I would take ntop with a large grain of salt. I have had it running on my main Linux box behind an ADSL router/firewall. The traffic this box sends to many Internet destinations (my ISP, www.google.com, etc) is all misclassified as traffic to a web site that I connected just after restarting ntop. IE, my default router is named www.mirror.ac.uk...ntop ? http://www.ntop.org/
from luca deri http://ntop.org/