nProbe™ Cento
100 Gbit NetFlow Probe, Traffic Classifier and Packet Shunter
nProbe™ Cento is a high-speed NetFlow probe able to keep up with 1/10/100 Gbit. nProbe™ Cento is not just a fast Netflow probe, it has been designed as the first component of a modular monitoring system: besides capturing ingress packets and computing flow data, it can be used to classify the traffic via DPI (Deep Packet Inspection) and performs optional actions on selected packets/flows when used as traffic forwarder in combination with other applications such as IPS/IDS, traffic recorders, etc.
at a glance
Key Features
- Scalable, lightweight and multithreaded design fully leveraging modern multi-core architectures
- Layer-7 visibility and accounting with 450+ detected applications (e.g. Teams, BitTorrent, Citrix, ...)
- Integrate with ntopng to visualize, collect, and analyze monitored traffic
- Flow export to NetFlow v5/v9/IPFIX, JSON, text files (CSV), Kafka, Syslog
- Native PF_RING Zero-Copy (ZC) support for ultra-high-speed packet processing up to 100 Gbit
- Native support for support of Napatech, NVIDIA/Mellanox, Intel and Silicom/Fiberblaze 100 Gbit NICs
- Flow-based traffic load balancing, filtering and shunting to third-party applications like IDS/IPS (Snort, Bro, Suricata)
- Metadata extraction for selected Layer-7 protocols including HTTP, HTTPS, DNS
Ideal for Every Environment
Use Cases
Probe and Flow Exporter
nProbe Cento acts as a high-speed probe capable of handling multi-10 Gbps or 100 Gbps links with minimal resource usage. It captures raw traffic and exports enriched flow data (e.g., NetFlow v5/v9, IPFIX) for integration with collectors and SIEM platforms. Ideal for environments where packet-level storage is impractical but deep visibility into traffic behavior is required.
Probe and ntopng Data Source
When paired with ntopng, Cento provides a high-performance flow data source that delivers L7 application visibility, traffic classification, and behavioral insights. It enables real-time monitoring and security analysis with reduced packet capture overhead, making it perfect for high-throughput edge, core, or data center environments
Full-Duplex network TAP Aggregator and Flow Exporter
Deployed behind full-duplex network TAPs, nProbe Cento aggregates ingress and egress traffic into unified flow records. This ensures accurate traffic accounting and application monitoring, while minimizing export overhead. It’s particularly effective for monitoring critical network links or enforcing compliance at interconnection points.
Probe and Traffic Balancer for IDS with Layer-7 Shunting/Filtering
nProbe Cento can intelligently distribute traffic across multiple IDS/IPS instances (e.g., Suricata, Zeek), balancing load and avoiding over-subscription. With built-in Layer-7 filtering, Cento selectively forwards only relevant traffic (e.g., HTTP, DNS, or suspicious payloads), increasing IDS efficiency while preserving detection accuracy.
Probe and Inline Traffic Bridge with Layer-7 Filtering
In inline deployments, Cento functions as a transparent bridge that can analyze, filter, or selectively forward traffic based on Layer-7 policies. This allows for advanced use cases such as protocol-specific traffic suppression, policy enforcement, or content-aware access control, all this without introducing significant latency or packet loss.
Specifications
Tech Specs
- Linux
- NetFlow v5/v9/IPFIX
- ZMQ (ntopng)
- Text (CSV)
- Kafka (JSON/Avro)
- Syslog
nProbe™ Cento has been designed to keep up with 1/10/100 Gigabit speeds on commodity hardware. On adequate hardware nProbe™ Cento is able to process more than 10 Gbit per physical core, and to scale almost linearly in the number of cores.
In order to process 100 Gbit it is possible to load-balance the traffic across multiple cores using RSS techniques usually available on Intel, NVIDIA/Mellanox and FPGA cards.
A 16-cores 3+Ghz Intel Xeon Scalable or similar CPU is recommended for processing 100 Gbit links full rate.
- IPv4/IPv6
- TCP/UDP/ICMP
- GTP/GRE/MPLS/VXLAN
- 450+ Layer-7 application protocols supported by nDPI
models
Choose Your Model
Did you already install the software?
Select the model. Different models unlock different features and capacity. Check the comparison table.
S/M/L/XL/XXL
- Layer-7 traffic inspection with nDPI
- PF_RING packet capture acceleration
- NetFlow, Kafka, Text (compressed), Syslog export
- CSV, JSON, Avro export formats
- IDS/IPS acceleration with load-balancing/filtering
- Inline/bridge mode with filtering
- No NetFlow collection
- Designed for large organizations and telcos