Table of Contents
In network visibility, Asterfusion is a trusted OEM with 15 years of mass-production expertise. As the design and manufacturing partner behind leading NPB brands (Shadow Factory), we have supported telecom operators and financial institutions worldwide with advanced traffic visibility and security solutions. Today, Asterfusion is stepping out of the shadows to redefine the industry with its open packet broker approach, delivering the most cost-effective solutions that directly challenge traditional closed hardware models.
What Is a Network Packet Broker (NPB)?
A Network Packet Broker (NPB) is a specialized network device designed for network traffic acquisition, processing, and distribution. It is typically deployed between the production network and monitoring or security analysis systems. By receiving traffic from Network TAPs, switch SPAN/Mirror ports, or other network devices, an NPB intelligently processes packets and forwards them to different analysis platforms based on predefined policies.
Unlike traditional switches, which are primarily responsible for business traffic forwarding, an NPB focuses on network traffic visibility and optimization. It does not change the existing production network architecture; instead, it provides centralized traffic management capabilities in an out-of-band environment.
A typical NPB can connect to:
Traffic Sources:
- Network TAPs
- SPAN/Mirror Ports
- Routers
- Switches
- Backbone Links
Traffic Destinations:
- IDS/IPS (Intrusion Detection and Prevention Systems)
- DPI (Deep Packet Inspection) Systems
- NDR (Network Detection and Response) Platforms
- SIEM (Security Information and Event Management) Platforms
- Network Performance Monitoring Systems
- Packet Analysis Platforms
Its core principle is: Deliver the right data to the right tool at the right time.
Why Do We Need a Network Packet Broker (NPB)?
Modern networks generate massive amounts of data traffic every second. Every user request, application transaction, server communication, and security event is carried through network packets. These packets contain valuable insights, such as:
- Who is accessing which resources?
- Which applications are communicating?
- Are there abnormal activities?
- Where is network performance degrading?
- Are there potential security threats?
However, traditional network devices, such as switches and routers, are primarily designed for fast and reliable packet forwarding. They ensure data reaches the destination, but they do not provide deep visibility into what is happening inside the network.As a result, organizations often face a challenge:The network is running, but they lack visibility into the traffic flowing through it.This is why network visibility has become essential.
Traffic Acquisition: The Foundation of Network Visibility
Network traffic contains valuable information, but it must first be collected before it can be analyzed.Similar to how traffic cameras help monitor highways, network traffic acquisition allows organizations to understand what is happening inside their infrastructure. By using Network TAPs or SPAN/Mirror ports, organizations can capture copies of real network traffic and send them to monitoring and security platforms for analysis. These systems can then identify:
- Network performance issues
- Application behavior
- Security threats
- Abnormal communications
Therefore, traffic acquisition is the first step toward building complete network visibility.
Security Systems Need Real Network Traffic
Modern cyber threats are becoming increasingly sophisticated. Attackers often hide within normal network activities through:
- Unauthorized access
- Lateral movement
- Malicious communication
- Data exfiltration
Security solutions such as IDS/IPS, NDR, and SIEM rely on real network traffic to detect these threats.For example, if a server is compromised and starts communicating abnormally with internal systems, security teams need visibility into like: Who initiated the connection? Where the traffic is going? Whether the behavior is suspicious? and How the attack spreads. Without traffic visibility, these threats can remain unnoticed.An NPB helps security tools access the right traffic data and improves threat detection capabilities.
High-Speed Networks Require Intelligent Traffic Management
As networks evolve from 10G and 40G to 100G, 400G, and beyond, traffic volumes continue to grow rapidly.However, security and monitoring tools often cannot process all network traffic at full line rate. Sending all traffic directly to these tools may cause an excessive workload,unnecessary data processing and higher costs. However, an NPB solves this problem by intelligently managing traffic before it reaches analysis systems. It can:
- Filter unnecessary traffic
- Remove duplicate packets
- Select relevant traffic
- Distribute traffic across multiple tools
This allows monitoring and security platforms to focus on the data that matters most.
