We are pleased to announce the release of nProbe 11.2, bringing major new capabilities for network visibility, routing intelligence, flow analysis, and OT monitoring. This release significantly expands nProbe beyond traditional flow collection and export, adding BGP/BMP route enrichment, OT protocols support, collection deduplication, enhanced IPv6 handling. Flow collection has also been optimized to deliver higher performance with respect to version 11. Furthermore the export of information elements has been aligned with Cento, making them interchangeable.
BGP/BMP Support and Route Enrichment
One of the highlights of nProbe 11.2 is native support for BGP and BGP Monitoring Protocol (BMP) used by network operators and IXPs. The new bgp_server daemon can parse BGP/BMP sessions, including feeds generated by ExaBGP, and build a Routing Information Base (RIB) with best-route selection. The resulting routing information can be queried through Redis and used by nProbe to enrich flow data with routing context (e.g. the AS path). A new --bgp-server option enables BGP/BMP-based route enrichment, while the new %SRC_BGP_INFO and %DST_BGP_INFO information elements expose best-route attributes for the source and destination of flows. The release also includes the new bgp_server tool as part of the standard package, together with systemd service files and ExaBGP configuration examples, making deployment straightforward.
Enhanced Visibility into OT Traffic
nProbe 11.2 introduces OT protocol plugins, including Modbus, S7Comm, Profinet. These additions extend nProbe’s traffic visibility into industrial and OT environments, providing additional protocol-level context for networks where understanding industrial traffic is critical for monitoring, troubleshooting, and security.
Flow Annotation and Traffic Behaviour Analysis
Another major addition is %FLOW_ANNOTATION, an information element designed to characterize flows using multiple behavioural indicators.
Flow annotations can incorporate:
- Packet-length and inter-arrival-time distribution bins
- Protocol data ratios
- TLS block details
Together with the new %BURSTINESS information element, which computes flow burstiness over one-second intervals, these capabilities provide a richer description of how traffic behaves, rather than simply what endpoints and protocols are involved.
This additional context can be particularly useful for traffic classification, anomaly detection, behavioural analysis, and downstream analytics.
Flow Collection Deduplication
Networks with multiple exporters can sometimes report the same flow more than once. nProbe 11.2 introduces flow collection deduplication to address this situation. With --flow-collection-deduplication, nProbe can discard duplicate flows with the same key when they are received from multiple exporters, including IPv6 exporters. This helps prevent duplicated records from inflating traffic statistics and improves the accuracy of downstream flow analysis.
Reworked IPv6 Support
IPv6 handling has been substantially reworked across the probe, exporter, and flow-template code. The release includes numerous IPv6 fixes and addresses partial IPv6 support when collecting flows from IPv6-only exporters, including corrections to IPv6 handling in BGP endianness code, probe and exporter processing, encapsulated addresses, and flow collection.
New information elements also provide explicit support for encapsulated addresses such as GTP and GRE:
%ENCAP_IPV4_SRC_ADDR/%ENCAP_IPV4_DST_ADDR%ENCAP_IPV6_SRC_ADDR/%ENCAP_IPV6_DST_ADDR%ENCAP_IN_BYTES/%ENCAP_OUT_BYTES
More Flow Information
Several additional information elements have been introduced or enhanced in this release:
%SRC_BGP_INFOand%DST_BGP_INFOfor source and destination BGP best-route attributes%BURSTINESSfor flow burstiness%FLOW_ANNOTATIONfor behavioural flow characterization%HR_SRC_TO_DST_BYTESand%HR_DST_TO_SRC_BYTES%TCP_STATS_SRC_TO_DSTand%TCP_STATS_DST_TO_SRC
The TCP statistics elements have also been added to the default flow template.
Better Tunnelling and GTP Analysis
GTP processing has been significantly improved. nProbe 11.2 reimplements GTPv1 header decoding and improves GTPC/GTPU correlation and EBI dissection. Fragmented and tunnelled traffic length calculations have also been improved. The release fixes several issues involving GTP unencapsulated IP traffic as well as untunnelled port and byte calculations, providing more reliable flow records in mobile and tunneled environments.
Flow Collection Scalability and Performance
The number of collection templates is no longer statically defined as in the previous versions. Instead, nProbe now scales the number of collection templates according to the maximum number of routers from which flows are collected This makes flow collection more adaptable to larger and more diverse deployments. Furthermore during flow collection, memory requirements have been significantly reduced this to enable to nProbe to collect many more flows/sec with much less memory pressure.
Platform Updates
nProbe 11.2 adds support for:
- Ubuntu 26
- Rocky Linux 10
- Debian 13
There are also compatibility and compilation fixes for Windows, FreeBSD, recent RHEL/Rocky Linux 9 releases.
Other Changes and Fixes
The release includes a broad set of stability and correctness improvements, including fixes for:
- TCP retransmission counting in specific SYN/ECE/CWR sequences
- ICMP destination-port handling for NetFlow v5 and v9/IPFIX
- Invalid payload calculations and flow-record decoding
- Non-TCP flow crashes
- Misconfigured maximum hash sizes
- Statistics reporting race conditions
- Cache memory allocation
- Several IPv6 handling issues
- License detection in jailed environments
Get nProbe 11.2
With BGP/BMP route enrichment, OT protocol visibility, richer flow annotations, deduplication, improved IPv6 support, and a wide range of reliability improvements, nProbe 11.2 is a substantial step forward for high-performance network flow monitoring and analysis. We encourage existing users to upgrade and take advantage of the new capabilities, particularly those operating multi-exporter environments, IPv6-heavy networks, OT/industrial networks, or deployments where routing context and behavioural flow information are important.
Enjoy!