In my experience, ntop is only useful for diagnosing problems, as you cannot leave it running for too long without it killing your CPU.

ntop brought our 4 core intel machine to a standstill after a few days, it's ment for quick diagnosis but not long term monitoring.

On a side note - I like trafshow much better than ntop, I wish they would have continued developing trafshow instead of converting it into the web-based, memory sucking nightmare that is ntop.

Just MHO. Have you had success running ntop for longer than a few days?

While this won't track URL's, we use Argus for tracking bandwidth/host usage.

It's got a nice client interface to insert data into MySQL, damn near real-time, I can pull accurate reports within 30 seconds. Unfortunately the MySQL feature is kinda new & there's no really good web interfaces.

Not really an out of the box solution either, but it's free & if you're familiar with MySQL and web development, you can make a nice reporting interface fairly easily. I whipped one up with jQuery and flot for charting over a weekend, and tied it into our inventory database. It'll show network utilization grouped by the local source, with a count for bytes sent/recv for each remote host. But it's layer 2-4 only, so no URL's are reported.

One of these days I might release my web interface for Argus, but the code needs cleanup and commenting so eh...I wouldn't expect it any time soon.

http://www.qosient.com/argus/

and even one more difference, from TFA:
Organizers said the trio was caught when they took their purloined password prizes to Wall of Sheep workers and asked them to post the information. The workers refused.

So...they turned themselves in.