A Unified Traffic Management Layer for Multiple Tools
Large enterprises, telecom operators, and critical infrastructure organizations typically deploy multiple monitoring and security systems, including: IDS/IPS，DPI，NDR，SIEM,network monitoring platforms. Without an NPB, each tool may require separate connections to network devices, creating a complex architecture.An NPB provides a centralized traffic management layer:
[ Network Traffic ]
│
▼
┌──────────────────────────┐
│ Network Packet Broker │
└──────────────────────────┘
│ │ │
┌────┘ │ └────┐
▼ ▼ ▼
[ IDS ] [ DPI ] [ SIEM ]
By connecting network infrastructure with security and analytics platforms, NPB transforms networks from: “The network is running, but we do not know what is happening.” into:“We can see, analyze, and manage every communication across the network.” This is why NPB has become a critical component of network visibility architectures for telecom operators, financial institutions, power and energy companies, and large enterprises.
How Does a Network Packet Broker (NPB) Work?
A typical NPB workflow consists of three core steps:
Step 1: Traffic Acquisition
The NPB first captures network traffic from various ingestion points across the infrastructure. Sources include: Network TAPs, switch SPAN/mirror ports, and live network links.
Step 2: Traffic Processing
The NPB processes and manipulates data packets in real-time based on user-defined policies.
Packet Filtering: Selects only the required data by filtering based on IP addresses, MAC addresses, VLAN tags, TCP/UDP ports, or protocol types.
Traffic Aggregation: Combines traffic from multiple network interfaces into a single, cohesive stream for the analytical tools.
Packet Replication: Multiplies and copies a single traffic stream to deliver it to multiple monitoring tools simultaneously.
Packet Deduplication: Eliminates duplicate packets captured at multiple tapping points to drastically improve back-end tool efficiency.
Packet Slicing: Clips out sensitive or unnecessary payload data while preserving key headers, reducing the processing load on monitoring tools.
Traffic Load Balancing: Intelligently distributes massive traffic flows across a cluster of identical analytical devices without breaking session state.
Step 3: Traffic Distribution
The optimized and filtered traffic is precisely delivered to the designated destination tools:destinations include: Inline/passive security appliances, network monitoring platforms, analytical systems, and packet capture repositories.
The Workflow Loop: Ingestion → Optimization → Analysis → Network Assurance
Network Packet Broker (NPB) Architecture and Key Functional Design
In modern network observability and security architectures, the Network Packet Broker (NPB) serves as a central traffic orchestration layer. Its role is to ensure that the right traffic is delivered to the right tools, in the most efficient way possible. From an architectural perspective, NPB capabilities are typically divided into two categories: core (stateless) functions and advanced (stateful) functions. Each plays a distinct role and is implemented differently to balance performance and processing depth.
Core Functions: High-Performance Traffic Steering at Line Rate
Core functions focus on efficiently managing and distributing traffic without introducing latency or complexity. The goal here is straightforward: reduce unnecessary load on downstream tools and ensure optimal utilization of monitoring and security systems. These capabilities are typically implemented directly in switching ASICs, enabling terabit-level throughput and ultra-low latency.
Key capabilities include:
- Packet Filtering – Select traffic based on L2–L4 headers (e.g., 5-tuple)
- Traffic Aggregation – Combine multiple TAP or SPAN sources into unified streams
- Load Balancing – Distribute flows across tools while maintaining session consistency
- Traffic Replication – Send the same traffic to multiple tools simultaneously
- Packet Modification & Tagging – Add metadata or adjust headers for downstream processing
- Packet Slicing – Trim packets to essential headers to reduce bandwidth and storage usage
- Tunnel Decapsulation – Remove encapsulations such as GRE, VXLAN, GTP, or VLAN
In essence, this layer ensures that traffic is clean, controlled, and efficiently delivered.
Advanced Functions: Deep Processing with Stateful Awareness
As networks become more complex, simple traffic forwarding is no longer sufficient. Advanced functions provide deeper visibility by reconstructing and interpreting traffic flows.
