We are pleased to announce the release of cento 2.6, bringing a broad set of new capabilities and improvements to high-performance traffic processing and flow export.
This release expands cento’s integration with the ntop ecosystem, adds new visibility into tunneled traffic, introduces Post-Quantum Cryptography (PQC) support, and delivers important improvements across protocol dissection, security, and performance.
ClickHouse Export
Cento 2.6 introduces ClickHouse export support, using a schema compatible with ntopng. This makes it easier to feed high-volume flow data into ClickHouse-based deployments and integrate cento into existing ntopng-oriented data pipelines.
ClickHouse settings can be configured through the new --clickhouse-* options.
Better Visibility into Encapsulated and Tunneled traffic
Understanding traffic inside tunnels is increasingly important in modern networks. Cento 2.6 adds new Information Elements that expose addresses and ports across encapsulation boundaries.
The new fields include:
%ENCAP_IPV4_SRC_ADDR/%ENCAP_IPV4_DST_ADDR%ENCAP_IPV6_SRC_ADDR/%ENCAP_IPV6_DST_ADDR
These identify the addresses at the first encapsulation hop.
Cento also introduces fields for the traffic after tunnel decapsulation:
%UNTUNNELED_IPV4_SRC_ADDR%UNTUNNELED_L4_SRC_PORT%UNTUNNELED_IPV4_DST_ADDR%UNTUNNELED_L4_DST_PORT
Together, these additions provide more detailed visibility into tunneled traffic and make exported flows more useful for analysis and monitoring.
Application Latency Export
Cento 2.6 adds application latency export, providing latency information similar to the capabilities available in nProbe. This gives flow collectors additional context for identifying application performance issues and understanding how network conditions affect applications.
Flow Swap Heuristic
Cento now includes a flow swap heuristic, similar to the one used by ntopng. This helps cento correctly handle flows when the observed direction of traffic needs to be reversed.
Deployments that need the previous behavior can opt out using:
--disable-flow-swapPost-Quantum Cryptography support
With the transition toward post-quantum security gaining momentum, cento 2.6 introduces Post-Quantum Cryptography (PQC) support, extending the platform’s cryptographic capabilities for future-proof network deployments.
REST API security hardening
Security is another important focus of this release.
The REST API now has HTTPS enabled by default, using a self-signed certificate when no other certificate is configured. At the same time, the default administrator credentials have been removed.
These changes provide a safer starting point for new installations and reduce the risk associated with leaving default credentials or unencrypted API access in place.
Improved GTP dissection
GTP processing has been extensively reworked. The new implementation includes:
- A tunnelled-packet decode loop
- Support for fragmented tunnelled packets, including encapsulated smart fragments
- Improved handling of packets with sequence-number and length options
These changes improve the reliability and accuracy of traffic analysis in mobile and other GTP-based environments.
More secure ZMQ defaults
ZMQ communication is now encrypted by default, using a default encryption key that can be replaced by the user with a dedicated key in production environments. This provides secure communication out of the box while retaining the ability to configure deployments according to their specific requirements.
nDPI Improvements
Cento 2.6 incorporates several nDPI-related improvements, including enhanced TLS block analysis settings and improved protocol detection. These changes further improve application and protocol identification.
Flow Export and Performance
The flow export subsystem has been reworked with several performance optimizations, together with new counters to make throughput easier to monitor.
Napatech Flow Manager support for flow offload has also been updated with improved TX offload handling.
Fixes and Reliability Improvements
Cento 2.6 includes a large number of fixes addressing flow accounting, tunnel processing, protocol handling, exports, and memory management. Among the notable fixes are:
- Corrected ICMP type/code encoding in the destination port when exporting through NetFlow v5
- Fixed packet direction and accounting when the first packet of a flow is direction-swapped
- Corrected encapsulation size accounting and tunnel-related flow reversal and fragmentation handling
- Improved handling of IPv6 GTP-encapsulated traffic, untunnelled IP swaps, and downstream tunnel IDs/calculations
- Fixed partial flow resets and several FlowList issues
- Improved DNS record serialization, DNS forwarding, and JSON output with
--json-labels - Fixed HTTP export over ZMQ
These fixes further improve cento’s stability and correctness, particularly in complex environments involving tunnels, fragmented traffic, and multiple export backends.
Get Cento 2.6
Cento 2.6 is now available with these new capabilities and improvements.
With ClickHouse integration, richer tunnel visibility, application latency export, PQC support, stronger security defaults, and extensive performance and reliability work, cento 2.6 represents another significant step forward for high-performance flow collection and export.
For the complete list of changes, please refer to the cento 2.6 release notes and documentation.
Enjoy!