ntop definitely has the data, what it lacks is the user interface to present it the way I need it. It is possible the paid version might have something, but I can find nothing in the user manual (which includes paid version details).
Of course, since it is open source I guess I could try to add what I need … but not sure if I have the necessary skills, and I definitely don't have the time at the moment. The only other alternative would appear to be to export its totals and collate them in some other package.
I discovered another complication. It looks like lightSquid's "day" is (if you update every hour) is actually 23:00..22:59 (the update they run at midnight goes into the next day (despite the fact that it is obviously counting traffic from the previous day). So it just gets harder and harder to compare figures. (My network is small enough I could probably run lightsquid's update more often and reduce the problem.)
Deleting ntopng data just before midnight (disable the service, hit the delete data button, restart the service, then restart it again before it will actually work) clears most of its history (but not traffic totals). And using this I've been able to see that ntop's totals come close enough to the "Traffic Totals" package, both of which are close to the ISP totals for the day.
Without having collected the history going back to December or early January I cannot see for certain what has blown out in my network use, but since ntop's "Facebook" application is something like 40% to the total I am guessing it must be a significant part of it (none of the other totals are large enough to hide the approx 300MB a day that the traffic has increased - up from around 700MB/day to 1000MB/day).
So ntopng has helped (or offers hints), it's just a shame it doesn't offer consistent, comparable historical analysis from its current user interface.
