nProbe™ Cento

100 Gbit NetFlow Probe, Traffic Classifier and Packet Shunter

Recommendation
Alternatives
Tradeoffs
Proof

100 Gbit

flow probe

IPFIX

and NetFlow v5, v9

nDPI

Layer-7 classification

Download free

Get a license

The recommendation

Who should choose nProbe Cento

nProbe Cento is the high-speed flow probe for 1, 10, 40 and 100 Gbit links. Choose it when a standard probe cannot keep up, or when the same box must also classify traffic with nDPI and balance or filter traffic towards IDS/IPS, recorders and other tools.

You monitor links up to 100 Gbit and need NetFlow v5/v9/IPFIX, JSON, Kafka or Syslog export.
You want a high-performance data source for ntopng.
You want to shunt or load-balance traffic to Suricata, Snort or Zeek by Layer-7 protocol.

The ideal use case

Ideal use case for nProbe Cento

Environment: high-throughput edge, core, data center and interconnection links, including behind full-duplex TAPs.
Team: network and security teams where packet storage is impractical but traffic behavior must be visible.
Technical requirements: Linux, commodity hardware with PF_RING ZC. A 16-core 3+ GHz Intel Xeon Scalable or similar CPU is recommended for 100 Gbit at full rate.
Problem solved: accurate flow accounting and Layer-7 classification at line rate, with fewer packets sent to IDS/IPS.

Ideal for Every Environment

Deployment scenarios

Probe and Flow Exporter

nProbe Cento acts as a high-speed probe capable of handling multi-10 Gbps or 100 Gbps links with minimal resource usage. It captures raw traffic and exports enriched flow data (e.g., NetFlow v5/v9, IPFIX) for integration with collectors and SIEM platforms. Ideal for environments where packet-level storage is impractical but deep visibility into traffic behavior is required.

Probe and ntopng Data Source

When paired with ntopng, Cento provides a high-performance flow data source that delivers L7 application visibility, traffic classification, and behavioral insights. It enables real-time monitoring and security analysis with reduced packet capture overhead, making it perfect for high-throughput edge, core, or data center environments

Full-Duplex network TAP Aggregator and Flow Exporter

Deployed behind full-duplex network TAPs, nProbe Cento aggregates ingress and egress traffic into unified flow records. This ensures accurate traffic accounting and application monitoring, while minimizing export overhead. It’s particularly effective for monitoring critical network links or enforcing compliance at interconnection points.

Probe and Traffic Balancer for IDS with Layer-7 Shunting/Filtering

nProbe Cento can intelligently distribute traffic across multiple IDS/IPS instances (e.g., Suricata, Zeek), balancing load and avoiding over-subscription. With built-in Layer-7 filtering, Cento selectively forwards only relevant traffic (e.g., HTTP, DNS, or suspicious payloads), increasing IDS efficiency while preserving detection accuracy.

Probe and Inline Traffic Bridge with Layer-7 Filtering

In inline deployments, Cento functions as a transparent bridge that can analyze, filter, or selectively forward traffic based on Layer-7 policies. This allows for advanced use cases such as protocol-specific traffic suppression, policy enforcement, or content-aware access control, all this without introducing significant latency or packet loss.

The alternatives

nProbe Cento alternatives, compared

Same criteria for each option: role, when to choose it, limits and cost.

nProbe

Role: Probe and collector for lower speeds.
Choose it when: Multi-Gbit links, or you need flow collection from routers.
Limits: Not designed for 100 Gbit.
Cost: Pro 299.95 euro, Enterprise from 499.95 euro

nBox NetFlow

Role: 1U appliance based on nProbe and Cento.
Choose it when: You want a turn-key 100 Gbit probe.
Limits: Priced by quote.
Cost: Get a quote

n2disk

Role: Records full packets.
Choose it when: You need packet-level evidence, not only flows.
Limits: Needs fast disks; does not export flows.
Cost: from 299.95 euro

The tradeoffs

When nProbe Cento is not the right choice

Cento exports flows. For dashboards and alerts add ntopng or a collector.
It is Linux only.
100 Gbit needs suitable NICs (Intel, NVIDIA/Mellanox, Napatech, Silicom) and enough memory bandwidth.
It is a licensed product starting from 499.95 euro: for small networks nProbe or ntopng alone is enough.

The proof

Specifications, versions, pricing and documentation

Features, supported platforms and protocols, editions with prices, documentation links and answers to common questions follow below.

at a glance

Key Features

Scalable, lightweight and multithreaded design fully leveraging modern multi-core architectures
Layer-7 visibility and accounting with 450+ detected applications (e.g. Teams, BitTorrent, Citrix, ...)
Integrate with ntopng to visualize, collect, and analyze monitored traffic
Flow export to NetFlow v5/v9/IPFIX, JSON, text files (CSV), Kafka, Syslog
Native PF_RING Zero-Copy (ZC) support for ultra-high-speed packet processing up to 100 Gbit
Native support for support of Napatech, NVIDIA/Mellanox, Intel and Silicom/Fiberblaze 100 Gbit NICs
Flow-based traffic load balancing, filtering and shunting to third-party applications like IDS/IPS (Snort, Bro, Suricata)
Metadata extraction for selected Layer-7 protocols including HTTP, HTTPS, DNS

Specifications

Tech Specs

nProbe™ Cento has been designed to keep up with 1/10/100 Gigabit speeds on commodity hardware. On adequate hardware nProbe™ Cento is able to process more than 10 Gbit per physical core, and to scale almost linearly in the number of cores.
In order to process 100 Gbit it is possible to load-balance the traffic across multiple cores using RSS techniques usually available on Intel, NVIDIA/Mellanox and FPGA cards.
A 16-cores 3+Ghz Intel Xeon Scalable or similar CPU is recommended for processing 100 Gbit links full rate.

Performance

nProbe Cento has been designed to keep up with 100 Gigabit speeds on commodity hardware. On adequate hardware nProbe Cento is able to process 10 Gbit per physical core, and to scale almost linearly in the number of cores (as long as there is enough memory bandwidth available) as shown in the picture below.

In order to process 100 Gbit it is possible to load-balance the traffic across multiple cores using RSS-like techniques usually available on Intel and NVIDIA/Mellanox cards or specialised FPGA cards.

The picture shows the result of a performance test using a 100 Gbit Napatech card, changing the number of cores / RSS streams. The configuration used for the test:

2 x CPU Intel E5 v3
Napatech 100 Gbit card
500K rotating IP addresses
Generation of 25 million flows/minute
No flow storage on DB or disk, just forwarding using NetFlow v9 format to a collector

For the latest news about nProbe Cento, please read the blog.

versions

Choose Your Version

Did you already install the software?

Install

Select the nProbe Cento version that fits your needs. Different versions unlock different features and capacity.

Check the comparison table for the features set about the various versions.

S/M/L/XL/XXL

Starting from 499.95€

Layer-7 traffic inspection with nDPI
PF_RING packet capture acceleration
NetFlow, Kafka, Text (compressed), Syslog export
CSV, JSON, Avro export formats
IDS/IPS acceleration with load-balancing/filtering
Inline/bridge mode with filtering
No NetFlow collection

Designed for large organizations and telcos

Buy

Ready to see it on your network?

Download the free Community edition of ntopng, compare editions and buy in the shop, or talk to the ntop team about your requirements.

Talk to us