ntopng VS Fog

and use software: https://www.ntop.org/

InfluxDB 2.0 Support (ntopng github)

For what it's worth, there used to be a package in many Linux repositories called "ntop" [1] but became less popular when they went commercial. There is still a community version but I have no idea how popular it is any more. It was quite popular prior to projects like PiHole. Perhaps the older ntop has fallen out of favor so maybe there won't be any confusion.

[1] - https://www.ntop.org/

Have you seen https://github.com/ntop/ntopng?

NTOP -- Traffic Analysis.

One of the comments suggests using a managed switch that supports port mirroring, and installing a Flow collector on the connected system. Google netflow collector for software options. Something like ntop may work. See... HowTo Monitor Traffic in SMEs and Home Networks: A Primer

What can I do to implement GeoIP support into ntopng? The instructions I found on the internet (e.g. https://github.com/ntop/ntopng/blob/dev/doc/README.geolocation.md) did not seem to fit the case.

I heard about devbox [1] but I haven't tried it yet. Perhaps it could suit your needs.

Back in the day I used "Norton Ghost" to create a full image of a just-installed windows just in case I needed to go back in time. Windows includes a snapshot feature built-in but I did not really trusted it. These days you can use a "sysprep" tool [2] to create a similar system snapshot. Make a partition and keep everything you don't want deleted on drive D: or something :-).

--

1: https://www.jetpack.io/devbox

2: like https://www.ntlite.com or https://fogproject.org

For provisioning the machines base image consider FOG it uses PXE and can remotely provision dozens of machines using multicast.

Same. We set up 1 device how we want to, then use FOG to clone the other devices

With standard computers, I usually deploy something like the fog project and automate the process over pxe with scheduled reboots. I guess you could do that as well with your VMs but that seems overkill.

you could setup a PXE server and automate installs. you could also clone them and reapply the image as needed. https://fogproject.org/ or lookup CloneZilla both are open source

Free: https://fogproject.org/ or https://clonezilla.org/

Microsoft used to have a free tool called SteadyState to do this, but it's been discontinued for a while. It took a different approach of undoing changes rather than restoring from image but it worked great with Kiosk mode. There are remote management tools that can wipe and reimage managed machines, most of them don't require an AD domain. As an example FOG Project.