ntopng vs Flowtriq:
Monitoring vs Mitigation

Back to Blog

We build Flowtriq. This post is not a takedown of ntopng. ntopng is good at what it does. The question is whether what it does is what you need, specifically when it comes to DDoS attacks.

ntopng Is a Traffic Monitor

ntopng excels at real-time traffic visibility. It processes flow data (NetFlow, sFlow, IPFIX) and packet captures to provide detailed analytics: per-host bandwidth usage, protocol distribution, application identification, flow tracking, and historical trends. The web interface is well-designed and gives operators a clear picture of what is happening on their network.

ntopng can detect DDoS-like patterns. Its alert engine identifies traffic anomalies, floods, and behavioral changes that suggest an attack in progress. When these patterns are detected, ntopng generates alerts through its notification framework.

That is where ntopng's job ends. It saw the attack. It told you about it. The mitigation is your responsibility.

ntopng does not apply firewall rules. It does not push FlowSpec to your upstream. It does not trigger RTBH announcements. It does not orchestrate scrubbing center diversion. It monitors and alerts. What happens after the alert is outside its scope.

The Alert-to-Action Gap

ntopng detects suspicious traffic and sends a notification. The operator receives it. Now the manual process begins.

The operator needs to SSH into the affected server or log into the router. They need to evaluate the attack: what type, what volume, what sources, what targets. They need to decide on a response: iptables rules, a blackhole route, a call to the scrubbing provider. They need to implement that response, verify it is working, and monitor for side effects.

Every minute in this gap is service degradation. If the attack is a 1 Gbps UDP flood targeting a game server, those minutes are player disconnections and session drops. If it is targeting an API endpoint, those minutes are failed requests and cascading timeouts in downstream systems.

For a 2-minute attack, the manual response often takes longer than the attack itself. By the time the operator has SSH'd in and started writing iptables rules, the attack is over. The damage is done. The next attack, which may come 20 minutes later or 20 hours later, will play out the same way.

Short, repeated attacks are particularly problematic for monitoring-only tools. Each attack is too brief for a human to respond to, but the cumulative impact on service availability and customer experience is significant. Automated mitigation handles these in seconds. Manual mitigation based on monitoring alerts does not handle them at all.

What Flowtriq Adds

Flowtriq provides detection and automated response in a single agent:

• Faster detection. The agent runs on each server and analyzes traffic per-second. No flow export intervals, no polling delays. Detection happens in 1-2 seconds.
• Automatic kernel-level filtering. When an attack is detected, the agent applies iptables/nftables rules on the server immediately. SYN cookies for SYN floods, rate limiting for amplification, port drops for reflection. The server stays running.
• FlowSpec escalation. If local filtering is not enough, the agent pushes BGP FlowSpec rules to the upstream router. Surgical filtering at the network edge without blackholing.
• RTBH as last resort. Only when the attack saturates the link and surgical filtering cannot handle the volume. Not the default, not the first option.
• Scrubbing orchestration. Webhook and API integrations to activate cloud scrubbing services when the attack exceeds what local and upstream filtering can handle.
• Automatic PCAP capture. Full packet capture starts when the attack is detected, providing forensic data without manual intervention to start the capture.

The detection-to-response time is measured in seconds, not minutes. No human is needed for the initial response. The system handles the attack and notifies the operator after the fact.

ntopng Strengths Worth Acknowledging

ntopng provides capabilities that Flowtriq does not, and those capabilities are genuinely valuable:

• Open source community edition. ntopng Community Edition is free and open source. The barrier to entry is zero for operators who want to try it.
• Broad network visibility beyond DDoS. ntopng is a general-purpose network monitor. It tracks application protocols, host behavior, bandwidth trends, and network topology. For operators who need visibility into all aspects of their network traffic, ntopng provides a much broader view than a DDoS-focused tool.
• Deep protocol analysis. ntopng's nDPI engine identifies applications and protocols at a level of detail that goes well beyond what a DDoS agent needs. If you want to know that 12% of your traffic is Netflix and 8% is Microsoft Teams, ntopng tells you that.
• Historical trending. ntopng stores traffic data over time and provides trend analysis that helps with capacity planning, traffic engineering, and understanding long-term network behavior changes.
• Plugin ecosystem. ntopng's plugin architecture allows community-developed extensions for additional protocol support, alerting integrations, and custom analytics.

For general network monitoring, ntopng provides broader traffic analytics than a DDoS-specific tool. That is not a limitation of Flowtriq; it is a difference in purpose. A DDoS agent should be excellent at DDoS detection and mitigation. A network monitor should be excellent at network monitoring. They are different tools for different jobs.

Using Both

ntopng and Flowtriq are not mutually exclusive. They complement each other well in a network operations stack:

ntopng for general network monitoring: traffic analysis, protocol visibility, bandwidth trending, host behavior tracking, capacity planning. ntopng answers the question "what is happening on my network?"

Flowtriq for DDoS-specific operations: per-server attack detection, automatic attack classification, PCAP capture, automated kernel-level mitigation, FlowSpec escalation, RTBH, and scrubbing orchestration. Flowtriq answers the question "is this server under attack, and if so, what are we doing about it?"

Running both gives you complete network visibility from ntopng and automated DDoS response from Flowtriq. The monitoring layer tells you everything about your traffic. The mitigation layer keeps your servers running when attacks hit.

Pricing

ntopng Community Edition: Free and open source. Solid traffic monitoring with some feature limitations compared to Enterprise.

ntopng Enterprise: Pricing varies by throughput tier. Ranges from roughly $200/year for small deployments to $2,000+ for high-throughput networks. Adds advanced alerting, SNMP support, longer data retention, and additional protocol features.

Flowtriq: $9.99/node/month. Per-server DDoS detection, classification, PCAP capture, and automated mitigation. No throughput tiers, no hidden charges for attack volume.

Both tools are accessible at reasonable price points. The question is whether you need monitoring alone or monitoring plus automated DDoS mitigation. If you already run ntopng and want to add automated DDoS response, Flowtriq layers on top without replacing anything.