nTap is a virtual software tap that can be used in physical/virtual/cloud environments to remotely capture traffic (with respect to the monitoring location) and delivering packets to the observation point in a secure way. Packet capture is required whenever flow-based analysis tools such as nProbe or nProbe Cento are not suitable as packet-level analysis is required.

Main differences between a physical tap and nTap:

• nTap is able to deliver monitored traffic remotely (a physical tap requires a direct cable connection forcing to monitor traffic where it is generated).
• nTap delivers packets with end-to-end encryption preventing intruders from watching monitored traffic.
• nTap can apply packet filtering on monitored traffic (physical taps are unable to do this: more expensive packet brokers provide this feature).
• nTap can be used in containers and virtual machines as well highly dynamic environments such as Kubernetes (a physical tap can be used only on a physical network).

nTap is based on two components:

• nTap remote it is installed on the remote device for which need to monitor traffic.
• nTap collector receives encrypted packets sent by nTap remote, decrypts them, and deliver them to the traffic analysis software (ntopng, nProbe, or third party like Wireshark or Suricata).