Feature
High-speed packet capture on commodity hardware
PF_RING is the packet capture framework behind ntop software. Its Zero Copy (ZC) drivers bypass the kernel so nProbe, Cento and n2disk can keep up with 10 to 100 Gbit links without special appliances.
Capabilities
What high-speed capture gives you
Kernel bypass
PF_RING ZC delivers packets straight from the NIC to your application.
Scale with cores
Performance figures are per core, so a quad-core CPU gives roughly 4x with ZC.
Flows at 100 Gbit
nProbe Cento is a flow probe and packet processor for 1, 10, 40 and 100 Gbit links.
Record at line rate
n2disk writes 64-byte packets to disk at up to 100 Gbit with no packet loss on adequate hardware.
FAQ
Frequently asked questions
Do I need special hardware?
Commodity servers work. PF_RING ZC supports Intel and NVIDIA/Mellanox adapters, and n2disk also supports Napatech and Silicom FPGA cards.
What is PF_RING FT?
PF_RING FT is the flow table library used for fast flow processing. See the PF_RING FT product page for details.
Which operating systems are supported?
Linux is the primary platform. See each product page for the full list.
Get started
Capture every packet
Download the free Community edition of ntopng, or talk to the ntop team about your requirements.
