Introducing nProbe v6
Today the new nProbe v6 has been released. It includes several improvements with respect to the previous version including: Full IPFIX support: PEN (Private Enterprise Numbers) and Variable length encoding. Ability to…
nProbe
- Home
- nProbe
nProbe Internals
nProbe is an efficient processing engine able to produce flows based on captured packets, converts flow format (e.g. from NetFlow v5 to v9), or from sFlow to NetFlow. Its engine is fully…
Using Genetic Algorithms for Network Intrusion Detection and Integration into nProbe
Conference: OSCON 2010 Presentation Link: Ignite Track Presented by: Brian Lavender SNORT is popular Network Intrusion Detection System (NIDS) tool that currently uses a custom rule based system to identify attacks. This…
nProbe with FastBit database: an innovative flows storage solution
nProbe, acronym for NetFlow probe, is an open-source probe that supports both NetFlow and sFlow collection. It has been designed to keep up with Gigabit speeds on commodity hardware and it can…
IANA Assigned a PEN to ntop
Internet Assigned Numbers Authority (IANA) has assigned to ntop the 35632 PEN (Private Enterprise Number) number. This means for instance that nProbe extensions (e.g. HTTP and VoIP traffic monitoring) will be exported…
Collection and Exploration of Large Data Monitoring Sets Using nProbe
Collecting and exploring monitoring data is becoming increasingly challenging as networks become larger and faster. Solutions based on both SQL-databases and specialized binary formats do not scale well as the amount of…
Port Mirror vs Network Tap
In order to analyze network traffic, it's necessary to feed ntop/nProbe with network packets. There are two solutions to the problem: port mirror (also called SPAN in Cisco parlance) network tap Prior…
