ntopng can use a criterion to disaggregate incoming traffic. When a disaggregation criterion is selected, ntopng will use the criterion value to divert incoming traffic to dynamically-created interfaces. For example, when the 'VLAN Id' criterion is selected, a dynamic interface will be created for each VLAN Id observed, and the incoming traffic will be diverted to one dynamic interface depending the VLAN Id value.

'VLAN Id' disaggregation is supported both for physical interfaces as well as for flows received over ZMQ. The other disaggregation criteria are only supported for ZMQ flows and will be ineffective for physical interfaces.

A custom traffic disaggregation by means of BPF-like filters is also available by disabling Dynamic Traffic Disaggregation (set it to 'None') through the Custom Traffic Disaggregation tab.

Criterion changes will not affect existing interfaces. A restart of ntopng is required for the change to have effect.