An Embedded Small Form Factor Appliance
If you’re a user that wants to have an hardware-based, scalable, optimised, and purpose-built solution, without bothering with software installation, then you are probably a nBox user. nBox Mini is a low-cost, small form factor, appliance specifically designed for high-speed traffic analysis and flow collection, with ntopng (and optionally nProbe) on board, easy to administer using the embedded web interface.
The nBox Mini appliance comes with 4 GbE or 2.5 GbE interfaces:
- A Management interface to administer the box, access the Web interface for traffic analysis, and optionally collect Netflow.
- A Capture interface to monitor the Mirror or SPAN port from your switch.
- A Bridge with 2 interfaces to deploy the appliance inline as a bump in the wire (transparent bridge) and avoid additional TAP devices.
- Show realtime network traffic, active hosts and communications, with focus on traffic visibility and cybersecurity
- Discover Layer-7 application protocols (Facebook, YouTube, BitTorrent, etc) by leveraging on nDPI Deep Packet Inspection technology
- Sort network traffic according to many criteria including IP address, L7 application protocol, throughput
- Produce historical traffic reports to analyse past network activities and have control of network usage over time
- Monitor even low level network metrics including traffic throughput, network and application latencies, TCP retransmissions, out of order packets, packet lost
- Store on ClickHouse persistent traffic statistics to allow future explorations and post-mortem analyses
- Geolocate and overlay hosts in a geographical map
- Full support for IPv4 and IPv6
- Flexible alerts handling
- SNMP v1/v2c/v3 support and continuous monitoring of SNMP devices
- Behavioural traffic analyses such as lateral movements and periodic traffic detection
- REST API to ease integrations with third-parties
- nBox UI to manage the appliance using a user-friendly web interface
Open Source Technologies
nBox relies on Open Source high-performance technologies, including the PF_RING packet capture framework for capturing and processing traffic at high speed, the nDPI Deep Packet Inspection framework for traffic classification, and the ntopng traffic analyser.
The nBox UI is based on Cockpit. The pictures below show the nBox Mini Web user interface.
nBox Mini is available on MiniServer store.
The nBox is available as physical appliance in various models: