nEdge Lite
Lightweight Layer-7 Traffic Control for Every Network Segment
firewall and probe
netfilter based
flow streaming
The recommendation
Who should choose nEdge Lite
nEdge Lite is a headless, netfilter-based Layer-7 firewall and probe for Linux. Choose it when you need application-level policy on many network segments, with every instance streaming flows to a single ntopng.
- You want to enforce policy between VLANs, in front of IoT devices, at branches and on guest networks.
- You prefer a lightweight daemon driven by JSON policy or by ntopng.
- You want one pane of glass for many enforcement points.
The ideal use case
Ideal use case for nEdge Lite
- Environment: Linux boxes with a couple of NICs in bridge or router mode, IPv4 and IPv6. Data center east-west traffic, school labs, branch offices.
- Team: network and security teams that manage policy centrally in ntopng.
- Technical requirements: Linux with netfilter, NFQUEUE and conntrack. Flows go to ntopng over ZeroMQ, optionally CURVE-encrypted.
- Problem solved: block by protocol, category, country, ASN or pool, with hot reload and no downtime.
Ideal for Every Environment
Deployment scenarios
Enterprise Traffic Enforcement
Block unauthorized applications, social media, P2P file sharing, cryptocurrency mining, gaming and streaming, while keeping business-critical traffic flowing, enforced directly at the network edge or branch office.
Network Micro-Segmentation
Deploy nEdge Lite between VLANs or subnets in a data center or cloud environment to control East-West traffic, enforce application-level policy between security zones, and monitor inter-service communication that a traditional firewall never sees.
Distributed Guest / IoT / Segment Policy
Because instances are lightweight and fan into one ntopng, nEdge Lite is well suited to environments with many enforcement points and one management console: guest Wi-Fi, IoT device networks, school labs, or branch offices, each with its own pool and policy but a single pane of glass.
The alternatives
nEdge Lite alternatives, compared
Same criteria for each option: role, when to choose it, limits and cost.
nEdge
- Role: Full gateway with GUI, bandwidth shaping, multi-WAN and captive portal.
- Choose it when: One chokepoint such as an office or hotel edge.
- Limits: Heavier, one device per edge.
- Cost: Pro 499.95 euro, Enterprise L 999.95 euro
The tradeoffs
When nEdge Lite is not the right choice
- It is not a replacement for nEdge: no built-in GUI, bandwidth shaping, multi-WAN failover or captive portal.
- Central visibility and policy management need ntopng.
- Linux only.
- The product is listed as coming soon: check availability before planning a rollout.
The proof
Specifications, versions, pricing and documentation
Features, supported platforms and protocols, editions with prices, documentation links and answers to common questions follow below.
nEdge Lite vs nEdge
nEdge Lite is not a replacement for nEdge, it’s a complementary, lighter-weight tool. nEdge is a full-featured perimeter gateway appliance with its own web GUI, bandwidth shaping, multi-WAN failover, and captive portal/authentication, built for a single chokepoint like an office or hotel’s Internet edge. nEdge Lite is a headless, netfilter-native application designed to be deployed repeatedly, at every segment, VLAN, or branch that needs Layer-7 enforcement, with all visibility and policy management centralized in ntopng rather than in a per-box GUI. nEdge Lite also provides more flexibility when integrating with pre-existing netfilter-based configurations and appliances.
Make Every Segment of Your Network Enforceable
Modern networks aren’t just protected at the perimeter anymore. Traffic needs to be inspected and controlled between VLANs, in front of IoT devices, at branch offices, and across guest networks. nEdge Lite is built to be dropped into any of those points: it’s a single lightweight binary, driven by JSON policy or by ntopng, that turns any Linux box with a couple of NICs into an application-aware enforcement point.
- See the application, not just the port. nDPI-powered detection identifies hundreds of protocols and applications, including inside encrypted traffic via ETA and behavioral heuristics.
- Enforce policy where the traffic actually is. Deploy as many instances as you have segments, all reporting to one ntopng
- No disruption, no black box. Transparent bridge or router deployment, connection-tracked verdicts, hot-reloadable rules.
nEdge Lite is built on nDPI, the same detection engine used across ntop’s product line, to identify traffic by application and category, not just port number. It recognizes services like Facebook, YouTube, Netflix, Zoom, BitTorrent, and thousands
more, and can flag protocols even when they’re encrypted, using behavioral analysis.
Traffic is matched against JSON-defined policies that combine multiple criteria:
- Protocols: e.g. block BitTorrent, allow SSH
- Categories: Social Networks, Streaming, Gaming, File Sharing, VPN, Remote Access, and more
- Countries and continents: GeoIP-based geographic restrictions
- ASN: block or allow entire provider networks by Autonomous System Number
- Pools: apply different policies to different IP ranges or MAC addresses (e.g. "Guest WiFi" vs "Executive Devices"), with policy inheritance
Layer-7 Deep Packet Inspection and Policy-Based Filtering
Native Netfilter Architecture
nEdge Lite plugs directly into the Linux kernel’s netfilter framework via NFQUEUE: iptables rules hand undecided packets to nEdge Lite, which inspects them, calls nDPI, evaluates policy, and returns a verdict. Once a flow is classified, the decision is written to the conntrack, so the kernel enforces it for the rest of the connection without round-tripping every packet back to userspace.
Policies resolve to a simple marker (pass, drop, etc.), applied at the connection level so every packet in a flow is treated consistently. Labels are also supported, to provide visibility on the application protocol at the kernel level by setting it directly into the conntrack entry.
Multiple netfilter queues can be load-balanced and CPU-pinned for multi-gigabit throughput.
nEdge Lite exports flow data to ntopng in real time over ZeroMQ (compact TLV or human-readable JSON, optionally CURVE-encrypted), so every flow it inspects (including peers, protocol, application, bytes, verdict) shows up live in ntopng’s dashboards, historical views, and alerts.
Policies can be also configured and pushed back from ntopng: define pools and policies in ntopng’s web UI and they propagate to every connected nEdge Lite instance automatically, no restart required. Any number of nEdge Lite agents, on any number of hosts, can report into a single ntopng.
Centralized Visibility with ntopng
at a glance
Key Features
- Layer-7 application and protocol detection via nDPI (450+ protocols), including heuristic detection in encrypted traffic
- Protocol, category, country, continent, and ASN-based policy rules
- Pool-based policy assignment by IP range or MAC address, with policy inheritance
- Bridge mode and single-interface/router mode, with IPv4 and IPv6 support
- Multi-queue, CPU-fanned-out packet processing for multi-gigabit throughput
- Hash-based flow tracking with automatic idle-flow purging
- Hot policy reload via SIGHUP or live push from ntopng: zero-downtime updates
- Real-time flow export to ntopng over ZeroMQ, with optional CURVE encryption
- Multiple instances, on multiple hosts, fanning into a single ntopng for centralized management
- Runs as a lightweight, headless Linux daemon: no dedicated appliance or GUI required on the enforcement node itself
Specifications
Tech Specs
- Linux (netfilter, NFQUEUE, conntrack)
- Centralized policy management via the ntopng web UI
- Flow export and policy push via ZMQ
- CURVE encryption
- JSON policy files (with SIGHUP hot-reload)
- Ethernet
- IPv4/IPv6
- TCP/UDP/ICMP
- 450+ Layer-7 application protocols supported by nDPI
Subject to the EULA terms.
Related
Keep exploring
Pricing and editions
Compare editions and ways to buy.
Solutions
By use case and industry.
User guide
Installation and configuration.
Get started
Ready to see it on your network?
Download the free Community edition of ntopng, compare editions and buy in the shop, or talk to the ntop team about your requirements.
