|
Many software netflow solutions (such as nProbe) users, realized that running a probe on a PC (or any other common hardware) is not always the best choice for several reasons:
- PCs have moving parts that can break making the probe unavailable.
- PCs are large, need monitors and keyboards, whereas probes often need to be deployed on places where there is not much space available.
- Administering PCs is not cheap and they require the purchase of an OS, its installation and maintenance.
- In large networks divided in several trunks it is necessary to have several probes each analyzing a trunk.
This requires that multiple hosts running nProbe are deployed across the network.
- The cost (for both hardware and maintenance) is not neglectable in particular if several probes need to be deployed.
If you're a user that does not want to bother with installing software probes on a PC or that wants to have an
hardware-based, scalable and purpose-built solution then you are probably a nBox user
where you have a low-cost small factor computer with no moving parts and nProbe on board easy to administer
using the embedded web interface.
| | nBox-Ls | nBox-L | nBox-M | nBox-H | nBox-10G |
|---|
| Form Factor | Rackmount (19") Short Length |
|---|
| Management Ports | 1 |
|---|
| Remote Management (IPMI) | Optional | Yes |
|---|
Input Monitoring Ports
Standard / Maximum | 1 / 2 | 1 / 5 | 1 / 9 | 1 / 5 | 1 / 1 |
|---|
| Network Hardware Acceleration | None
(Software Acceleration via PF_RING) |
|---|
| Ethernet Line to Monitor | 10/100/1000 Mbit | 10 Gbit |
|---|
| Maximum Traffic Volume to Monitor | < 100 Mbit | <= 200 Mbit | <= 500 Mbit | 1 Gbit | 10 Gbit
(up to 4 Mpps) |
|---|
Target Flow Performance
(Concurrent Flows) | <= 7'000 | <= 10'000 | <= 100'000 | 250'000 | Over 500'000 |
|---|
| Typical Monitoring Scenario | xDSL | 100 Mbit Network | Lightly Loaded
Gbit Network | Heavy Loaded
Gbit Network | Heavy Loaded 10 Gbit Network |
|---|
Disk Storage
(e.g. for Saving Flows) | Optional |
|---|
| Kernel | Custom 2.6 Linux kernel with PF_RING Pro
Acceleration (Commercial Edition) |
|---|
| NetFlow Probe | nProbe 6.x (NetFlow v5/v9 and IPFIX)
with in-Kernel Flow
Acceleration (Commercial Edition) |
|---|
| Flow Dump Facility | On disk (text, SQL, FastBit) and Database Server |
|---|
| Local Flow Collection | ntop 4.x |
|---|
| Compatible Flow Collectors | Fluke, Cisco, Plixer, Lancope, InterMapper Flows
and any standard flow collector |
|---|
If you want to know more in detail how the nBox works from user's prespective, you can glace through the nBox User's Guide.
Do you want to see whether you can find an nBox that fits your requirements? Have a look at nBox product list.
NetFlow is copyright Cisco Systems.
|