Unlike core functions, these capabilities require maintaining full TCP/IP state, buffering packets, and performing more intensive computations. As a result, they are typically offloaded to specialized processing units rather than handled directly by ASICs. Typical advanced capabilities include:
- Packet Deduplication – Eliminate duplicate packets from multiple collection points
- Reassembly (Fragmentation & Out-of-Order Handling) – Restore complete sessions for accurate analysis
- Flow Metadata Generation (NetFlow/IPFIX) – Export summarized traffic insights
- Advanced Traffic Analytics – Measure latency, jitter, packet loss, and throughput
- Data Masking – Protect sensitive information for compliance (e.g., GDPR, PCI-DSS)
- Header-Only Forwarding – Optimize performance monitoring use cases
- High-Precision Timestamping – Nanosecond-level accuracy using IEEE 1588 / PTP
- Deep Packet Inspection (DPI) – Content-based traffic identification and analysis
This layer transforms traffic into something that is actionable, analyzable, and compliant.
Industry Implementation: A Layered, Heterogeneous Architecture
Leading vendors such as Gigamon, Keysight, and Asterfusion typically adopt a layered architecture that separates performance-critical tasks from compute-intensive processing.
ASIC Layer: Line-Rate Processing,core functions are handled by high-performance switching silicon, such as solutions from:
- Broadcom (Tomahawk, Trident)
- Marvell (Teralynx, Prestera)
- Intel (Tofino) P4 ASIC (End of Life already)
These chips are optimized for deterministic, high-speed packet processing using hardware pipelines and lookup tables.
Acceleration Layer: Advanced Processing Offload,more complex functions are offloaded to dedicated processing units:
- DPU / SmartNIC (increasingly mainstream): solutions such as NVIDIA BlueField or Marvell OCTEON provide integrated CPU cores, memory, and hardware accelerators for stateful processing
- FPGA-Based Acceleration:ideal for ultra-low latency and deterministic operations like timestamping and deduplication
- x86-Based Processing: typically used for highly flexible and compute-intensive workloads (e.g., TLS decryption or advanced analytics)
How Is an NPB Deployed?
The deployment of a Network Packet Broker (NPB) can be simplified into one key idea:
there are two primary deployment modes:
- Inline Deployment – inserted directly into the traffic path, processing live traffic
- Out-of-Band Deployment – does not touch production traffic, but works on a copied version for analysis
Inline Deployment — The “Gatekeeper” of the Network
In an inline setup, the NPB is placed directly into the main data path.Before deployment, traffic flows directly between users and servers through switches.After inserting an inline NPB, all traffic must pass through it. Nothing moves forward unless the NPB allows it. Because it sits in the critical path, the NPB gains powerful, real-time control:
- It can block, modify, or redirect malicious traffic such as attacks, viruses, or unauthorized access
- It can chain multiple security tools together, such as firewalls, IPS (Intrusion Prevention Systems), and DLP (Data Loss Prevention). Traffic is inspected step-by-step before being allowed through
- It provides failover protection (bypass). If a downstream security device fails (e.g., an IPS goes offline), the NPB can automatically bypass it and keep traffic flowing, ensuring business continuity
Inline deployment is ideal for scenarios requiring real-time enforcement, such as intrusion prevention, active firewalling, and data loss prevention. it provides extremely powerful control, but also high requirements for stability and performance, since it sits directly in the production path.
Out-of-Band Deployment — The “Invisible Observer”
Out-of-band deployment is the most common and traditional way to use an NPB. In this mode, production traffic never passes through the NPB. Instead, the NPB receives a copy of traffic via network taps and SPAN / mirror ports on switches; since it only works on copied traffic, even if the NPB goes offline, the production network is completely unaffected. This is its biggest advantage.
With this copied traffic, the NPB enables:
- Network performance monitoring – identifying bandwidth usage, latency issues, and application behavior
- Security analysis – feeding traffic to IDS (Intrusion Detection Systems) and NDR (Network Detection & Response) tools for threat detection
- Compliance and forensics – sending structured traffic data to SIEM or packet capture systems for logging and audit purposes
It widely used in data center monitoring, performance analysis, and passive security inspection. Zero risk to production traffic, which is why it represents the majority of real-world deployment.
Where Are Network Packet Brokers Deployed?
An NPB is not a device you scatter randomly across a network. It belongs in core environments that demand extreme bandwidth, rigid compliance auditing, or ironclad security. From a real-world commercial standpoint, NPBs dominate five primary battlegrounds:
- Telecom Networks: This is the highest-volume, most high-stakes scenario. Telecom networks carry astronomical amounts of data daily across mobile cores, IP backbones, and Data Center Interconnect (DCI) links. Operators deploy NPBs to aggregate and strip down this massive traffic, channeling it to Deep Packet Inspection (DPI) systems and service probes to monitor network quality and mitigate security risks.
