat 10 (x64) family including RockyLinux and AlmaLinux As usual you can: read…
Flow Direction Swapping Explained
A flow is a set of traffic packets sharing the same tuple (IP src, IP dst, port src, port dst, protocol, VLAN, ...). When a flow is observed from the beginning, the…
Simplifying Packages Installation with ntop-installer
Depending on your Linux distribution, you can install ntop packages using your platform packager (apt on Debian/Ubuntu and yum/dnf on RedHat/RockyLinux). Some users asked us a simplified installation tool, for networkers not…
When SNIs Cannot be Trusted
SNI (Server Name Indication) is an optional extension in TLS/QUIC that contains the symbolic host name we're connecting to. For instance, during the TLS handshake, the SNI allows the server to identify…
Announcing ntop Professional Training: November 2025
ntop tools range from packet capture, traffic analysis and processing, and sometimes it is not easy to keep up on product updates as well master all the tools. This has been the…
AS Traffic Observability using ntopng
Since the first version of our tools, we have focused on packets. Having access to packets is a privilege that is not always possible; observing packets provides high-detailed information. At the edge…
