ntopng VS goflow2

and use software: https://www.ntop.org/

InfluxDB 2.0 Support (ntopng github)

For what it's worth, there used to be a package in many Linux repositories called "ntop" [1] but became less popular when they went commercial. There is still a community version but I have no idea how popular it is any more. It was quite popular prior to projects like PiHole. Perhaps the older ntop has fallen out of favor so maybe there won't be any confusion.

[1] - https://www.ntop.org/

Have you seen https://github.com/ntop/ntopng?

NTOP -- Traffic Analysis.

One of the comments suggests using a managed switch that supports port mirroring, and installing a Flow collector on the connected system. Google netflow collector for software options. Something like ntop may work. See... HowTo Monitor Traffic in SMEs and Home Networks: A Primer

What can I do to implement GeoIP support into ntopng? The instructions I found on the internet (e.g. https://github.com/ntop/ntopng/blob/dev/doc/README.geolocation.md) did not seem to fit the case.

I use goflow2 to do something like this. I don't specifically use syslog itself for this, but mtail to generate the metrics.

I've been using this one: https://github.com/netsampler/goflow2

Take a look at goflow2 which is based on Cloudflare's flow analysis pipeline.

I'm not particularly familiar with netflow formats, but this collector emits Prometheus metrics.

GoFlow2 is a high-performance sFlow/IPFIX/NetFlow collector that gathers network information and serializes it in a common format. This fork of CloudFlare's GoFlow provides horizontal scalability, consistent format and the ability to work with raw samples and build aggregation and custom enrichment. Our thanks for this suggestion goes to SuperQue.

You want something like goflow2.

There's goflow2, which is a fork of CloudFlare's goflow netflow collector.

I'd suggest looking at goflow2 before you write something new.

I personally use goflow2, but my needs are pretty simple.