ntopng

ntopng (the next-generation version of the classic 'ntop') is a highly specialized, fiercely open-source, network traffic probe. While tools like PRTG tell you if a server is online or offline, ntopng sits entirely on the network layer acting as a hyper-advanced packet sniffer. It literally reads the data flowing through the cables in real-time. It is heavily favored by hardcore network security engineers because of its deep Layer-7 (Application Layer) inspection. It doesn't just tell the admin "Port 443 is using 500 Megabits." It looks inside the packets and says, "500 Megabits are being used, and specifically, 400 Megabits of that is Netflix streaming, 50 Megabits is BitTorrent, and 50 Megabits is WhatsApp." Because it operates as a probe, it is incredibly lightweight and fast. It is frequently installed on incredibly cheap hardware (like a Raspberry Pi or a low-end Linux box), plugged into a network "Mirror Port" (SPAN port), and left to silently monitor and categorize all traffic flowing into the entire building, making it a favorite tool for finding rogue devices or malware beaconing out to the internet.