ntop is a network probe that shows network usage in a way similar to what top does for processes. In interactive mode, it displays the network status on the user's terminal. In Web mode, it acts as a web server, creating a HTML dump of the network status. It sports a NetFlow/sFlow emitter/collector, a HTTP-based client interface for creating ntop-centric monitoring applications, and RRD for persistently storing traffic statistics.
ntop is available for both Unix and Win32-based platforms. It has been developed by Luca Deri, an Italian research scientist and network manager at University of Pisa.
Common usage on linux system is to start the ntop daemon (/etc/init.d/ntopd start), then one can use the web interface to ntop via visiting http://127.0.0.1:3000 provided the loopback device has been started (/etc/init.d/net.lo start) and the listening port for ntop is 3000 (look out for the -w option in ps aux | grep ntop).
Open Source in Network Administration: the ntop Project
High-Speed Passive Packet Capture and Filtering
Open Source VoIP Traffic Monitoring
Effective Traffic Measurement using ntop
ntop: Beyond Ping and Traceroute
ntop @ SourceForge
ntop @ Freshmeat
Berry Linux Wikipedia