- Financial Services: Banks, brokerages, and high-frequency trading platforms demand flawless network stability—in this sector, a dropped packet is quite literally dropped money. Here, the NPB is tasked with capturing real-time, zero-loss copies of every single transaction stream and feeding them to security audit and performance monitoring systems, all without introducing any noticeable latency to critical trading operations.
- Power & Energy: As smart grids and digital substations evolve, the security of industrial control networks (such as dispatch centers) directly impacts physical grid safety. NPBs are used to bypass-copy traffic from critical links without ever interfering with live electrical control systems. This data is fed into industrial control system (ICS) security audit platforms to watch for unauthorized commands or anomalous communication behaviors 24/7.
- Government & Critical Infrastructure:For government agencies and state-owned critical entities, the core drivers are extreme security compliance, national regulatory mandates, and strict network auditing. Unlike tech companies, these organizations rarely build in-house tools; instead, they purchase massive amounts of proprietary, third-party “black box” security systems. Here, the NPB acts as a secure “compliance data clearinghouse.” It ensures that all regulatory auditing tools receive the exact packet streams they require, while isolating those tools to prevent their own software glitches from disrupting vital public service networks.
- Tech Giants & Enterprise Campus Networks:The corporate campuses of giant enterprises and tech companies typically stack a heavy array of security and management tools, such as DLP, firewalls, NDR, and secure web gateways. While tech giants prefer in-house, distributed software capturing solutions for their production/business networks, they still rely on physical NPBs to manage complex toolchains within their internal corporate campus networks. With an NPB anchoring the infrastructure, all monitoring tools pull data directly from the broker rather than forcing engineers to manually crawl racks and mess with mirror ports, drastically simplifying campus IT operations.
Asterfusion SONiC-Based Network Packet Broker: Redefining Network Traffic Visibility
In modern data centers, AI networks, and high-speed backbone networks, traffic visibility and fine-grained scheduling are becoming more critical than ever. As the core equipment for traffic replication, filtering, and distribution, traditional Network Packet Brokers (NPBs) have long relied on proprietary hardware architectures and closed systems. Although stable in performance, they gradually fall short of meeting the scalability, flexibility, and cost requirements of next-generation networks. Against this backdrop, Asterfusion’s next-generation SONiC-based Network Packet Broker was born, redefining the form and value of NPBs through an open architecture and software-defined capabilities.
Evolution from Traditional NPB to SONiC NPB 2.0
Traditional NPB devices typically run on proprietary chips, such as the P4 architecture, which offer strong customization capabilities but also bring obvious limitations. These devices are usually deployed out-of-band and must work with TAPs or optical splitters, leading to complex network structures and high costs. Meanwhile, the closed system architecture means that functional expansion relies entirely on vendor upgrades, resulting in poor flexibility. When facing emerging demands such as AI traffic, ultra-large-scale data centers, and high-speed links (400G/800G), this architecture gradually exposes its bottlenecks.
Asterfusion’s SONiC NPB 2.0 achieves a fundamental architectural breakthrough by transforming the NPB function from a “dedicated box” into a “software application.” At its core is the Packet Broker Application (PB-APP) running on the SONiC operating system. Deployed as a container, it allows the NPB to be flexibly installed, upgraded, and expanded just like a standard application. This design not only achieves hardware-software decoupling but also empowers commodity switches with NPB capabilities, thereby natively integrating traffic processing into the network infrastructure.
Core Architecture: PB-APP + SONiC + Commodity ASIC
Architecturally, Asterfusion NPB is built on commodity switching silicon such as Marvell combined with the open SONiC ecosystem, achieving full-rate coverage from 1G to 800G. By supporting the Clos (Leaf-Spine) network architecture, the NPB is no longer limited to a single-point device but can expand into a distributed traffic processing network. This means enterprises can flexibly scale capacity as needed without replacing the entire hardware stack, significantly boosting return on investment (ROI).
