n2disk™
100 Gbit network traffic recorder with on-the-fly indexing
recording, no packet loss
standard file format
fast retrieval
The recommendation
Who should choose n2disk
n2disk is a network traffic recorder: it writes full packets to disk in PCAP format, up to 100 Gbit, and indexes them on the fly. Choose it when you need to go back in time to troubleshoot, investigate an incident or keep packet evidence for audits.
- You need continuous packet capture with no loss and long retention.
- You want to retrieve packets by time interval and BPF filter, with the standard PCAP format.
- You work on forensics, compliance or ultra-low latency analysis.
The ideal use case
Ideal use case for n2disk
- Environment: 1, 10 and 100 Gbit links, from a single HDD at 1 Gbit to NVMe at 100 Gbit.
- Team: network and security engineers, forensics and audit teams.
- Technical requirements: 1 Gbit: 1 core, 1 GB RAM, 1 HDD. 10 Gbit: 4 cores 3 GHz, 8 GB, 8 HDD or 4 SSD. 100 Gbit: 12 cores 3 GHz, 32 GB, 8 NVMe.
- Problem solved: rewind traffic and find the root cause with full-packet visibility. Oldest files are recycled when retention is full.
Ideal for Every Environment
Deployment scenarios
Troubleshooting
n2disk enables continuous packet capture with zero packet loss, providing a reliable record of all network activity. When issues arise (such as service disruptions, dropped connections, or abnormal latency) engineers can quickly rewind network traffic and pinpoint root causes with full-packet visibility.
Network Forensics
In security-sensitive environments, having a searchable, time-stamped archive of packet data is critical. n2disk supports long-term retention and indexed search capabilities, making it an ideal solution for forensic investigations, regulatory audits, and lawful interception scenarios.
HFT Optimization
In ultra-low latency environments like High-Frequency Trading, every microsecond matters. n2disk, when used with PF_RING and hardware timestamping, allows precise capture and analysis of packet timing and jitter. This helps trading firms validate performance, troubleshoot delays, and optimize infrastructure for maximum speed and accuracy.
The alternatives
n2disk alternatives, compared
Same criteria for each option: role, when to choose it, limits and cost.
nBox Recorder
- Role: Turn-key 1U appliance running n2disk.
- Choose it when: You want a ready recorder, not hardware you size yourself.
- Limits: Priced by quote.
- Cost: Get a quote
ntopng and nProbe
- Role: Flows and dashboards.
- Choose it when: Flow-level visibility is enough.
- Limits: No packet payloads.
- Cost: ntopng Community is free
disk2n
- Role: Replays n2disk captures.
- Choose it when: You need to replay recorded traffic.
- Limits: Replays, does not record.
- Cost: 699.95 euro
The tradeoffs
When n2disk is not the right choice
- Retention depends on disk space: add disks to reach the retention you need.
- Full-packet recording needs fast storage. The table on this page lists minimum requirements only.
- n2disk records and extracts packets. For dashboards use ntopng, which also drives extraction.
- Native FPGA and zero-copy capture needs supported adapters.
The proof
Specifications, versions, pricing and documentation
Features, supported platforms and protocols, editions with prices, documentation links and answers to common questions follow below.
at a glance
Key Features
- Industry standard PCAP file format (regular and nanoseconds)
- Line rate 64-byte packet to disk recording with no packet loss
- PF_RING Zero-Copy (ZC) support for Intel and NVIDIA/Mellanox adapters
- Native support for Napatech and Silicom (Fiberblaze) FPGA with segment mode
- Full 100 Gbit line-rate 64-byte packets to disk with no packet loss on adequate hardware
- Optimized BPF and Layer-7 filters support, shunting and slicing
- Multi-cores support to fully leverage on modern CPU architectures
- Direct-IO disk access and NVMe RAID emulation to obtain maximum disk-write throughput
- On-the-fly indexing of pcap data, to quickly retrieve interesting packets in a specified time interval using BPF-like filters
- PCAP and index compression (optionally enabled) to optimize I/O throughput and disk space
Specifications
Tech Specs
- Linux
- FreeBSD (libpcap capture)
- Web GUI available for configuration and traffic extraction through ntopng or on nBox appliances
- HTTP-based RESTful API for traffic extraction through ntopng
- CLI tool for traffic extraction
| 1 Gbit | 10 Gbit | 100 Gbit | |
| Disk | 1 HDD | 8 HDD / 4 SSD | 8 NVMe |
| Processor | 1 core | 4 cores 3 Ghz | 12 cores 3 Ghz |
| Memory | 1 GB | 8 GB | 32* GB |
Table reports minimum requirements.
Increase the number of disks to achieve the desired data retention.
* RAM configuration should meet the optimal number of memory modules according to the memory channels supported by the CPU.
versions
Choose Your Version
Did you already install the software?
Select the n2disk version that fits your needs. Different versions unlock different features and capacity.
Check the comparison table for the features set about the various versions.
1 Gbit
- Packet capture to disk in PCAP format
- On-the-fly indexing and timeline
- Native PF_RING support
- Single threaded packet processing
- L7 filtering not included (optional)
- Up to 1 Gbps
5 Gbit
- Packet capture to disk in PCAP format
- On-the-fly indexing and timeline
- Native PF_RING support
- Single threaded packet processing
- PF_RING FT included (L7 filtering)
- Up to 5 Gbps
10/100 Gbit
- Packet capture to disk in PCAP format
- On-the-fly indexing and timeline
- Native PF_RING support
- Multithreaded packet processing
- PF_RING FT included (L7 filtering)
- Up to 100 Gbps
Related
Keep exploring
Pricing and editions
Compare editions and ways to buy.
Solutions
By use case and industry.
User guide
Installation and configuration.
Get started
Ready to see it on your network?
Download the free Community edition of ntopng, compare editions and buy in the shop, or talk to the ntop team about your requirements.
