nTap
Virtual Network Tap for Hosts/Cloud/Containers/VMs
capture
delivery
license
The recommendation
Who should choose nTap
nTap is a virtual network tap for hosts, cloud, containers and VMs. Choose it when you need packet-level analysis of traffic at a remote location and flow-based tools such as nProbe or Cento are not enough.
- You must mirror remote or cloud traffic to a central monitoring point.
- Your policy allows only a one-way channel: nTap delivers encrypted packets over unidirectional UDP.
- You monitor containers, Kubernetes or virtual machines.
The ideal use case
Ideal use case for nTap
- Environment: physical, virtual and cloud hosts. The tap runs on remote hosts, the collector on a host with a static IP. Linux, FreeBSD, Windows x64, macOS and Raspberry Pi OS.
- Team: network and security teams that analyze traffic with ntop tools, Wireshark, tcpdump, Suricata or Snort.
- Technical requirements: no special hardware. BPF filters select the traffic to forward. No license is needed on the host where the tap runs.
- Problem solved: remote capture with end-to-end encryption and minimal bandwidth overhead.
Ideal for Every Environment
Deployment scenarios
Analyse Remote Traffic with ntop Tools
ntop applications such as nProbe (Enterprise M/L) and ntopng (Enterprise L), embed the nTap collector so that you can directly connect (one or more) nTap remote with nProbe/ntopng without the need to use the nTap collector.
Analyse Remote Traffic with Third-Party Tools
nTap collector can receive encrypted packets sent by nTap remote, decrypt them, and push them on a virtual ethernet interface where you can attach applications such as Wireshark, tcpdump, Suricata or Snort.
Deliver Remote Traffic to Open vSwitch
Optionally the nTap collector can also send packets to Open vSwitch for maximum flexibility.
Monitor Containers, Kubernetes and Virtual Machines
nTap can be used inside containers and VMs. Typically the tap component is deployed on remote hosts/containers whose IP address can be dynamic. Instead the collector application needs to be active on a host with a static IP address as it needs to receive packets sent by the tap. No license needs to be installed on the host where the tap application runs.
The alternatives
nTap alternatives, compared
Same criteria for each option: role, when to choose it, limits and cost.
nProbe or nProbe Cento
- Role: Flow-based analysis at the remote site.
- Choose it when: Flows are enough.
- Limits: No packet-level detail.
- Cost: nProbe from 299.95 euro
Embedded collector in ntop tools
- Role: nProbe Enterprise M/L and ntopng Enterprise L include the collector.
- Choose it when: You use those editions.
- Limits: Only those editions.
- Cost: included
The tradeoffs
When nTap is not the right choice
- A collector with a static IP is required for the tap packets.
- It transfers packets, so remote traffic uses bandwidth: use BPF filters to limit it.
- Analysis needs another tool, such as ntopng, nProbe, Wireshark or Suricata.
- The license costs 99.95 euro.
The proof
Specifications, versions, pricing and documentation
Features, supported platforms and protocols, editions with prices, documentation links and answers to common questions follow below.
at a glance
Key Features
- Efficiently mirrors remote network traffic with minimal latency and bandwidth overhead
- Filtering capabilities supporting BPF filtering to select and forward only relevant traffic to monitoring tools
- Deliver packets over an encrypted unidirectional channels over UDP, making it suitable in high-secure networks that do not allow a return channel
- End-to-end encryption using state-of-the-art symmetrical encryption and AVX instructions for maximum performance
- Bandwidth optimization to minimize the impacts on the network for transferring mirrored traffic
- Support for delivering traffic to a virtual ethernet interface as well as Open vSwitch
Specifications
Tech Specs
- Linux
- FreeBSD
- Windows x64 (including Windows 10/11)
- macOS
- RaspbianOS
No special hardware requirements necessary.
- All protocols over ethernet
Related
Keep exploring
Pricing and editions
Compare editions and ways to buy.
Solutions
By use case and industry.
User guide
Installation and configuration.
Get started
Ready to see it on your network?
Download the free Community edition of ntopng, compare editions and buy in the shop, or talk to the ntop team about your requirements.
