TAP & Network Packet Broker
The Importance of Network Packet Broker
As networks become increasingly decentralized and information needs to be collected more and more, it is essential to have a solution that assists in collecting, aggregating and processing them before being pushed through surveillance systems. , data analysis.
Distributed network assessment helps businesses gather more information, as well as have an overview and converge the necessary information in a single centralized system. Helping businesses save operating costs, enhance security across the entire system.
Some key features of Network Packet Broker:
1 / Provide the ability to filter multiple parameters simultaneously:
NPB device provides the ability to filter multiple components simultaneously from layer 2 to layer 7 (filter by VLAN, by IP address, by port, by application, by geographic partition …) to help filter the data stream accordingly. for each device, analysis tool, reducing processing need on those devices.
Copies traffic from one input port to multiple output ports, allowing data coming from one source to be sent to multiple analyzers. Reduces the need for ports to connect to that source (does not need multiple SPAN ports on a single physical device) thereby reducing the hardware requirements of network devices.
2 / Combine flow:
Consolidation of traffic from multiple sources to send to the analyzer reduces the ports needed to connect to the analyzer, reducing hardware requirements on the analyzer.
Vlan Tag, IxFlow, Packet capture:
Works with packets that have a Vlan tag assigned. Create IxFlow (NetFlow + Metadata) with information such as area IP, latitude and city name, and include application ID or name, device, browser and even SSL encryption. In addition, the device also supports the Packet Capture feature.
3 / Load Balancing:
- The device is capable of transferring traffic to many different devices to balance the load, reducing the processing performance for data processing equipment.
Packet stack feature:
- NPB supports the following features: Deduplication, Header stripping, Trimming, Data Masking, Timestamping, Burst Protection
- Features SSL inspection
- NPB supports SSL decryption with both Inline Active (for devices like IPS) and Inline Passive (IDS, APT) models.
- Real-time display of network traffic:
- NPB equipment handles network traffic and real-time display, allowing monitoring and operation personnel to capture information instantly.
- Update security features monthly.
- Other features include integration with Radius authentication devices, tacacs +, surveillance devices that use SNMP or support for the syslog protocol to eject SIEM devices.