How to See What's Using Your Bandwidth with ntopng (Which Device, Which Site, Right Now)
"The internet's slow" is unanswerable without seeing the traffic. Netdata (66) shows the server's interface; Pi-hole (34) shows DNS names, not volumes. ntopng is a traffic analyser: every host on the network, what protocol (Netflix, Teams, BitTorrent, Windows Update), how much, to where, live and over the last week. The one catch is that the server has to see the traffic — which on a switched network takes a mirror port, a router that exports flows, or running the analyser on the router itself.
Quick reference
| Task | What |
|---|---|
| Container | ntop/ntopng with host networking, interface enp3s0 |
| Web | http://server-ip:3000 — admin / admin (change it) |
| Seeing all traffic | a mirror/SPAN port on a managed switch → a second NIC on the server |
| Or | NetFlow/sFlow from the router → nprobe (licensed) or the router's own ntopng (OpenWrt/OPNsense packages) |
| Minimum | the server's own traffic plus anything that goes through it (VPN, NFS, Samba) |
| History | timeseries in ./data — RRD by default, InfluxDB optional |
1. The compose file
mkdir -p ~/docker/ntopng/data && cd ~/docker/ntopng
nano compose.yaml
services:
ntopng:
image: ntop/ntopng:stable
container_name: ntopng
network_mode: host
command: --interface enp3s0 --http-port 3000 --data-dir /var/lib/ntopng --community --local-networks 192.168.1.0/24,192.168.20.0/24
volumes:
- ./data:/var/lib/ntopng
cap_add:
- NET_ADMIN
- NET_RAW
restart: unless-stopped
Change enp3s0 to the interface to watch (ip link). --community is the free edition; --local-networks tells it which addresses are "inside".
docker compose up -d
sudo ufw allow from 192.168.1.0/24 to any port 3000 proto tcp
Open http://192.168.1.50:3000, log in admin/admin, change the password.
2. What you see straight away
With just the server's own NIC, ntopng sees everything to and from the server: who's streaming from Jellyfin, which backup client is pushing, the VPN's throughput, the Nextcloud sync that's eating the upload. Hosts lists every address with bytes in/out; click one for its Flows (connections), Applications (nDPI's protocol detection: YouTube, SSH, DNS, WireGuard…) and Traffic over time.
If Pi-hole is also the DHCP server (144), ntopng shows hostnames instead of IPs.
3. Seeing the whole LAN
Three routes, best first:
A mirror port. On a managed switch (UniFi, Omada, Netgear "Plus", MikroTik), mirror the port that connects to the router onto a spare port; plug that into a second NIC on the server (a £10 USB gigabit adapter is fine). Add --interface enp3s0,enx001122334455 to the command; ntopng now sees every packet the LAN sends to or from the internet. Wi-Fi clients included — their traffic goes through the same uplink.
The router runs ntopng. OpenWrt and OPNsense have it as a package; it sees everything natively, and sends nothing to the server. Fine if the router has the CPU.
Flows from the router. NetFlow/sFlow/IPFIX exported by the router to a collector — ntop's nprobe needs a licence; the free alternative is Akvorado or goflow2 → Grafana (90) for flow-level accounting without full packet visibility.
4. Answering the question
- Who, right now: Hosts sorted by throughput. The TV at 20 Mbps up is telemetry or a firmware upload; the laptop at 80 Mbps up is OneDrive.
- What: click the host → Applications. BitTorrent on the kids' PC; Windows Update at 3 pm on everything; Unknown to a strange IP from the IoT VLAN is worth a look (143).
- To where: Flows → remote host and country. The smart plug talking to a cloud at 3 am is normal; the camera streaming 2 Mbps out constantly is not.
- When: the timeseries per host over the week; the nightly spike is the backup (23) — as it should be.
Alerts (the bell) can flag a host exceeding a threshold, a new device appearing, or a flow to a blacklisted address — into the same ntfy/Telegram pipeline via a webhook.
5. Keep it polite
ntopng sees everyone in the house's traffic. Tell them. Keep it LAN-only, behind the password, and don't keep more history than you need (--retention / ./data size). It's a diagnostic tool, not a surveillance one.
Troubleshooting
Only the server's traffic shows. Expected without a mirror port or router-side flows; see step 3.
Second NIC shows nothing. The switch mirror isn't configured, or the NIC needs promiscuous mode (ntopng sets it; check ip link shows PROMISC).
Hostnames are just IPs. DNS reverse lookups off (Settings → Preferences), or Pi-hole isn't the DHCP/DNS so there are no names.
High CPU. A mirror of a gigabit uplink with nDPI on every packet is work; a mini PC copes, a Pi doesn't — use flow export there.
Wrapping up
One container on the server's NIC for its own traffic, a mirror port and a second NIC for the whole house. Hosts, applications, destinations and a week of history answer "why is it slow" in a minute — and show you which devices talk to whom when nobody's watching.
