ntopng in Docker
Running ntopng in a container keeps your traffic analyzer off the firewall and on a host you can actually size for it — more RAM, real disk for historical timeseries, and clean upgrades by pulling a new image. This guide deploys the official ntop/ntopng image with Docker Compose alongside its required Redis backing store, covers the one networking trick that makes or breaks packet capture in a container, and persists data across restarts so you don't lose your history.
| Requirement | Notes |
|---|---|
| Docker + Compose | Docker Engine and the Compose v2 plugin on a Linux host |
| A host that sees the traffic | ntopng can only analyze packets it can capture — see the note below |
| Disk for history | ntopng writes timeseries to /var/lib/ntopng; give it real storage, not a ramdisk |
network_mode: host. Even then, a normal NIC only sees traffic to and from the host itself unless it's in promiscuous mode fed by a SPAN/mirror port. To watch an entire LAN, feed ntopng from a switch mirror port or from flow data (section 06).ntopng captures on a named interface, so you need the real device name on the host (not a Docker veth). List them first.
Note the interface that carries the traffic you care about — typically the host's primary NIC, or a second NIC connected to a switch mirror port. You'll pass this name to ntopng with -i.
ens33 or enp3s0 are common on modern systemd distros; USB NICs show up as long enx<mac> names. Copy the exact string — ntopng will silently capture nothing if the interface name is wrong.Two services: Redis (required state store) and ntopng. Both use host networking so ntopng can reach the real interface and Redis is reachable on localhost. Data directories are bind-mounted so nothing is lost on restart.
| Flag | Meaning |
|---|---|
| --community | Run the free Community edition (no license needed) |
| -i eth0 | Interface to capture on — replace with your real device name |
| -r 127.0.0.1:6379 | Redis host:port (localhost works because of host networking) |
| -w 0.0.0.0:3000 | Bind the web UI to all addresses on port 3000 |
| -d /var/lib/ntopng | Data directory (mapped to a persistent volume) |
| -m "192.168.1.0/24" | Your local networks, so ntopng knows local vs remote hosts |
-i interface name, the -m local-network CIDR(s) to match your LAN, and the volume paths if you want them somewhere other than ./data. Leaving -i eth0 on a host whose NIC is ens33 is the most common reason nothing shows up.Make the persistent directories first (ntopng runs as a non-root user inside the container and needs to write to them), then bring the stack up.
NTOP_UID / NTOP_GID environment variables to match the container user to your host directory ownership — a tidier alternative to chmod 777 if you'd rather not loosen permissions.Open the web UI in a browser, pointing at the host running the container:
After logging in you'll land on the dashboard. If the interface you specified is capturing, live flows and top talkers begin populating within seconds. If it's empty, jump to the troubleshooting table in section 08 — it's almost always the interface name or the capture-visibility problem from section 01.
-w 0.0.0.0:3001 and free up or relocate the conflicting service.A container on one host only sees that host's traffic. To analyze an entire network without a switch mirror port, use the ntop pattern from the firewall guide: run a lightweight nProbe exporter where the traffic is (e.g. on pfSense/OPNsense), and have the containerised ntopng collect those flows over ZMQ.
Here ntopng's -i tcp://... turns the interface into a ZMQ flow collector rather than a packet sniffer. nProbe does the capture at the edge and ships compact flow records, so the ntopng box can sit anywhere on the LAN and be sized for analysis and retention.
| Concern | Handling |
|---|---|
| ntopng data | Persisted via the /var/lib/ntopng volume — timeseries and settings survive restarts |
| Redis state | ntopng keeps configuration in Redis, so persist /data too (the --save directive writes snapshots) |
| Upgrades | docker compose pull && docker compose up -d — volumes carry your data forward |
| Community vs licensed | --community = free edition. For Pro/Enterprise, mount the license read-only: -v /etc/ntopng.license:/etc/ntopng.license:ro |
--community flag.| Symptom | Check |
|---|---|
| Dashboard empty, no flows | Wrong -i interface name? Container not on network_mode: host? |
| Only host's own traffic seen | Normal for a non-mirrored NIC — need a SPAN/mirror port or flow collection (section 06) |
| ntopng exits / restarts | Redis not reachable? Confirm the redis container is up and -r points to it |
| Permission errors on start | Data dirs not writable by the container user — chmod 777 data or set NTOP_UID/NTOP_GID |
[PF_RING] Wrong RING version | Host kernel PF_RING module differs from the image's — ignore for plain capture, or align versions |
| Can't reach UI | Port 3000 in use by another service? Firewall blocking it? Try a different -w port |
| Item | Value |
|---|---|
| Official image | ntop/ntopng (Docker Hub) — tags include stable |
| Required dependency | Redis (persist its /data) |
| Web UI port | 3000 (set with -w) |
| Data directory | /var/lib/ntopng (persist this) |
| Networking | network_mode: host to see real interfaces |
| Free edition flag | --community |
| Default login | admin / admin (change on first login) |
| Whole-LAN capture | SPAN/mirror port, or nProbe → ntopng ZMQ collector |