disk2n
10 Gigabit network traffic re-player
any file size
packet timing
compatible
The recommendation
Who should choose disk2n
disk2n replays PCAP traffic, such as captures made with n2disk, onto a live network at the original inter-packet timing. Choose it for testing security appliances and IDS/IPS, stress-testing deployments, or reconstructing incidents.
- You need to replay recorded traffic at the original or at a custom rate.
- You want to change MAC, IP and port on the fly, with checksums recalculated.
- You test devices with terabytes of PCAP files, with limited memory usage.
The ideal use case
Ideal use case for disk2n
- Environment: lab and pre-production networks, red team and blue team exercises.
- Team: security and network engineers validating detection and performance.
- Technical requirements: PCAP playlists, or an n2disk timeline with a time interval. PF_RING ZC can accelerate transmission. Check the hardware sizing notes.
- Problem solved: reproduce real traffic or attacks in a controlled environment.
Ideal for Every Environment
Deployment scenarios
Network Devices and IDS Testing
Data captured to PCAP with n2disk, can be replayed to simulate real-world traffic in lab environments. This is essential for testing security appliances, validating IDS/IPS systems, or stress-testing new deployments before they go live. Replay real-world or synthetic attack traffic to evaluate how well security appliances detect or block threats or to analyze malware command-and-control patterns or observe how malware behaves in a controlled environment.
Incident Reconstruction and Simulation
Reconstruct historical incidents to understand attacker behavior or data exfiltration patterns or replay real attacks in red team/blue team exercises to simulate realistic threat environments.
The alternatives
disk2n alternatives, compared
Same criteria for each option: role, when to choose it, limits and cost.
n2disk
- Role: Records the traffic that disk2n replays.
- Choose it when: You first need to capture.
- Limits: Records only.
- Cost: from 299.95 euro
PF_RING
- Role: PCAP replay and traffic generation.
- Choose it when: You need a free tool for generating or replaying traffic.
- Limits: Not built for terabyte playlists with original timing.
- Cost: Free
The tradeoffs
When disk2n is not the right choice
- It is a 10 Gbps replayer: faster rates are out of scope.
- It needs captured PCAP files, so it is usually used with n2disk.
- It is a command line tool with no interface.
The proof
Specifications, versions, pricing and documentation
Features, supported platforms and protocols, editions with prices, documentation links and answers to common questions follow below.
at a glance
Key Features
- Replay traffic from standard PCAP playlists (regular and nanoseconds)
- Line-rate at original rate packet replay
- Customizable inter-packet time to replay traffic at capture rate or at a user-defined rate
- Packet reforging to change source/destination MAC/IP/Port on the fly, recalculating checksum
- Multi-core support to fully leverage on multicore architectures
- Native support for PF_RING Zero-Copy (ZC) to accelerate packet transmission
- Direct-IO disk access to obtain maximum disk-read throughput
Related
Keep exploring
Pricing and editions
Compare editions and ways to buy.
Solutions
By use case and industry.
User guide
Installation and configuration.
Get started
Ready to see it on your network?
Download the free Community edition of ntopng, compare editions and buy in the shop, or talk to the ntop team about your requirements.
