Feature
NetFlow, sFlow and IPFIX collector and probe
nProbe collects flows from your routers and switches, or builds them from packets on a mirror port or TAP, then delivers them to ntopng or any collector you already run.
Capabilities
What flow collection gives you
All the common formats
NetFlow v5, v9, IPFIX, sFlow and NetFlow-lite in, NetFlow v5/v9/IPFIX out.
Probe and collector in one
Use nProbe as a collector for router flows, or as a probe on a mirror port or TAP.
Layer-7 visibility
450+ applications detected by nDPI, such as Teams, BitTorrent and Citrix, added to every flow.
Flexible export
Send flows to ntopng over ZMQ, or to Kafka, CSV files, MySQL/MariaDB, Elasticsearch, TCP streams or syslog.
Convert and upgrade
Turn Cisco ASA and sFlow into NetFlow or IPFIX, or convert v5 flows to IPFIX in proxy mode.
Custom templates
Build your own NetFlow templates, with optional private enterprise number support.
How it works
From router to dashboard
1. Export
Enable NetFlow, IPFIX or sFlow on your router, switch or firewall and point it at nProbe.
2. Collect
nProbe receives the flows, enriches them with Layer-7 data and forwards them over ZMQ.
3. Analyze
ntopng shows hosts, applications and alerts, and keeps historical flows for later investigation.
Use cases
When teams use it
Branch and campus visibility
See traffic per site without installing probes everywhere, using the flows your devices already export.
ISP and carrier monitoring
Collect flows from many exporters and track traffic by AS, customer and link.
Legacy router upgrade
Convert NetFlow v5 to IPFIX with nProbe in proxy mode while you migrate.
FAQ
Frequently asked questions
What is the difference between a probe and a collector?
A probe turns packets from a mirror port or TAP into flows. A collector receives flows exported by routers and switches. nProbe can work in both modes.
Which flow formats does nProbe export?
NetFlow v5, v9 and IPFIX, and it can also deliver flows to ntopng over ZeroMQ.
Do I need ntopng?
No. nProbe can export to any collector. Together with ntopng you get dashboards, alerts and historical analysis.
What if I need 100 Gbit?
Use nProbe Cento, the high-speed probe for 1, 10, 40 and 100 Gbit links.
Get started
Start collecting flows today
Download the free Community edition of ntopng, or talk to the ntop team about your requirements.
