Network analysis devices always demand the visibility, how to access the network traffic they need, for the inspection purpose. The proper visibility we expect is to provide comprehensive data that can satisfy all analysis functions. However, each device has its “packets of interest” so that processing every packet without selection might be a waste for some devices. Thus, to boost the efficiency is to make “right packet to the right device”. In the same time, usually because of network complexity, the visibility mechanism includes packet pre-processing such as tagging/un-tagging, tunnel removal or payload slicing to make sure analysis functions can work smoothly.

Array NTB, the intelligent network visibility platform, is a network appliance powered by xUDN embedded network OS, realizes the approaches above. It creates the analysis-assisted monitoring plane to direct live traffic from the production network to every analysis device, no matter it is in-line or out-of-band, to achieve pervasive inspection and security function offloading. Moreover, Array NTB can defend network perimeters by monitoring massive malicious connections according to the imported threat intelligence, the black list of IPs/Domains/URLs, and send those events, trying to connect an object in the black list, to a log collector or SIEM.