Feature
Network traffic recording with on-the-fly indexing
n2disk records full-sized packets from a live interface straight to disk without packet loss, up to 100 Gbit, and indexes them so you can retrieve the exact packets in seconds.
Capabilities
Why record packets
Standard PCAP files
Open the recordings in Wireshark or any third-party tool, regular and nanosecond timestamps.
No packet loss
Line-rate 64-byte packet to disk, up to 100 Gbit on adequate hardware.
Fast retrieval
On-the-fly indexing lets you extract only the traffic for a time interval or a filter.
Long retention
Writes to disk for long periods and recycles the oldest files when the configured retention is reached.
Filtering and slicing
BPF and Layer-7 filters, shunting and slicing keep storage under control.
Extract from ntopng
Pull packets from the ntopng GUI or REST API, or use the CLI tool, straight from a flow or alert.
Use cases
When teams use it
Troubleshooting
Rewind the network to the moment a service dropped or latency spiked, and see the root cause with full packets.
Network forensics
Keep a searchable, time-stamped archive for investigations, audits and lawful interception.
Low-latency trading
With PF_RING and hardware timestamping, measure packet timing and jitter precisely.
Sizing
Plan your hardware
1 Gbit
1 HDD, 1 core, 1 GB of memory (minimum).
10 Gbit
8 HDD or 4 SSD, 4 cores at 3 GHz, 8 GB of memory (minimum).
100 Gbit
8 NVMe, 12 cores at 3 GHz, 32 GB of memory (minimum).
FAQ
Frequently asked questions
Why record packets when I have NetFlow?
Flows are small and cheap to keep, but they are summaries. Packets are the proof: they show the content of the conversation when a flow is not enough.
Which file format does n2disk use?
The industry standard PCAP format, so you can analyze files with Wireshark and other tools.
Can I replay recorded traffic?
Yes. disk2n replays recorded traffic at line rate.
How do I get the packets for an incident?
Use the ntopng GUI or REST API to extract the traffic for a time interval, or the n2disk CLI tool.
Get started
Keep the proof, not just the summary
Download the free Community edition of ntopng, or talk to the ntop team about your requirements.
