ntopng + netflow2ng (MikroTik NetFlow) via Docker Compose

This repository provides a minimal, reproducible Docker Compose setup for collecting NetFlow data from MikroTik devices using netflow2ng and visualizing it with ntopng Community. The intent is to keep the implementation simple and focused on observability, not container networking complexity.

Both services run with network_mode: host to avoid UDP/NAT edge cases and to simplify flow ingestion. This setup was deployed inside a Proxmox LXC running Docker.

Prerequisites

• Docker with the Docker Compose plugin installed
• A host reachable by your MikroTik devices for NetFlow export
• MikroTik devices configured to export NetFlow to this host’s IP address

Repository Structure

.
├── compose.yaml
├── .env.example
├── .gitignore
└── README.md

Quickstart

1. Copy the environment template and adjust it for your environment:

   cp .env.example .env

2. Edit .env and update:

   • NTOP_SUBNETS to match your VLANs or routed networks
   • Any input or mode flags as needed

3. Start the stack:

   docker compose up -d

4. Verify containers are running:

   docker ps
   docker logs netflow2ng --tail=50
   docker logs ntopng --tail=50

Configuration Notes

netflow2ng

• NETFLOW2NG_ARGS=--tlv enables TLV support.
• This flag is required for compatibility with newer ntopng versions and avoids the need for a licensed nProbe instance.

ntopng

• NTOP_INPUT defines the input source for ntopng.
  • Default: tcp://127.0.0.1:5556
• NTOP_SUBNETS maps subnets to friendly labels in the UI using the -m flag.
• NTOP_MODE_FLAG=--community ensures ntopng runs in Community mode.

Accessing ntopng

By default, the ntopng web UI is available at:

http://<host-ip>:3000

Stopping the Stack

To stop and remove the containers:

docker compose down

Notes

• On MikroTik CRS devices, NetFlow is only generated for traffic that traverses the CPU. Pure hardware-switched traffic will not appear.
• Host networking is intentional to ensure reliable UDP flow ingestion.
• This setup mirrors enterprise observability patterns in a lightweight home lab environment.

License

This repository is provided as-is. Refer to upstream project licenses for usage terms:

• ntopng: https://github.com/ntop/ntopng
• netflow2ng: https://github.com/synfinatic/netflow2ng