nBox
An Embedded NetFlow v5/v9/IPFIX Probe (IPv4, IPv6, MPLS)
Many software netflow solutions (such as nProbe) users, realized that running a probe on a PC (or any other common hardware) is not always the best choice for several reasons:
- PCs have moving parts that can break making the probe unavailable.
- PCs are large, need monitors and keyboards, whereas probes often need to be deployed on places where there is not much space available.
- Administering PCs is not cheap and they require the purchase of an OS, its installation and maintenance.
- In large networks divided in several trunks it is necessary to have several probes each analyzing a trunk. This requires that multiple hosts running nProbe are deployed across the network.
- The cost (for both hardware and maintenance) is not neglectable in particular if several probes need to be deployed.
If you're a user that does not want to bother with installing software probes on a PC or that wants to have an hardware-based, scalable and purpose-built solution then you are probably a nBox user where you have a low-cost small factor computer with no moving parts and nProbe on board easy to administer using the embedded web interface.
| nBox Nano | nBox-L | nBox-M | nBox-H | nBox-10G | |
|---|---|---|---|---|---|
| Form Factor | Desktop | Rackmount (19") | |||
| Management Ports | 1 | ||||
| Remote Management (IPMI) | No | Optional | Yes | ||
| Input Monitoring Ports Standard / Maximum | 2 / 2 | 1 / 5 | 1 / 9 | 1 / 5 | 1 / 1 |
| Network Hardware Acceleration | None (Software Acceleration via PF_RING) | ||||
| Ethernet Line to Monitor | 10/100 Mbit | 10/100/1000 Mbit | 10 Gbit | ||
| Maximum Traffic Volume to Monitor | < 100 Mbit | <= 200 Mbit | <= 500 Mbit | 1 Gbit | 10 Gbit (wire rate) |
| Target Flow Performance (Concurrent Flows) | 2'000 | <= 10'000 | <= 25'000 | 100'000 | Over 500'000 |
| Typical Monitoring Scenario | xDSL | 100 Mbit Network | Lightly Loaded Gbit Network | Heavy Loaded Gbit Network | Heavy Loaded 10 Gbit Network |
| Disk Storage (e.g. for Saving Flows) | Optional | ||||
| Kernel | Custom 2.6 Linux kernel with PF_RING Pro Acceleration (Commercial Edition) | ||||
| NetFlow Probe | nProbe 5.x (NetFlow v5/v9 and IPFIX) with in-Kernel Flow Acceleration (Commercial Edition) | ||||
| Flow Dump Facility | On disk (text and SQL) and Database Server | ||||
| Local Flow Collection | ntop 3.3.x | ||||
| Compatible Flow Collectors | Fluke, Cisco, Trendium, HP, Scrutinizer, InterMapper Flows and any standard flow collector | ||||
If you want to know more about how to setup nBox and begin collecting network traffic data, take a look at the 
nBox User's Guide.