nBox Recorder

The 100 Gbit Continuous Packet Recorder


nBox Recorder is a network traffic disk recorder application. With nBox Recorder you can capture full-sized network packets at gigabit rate from a live network interface and write them into files. It has been designed and developed mainly because most network security systems rely on capturing all packets (headers and payload), since any packets may have been responsible for the attack or could contain the problems that we are trying to find.
nBox Recorder uses the industry standard PCAP file format to dump packets into files so the resulting output can be easily integrated with existing third party or even open-source analysis tools like ntopng, Wireshark, Suricata, Zeek, Snort.

nBox Recorder can be effectively used to perform:

  • Off-line network packets analysis by feeding a specialized tool (such as snort or ntopng).
  • Reconstruct specific communication flows or network activities.
  • Reproduce the previous captured traffic to a different network.


Open Source Technologies

nBox relies on Open Source high-performance technologies for capturing and processing traffic, including our PF_RING framework, delivering Line-Rate packet capture up to 100 Gbit/s. nBox Recorder uses the industry standard PCAP file format to dump packets into files, so the resulting output can be easily integrated with existing third party and Open Source analysis tools like ntopng, Wireshark or Snort.


100% Visibility, Nanosecond Precision

nBox provides 100% visibility with sustained Line-Rate loss-less packet capture, which is a requirement in network security. Loss-less packet capture up to 100 Gbit, combined with nanosecond accuracy, delivers the best visibility in any condition. Full packets are stored, indexed and organized in a timeline to enable on-demand retrieval, specifying time interval and BPF criteria to fully reconstruct past events.


High Performance, Small Form Factor

Our nBox Recorder and NetFlow appliances are able to process up to 100 Gbit and fit in 1U form factor rackmount (depending on the required data retention). Up to 24 disks in 2U form factor, or longer-term storage on modular systems to scale as needed.


Main Features


The nBox Recorder is based on n2disk, a 100 Gbit Network traffic recorder with indexing capabilities.

  • High performance full packet capture to disk.
  • BPF filters support. You can specify any filters you want to filter out the unwanted network packets from the dumping process.
  • Conditional dump: save packets on disk based on traffic conditions (e.g. when traffic is above threshold X) and time of the day.
  • Detailed dump statistics.
  • Fully integrated in the nBox appliance. From the nBox web interface you can browse the dumped files and open them within nTop.
  • Ability to reproduce dumped files onto a physical interface, or using tools such as ntop and nProbe.

The nBox Recorder is based on the n2disk software, please refer to the n2disk product page and documentation for further information about supported features.

User Interface


The nBox UI is based on Cockpit. The pictures below show the nBox Recorder Web user interface.

Available Models


The nBox recorder is available as physical appliance in the models below. All models:

  • 19″ Rack-mount
  • Use NVMe as storage for no drops.
  • Operate at line rate with minimal packet size
  • All models are Dell-based and include up to 3 years on-site hardware guarantee.
  • Additional storage, software and hardware options available on demand.

 

nBox Recorder Form Factor Monitoring Port Options Certified Dump Performance Storage Size

R10

1 Unit
  • 2 x 10 Gbit Intel ZC SFP+
  • 2 x 10 Gbit/s
    (2 x 14.88 Mpps)
8 x 0.96 TB

R40

1 Unit
  • 2 x 40 Gbit FPGA-based adapter with Hardware Timestamps (QSFP28)
  • 2 x 10 Gbit/s
    (2 x 14.88 Mpps)
  • 2 x 40 Gbit/s
    (40 Gbit Max with FPGA)
8 x 1.6 TB

R100

2 Units
  • 1 x 100 Gbit FPGA-based adapter with Hardware Timestamps (QSFP28)
  • 100 Gbit/s line rate
8 x 1.6 TB

 

Get It


Please contact us for details, price and availability, or get in touch with our resellers.