Core Functional Capabilities
1️⃣ Standard NPB Functions (Hardware Line-Rate Execution)
- Traffic Filtering: Supports 5-tuple / 7-tuple filtering.
- Traffic Aggregation
- Load Balancing
- Traffic Replication
- VLAN / MAC Modification
- Packet Truncation
- Tunnel Processing: Stripping and handling of VXLAN, GRE, ERSPAN, etc.
- For more: ASIC based Standard NPB Features
2️⃣ Advanced Features (DPU + Software Enhancement)
- Packet Deduplication
- Advanced Traffic Processing & Analysis
- DPU Resource Pool Invocation
- Security Enhancement: Such as line-rate MACsec encryption.
- For more: DPU based Advanced NPB Features
Architectural Highlight: Standard functions run on the ASIC for maximum performance, while advanced functions run on the DPU for ultimate flexibility.
3️⃣ Intelligent Traffic Scheduling (NPB 2.0 Innovation)
- Flowlet Scheduling: Prevents congestion caused by elephant flows.
- Enhanced Hashing Algorithms: Improves load balancing precision.
- Fine-Grained ACLs: Enables more precise traffic screening.
- Dynamic Traffic Distribution (ARS)
Evolution: Upgrading from simple “traffic replication” to “intelligent traffic orchestration.”
Deployment Modes: From Out-of-Band to Inline
In terms of deployment, Asterfusion NPB supports not only traditional out-of-band (bypass) deployment but also inline deployment, allowing it to actively participate in data-path traffic processing. This capability enables the NPB to form service chains with security appliances like firewalls, Intrusion Prevention Systems (IPS), and Data Loss Prevention (DLP) tools, while providing automatic bypass or traffic failover in the event of a device malfunction to enhance overall network reliability and security.
DevOps & Automation Capabilities
On the operations front, Asterfusion NPB deeply integrates DevOps philosophies, supporting automated deployment and policy delivery via Ansible, alongside real-time monitoring and visual management through Prometheus and Grafana. Network operators can rapidly deploy large-scale policies using templates, significantly reducing configuration complexity and human error. This transition from “manual configuration” to “automated operations” is indispensable for modern data center networks.
Performance and Scale Advantages
Asterfusion NPB supports interface speeds up to 800G and delivers ultra-high port density. For instance, a single device can support up to 64 x 800G ports or be split into hundreds of 100G interfaces, satisfying the dual demands of bandwidth and scale required by AI clusters and hyper-scale data centers. This high-density, high-bandwidth capability gives it a distinct edge in next-generation network infrastructures.
Based on these capabilities, Asterfusion NPB is widely applicable to various scenarios, including traditional telecom carriers, financial institutions, the electrical power industry, data center traffic analysis, AI cluster monitoring, Data Center Interconnect (DCI), and network security visibility. In small and medium-sized enterprise (SME) environments, it even allows a converged deployment of switching, traffic capturing, and analysis on a single device, drastically cutting Total Cost of Ownership (TCO).
Summary
Overall, Asterfusion’s SONiC-based Network Packet Broker evolves the traditional NPB from a standalone box into a core, native capability module within the network through its open architecture, software-defined nature, commodity hardware, and automated operations. It not only elevates traffic processing performance and flexibility but also lays a sustainable foundation for the future of AI networks and hyper-scale data centers. Simply put, Asterfusion is transforming the NPB from a “box” into a “platform,” and upgrading it from a “tool” to a “network capability.”
For more:
Network Packet Broker Powered by SONiC: PB-APP Solution
Network Packet Broker Powered by SONiC: PB-APP Solution
Open Packet Broker powered by SONiC: Next Genaration NPB Solution-NPB2.0
Open Packet Broker powered by SONiC: Next Genaration NPB Solution-NPB2.0
SONiC-based Network Packet Broker 2.0: Transforming Network Visibility and Efficiency
SONiC-based Network Packet Broker 2.0: Transforming Network Visibility and Efficiency
Introducing Inline-Bypass HA for NPB
How to Choose between Marvell Octeon CN103 and CN9670 for Advanced Packet Broker Features?
A Deep Comparison of Network Packet Broker,TAP and Bypass
A Deep Comparison of Network Packet Broker/TAP &Bypass for Your Network Visibility
