What is Network Packet Broker?
Network Packet Broker referred to as “NPB” is a device that Capture, Replicate and Aggreate the inline or out of band Network Data Traffic without Packet Loss as “Packet Broker”, manage and deliver the Right Packet to Right Tools like IDS, AMP, NPM, Monitoring and Analysis System as “Packet Carrier”.
What can Network Packet Broker (NPB) do?
In theory, aggregating, filtering, and delivering data sounds simple. But in reality, smart NPB can perform very complex functions that generate exponentially increased efficiency and security benefits.
Load balancing is one of the functions. For example, if you upgrade your data center network from 1Gbps to 10Gbps, 40Gbps, or higher, NPB can slow down to distribute the high speed traffic to an existing set of 1G or 2G low speed analysis and monitoring tools. This not only extends the value of your current monitoring investment, but also avoids expensive upgrades when IT migrates.
Other powerful features that NPB performs include:
-Redundant packet deduplication
Analysis and security tools support receiving a large number of duplicate packets forwarded from multiple distributors. NPB eliminates duplication to prevent the tool from wasting processing power when processing redundant data.
-SSL decryption
Secure sockets layer (SSL) encryption is a standard technique for securely sending private information. However, hackers can also hide malicious network threats in encrypted packets.
Checking this data must be decrypted, but shredding the code requires valuable processing power. Leading network packet agents can offload decryption from security tools to ensure overall visibility while reducing the burden on high-cost resources.
-Data Masking
SSL decryption allows anyone with access to security and monitoring tools to see the data. NPB can block credit card or social security Numbers, protected health information (PHI), or other sensitive personally identifiable information (PII) before transmitting the information, so it is not disclosed to the tool or its administrators.
-The header stripping
NPB can remove headers such as vlans, vxlans, and l3vpns, so tools that cannot handle these protocols can still receive and process packet data. Context-aware visibility helps identify malicious applications running on the network and the footprints left by attackers as they work in systems and networks.
-Application and threat intelligence
Early detection of vulnerabilities can reduce loss of sensitive information and eventual vulnerability costs. The context-aware visibility provided by NPB can be used to expose intrusion metrics (IOC), identify the geographic location of attack vectors, and combat cryptographic threats.
Application intelligence extends beyond layer 2 to layer 4 (OSI model) of packet data to layer 7 (application layer).Rich data about users and application behavior and location can be created and exported to prevent application-level attacks in which malicious code masquerades as normal data and valid client requests.
Context-aware visibility helps to spot malicious applications running on your network and the footprints left by attackers as they work on systems and networks.
-Application of network monitoring
Application-aware visibility also has a profound impact on performance and management. You might want to know when an employee USES a cloud-based service like Dropbox or web-based email to bypass security policies and transfer company files, or when a former employee tried to access files using a cloud-based personal storage service.
Post time: Dec-23-2021
