Flow-Based Traffic Analysis

nProbe™ Cento

100 Gbit NetFlow/IPFIX Probe, Traffic Classifier, and Packet Shunter

nProbe Cento is a high-speed NetFlow probe for 1/10/100 Gbit networks. More than just fast, it forms the foundation of a modular monitoring system. It captures packets, computes flow data, and uses Deep Packet Inspection (DPI) for traffic classification. Combined with tools like IPS/IDS or traffic recorders, it can forward selected packets and flows for advanced analysis and security.

Expand Your NetFlow Capabilities

  • Comprehensive Flow Export & Protocol Support

    Supports NetFlow v5/v9/IPFIX and exports flow data in JSON, Text, Kafka, Syslog, and ntopng formats.

  • High-Performance Packet Processing

    Native support for PF_RING and PF_RING ZC for efficient high-speed traffic handling.

  • Scalable & Multithreaded Architecture

    Enables load balancing of ingress traffic across multiple streams in multi-core environments.

  • Broad Hardware Compatibility

    Supports Accolade, Intel, Myricom, Napatech, and Silicom/Fiberblaze 10/40/100 Gbit NICs.

  • Advanced Traffic Filtering & Flow Control

    Enables protocol-based traffic filtering, flow-based load balancing for IDS/IPS, and IPS feedback for real-time traffic control.

  • Deep Packet Inspection & Layer-7 Visibility

    Utilizes nDPI and micro-nDPI for detailed application-layer traffic analysis, including HTTP/HTTPS/DNS.

Use Cases

Performance

nProbe Cento has been designed to keep up with 1/10/100 Gigabit speeds on commodity hardware. On adequate hardware nProbe Cento is able to process 10 Gbit per physical core, and to scale almost linearly in the number of cores (as long as there is enough memory bandwidth available) as shown in the picture below.

In order to process 100 Gbit it is possible to load-balance the traffic across multiple cores using RSS-like techniques usually available on Intel cards or specialized packet-capture cards.

The picture shows the result of a performance test using a 100 Gbit Napatech card configured with 26 strams. The total processed rate (sustained) was of 132 Mpps with 70-byte packets (0 drops). The configuration used for the test:

System Configuration

  • OS: CentOS 6.x x64
  • PF_RING: 6.3.X
  • CPU: 2 x Intel E5 v3
  • Card: Napatech 100 Gbit
  • Traffic Handling: 500K rotating IP addresses, 25 million flows/minute
  • Flow Storage: No flow storage on DB or disk, forwarding in NFv9 format to a collector

License

Licensee’s use of this software is conditioned upon acceptance of the terms specified by ntop.

Operating Systems

Linux

Extensive nProbe Cento Licenses

Licenses are available in various flavours depending on the number and speed of network interfaces Cento can handle per system.

  • Max Concurrent Ports

    1 Gbit - 2

    10 Gbit - NA

    40 Gbit - NA

    100 Gbit - NA

  • Max Concurrent Ports

    1 Gbit - Unlimited

    10 Gbit - 2

    40 Gbit - NA

    100 Gbit - NA

  • Max Concurrent Ports

    1 Gbit - Unlimited

    10 Gbit - Unlimited

    40 Gbit - 2

    100 Gbit - NA

  • Max Concurrent Ports

    1 Gbit - Unlimited

    10 Gbit - Unlimited

    40 Gbit - Unlimited

    100 Gbit - 2

  • Max Concurrent Ports

    1 Gbit - Unlimited

    10 Gbit - Unlimited

    40 Gbit - Unlimited

    100 Gbit - Unlimited

Wondering about the difference between

nProbe vs
nProbe Cento?

Read More  ➔