Network Packet Broker (NPB)

A Network Packet Broker (NPB) is an appliance or software that collects a copy of network traffic from TAP points and SPAN ports, then filters, cleans up, and distributes it to monitoring and security tools (IDS/IPS, NDR, SIEM, APM, sniffers, forensics systems). An NPB works on a copy of the traffic, off to the side of the main flow (this is called out-of-band), so it does not change or slow down production communication — unless it is deliberately placed in the traffic path (inline mode). It operates at OSI Layers 2–4 (up to Layer 7 in more advanced models). Its job is simple: give each tool exactly the packets it needs, and not bury it under the rest.

What is a Network Packet Broker?

An NPB is a broker between the place where you tap the traffic and the tools that analyze it. The production network generates traffic. That traffic is copied by TAPs (Test Access Points, that is, points that give access to a link) or by SPAN/mirror ports on switches. Raw copies from many links arrive at the NPB, which combines, trims, and distributes them to the connected systems. Without this intermediate layer, every tool would need its own capture point, and TAP/SPAN ports would quickly run out.

An NPB is not an ordinary switch. It does not forward production traffic and does not decide where to send it based on MAC addresses. It works only on packet copies and applies rules set by an administrator: it filters, replicates, slices, and spreads the load. The result is a coherent visibility fabric — a layer that makes sure the right traffic reaches the right tool, whether on a physical, virtual, or cloud network.

How does a Network Packet Broker work?

Traffic passes through an NPB in a few steps:

1. Traffic acquisition — packet copies enter ingress ports from TAPs or SPAN ports.
2. Aggregation (combining) — streams from many links merge into one, so you do not need a separate capture point for every tool.
3. Filtering — Layer 2–4 rules (up to Layer 7 in stronger models) select specific VLANs, IP addresses, ports, protocols, or patterns and pass only the relevant traffic.
4. Packet processing — deduplication, slicing, masking, decapsulation, timestamping.
5. Distribution and balancing — selected traffic is replicated to multiple destinations or spread across several copies of the same tool on egress ports.

What are the key NPB functions?

• Aggregation — combines traffic from many links into a single stream, so one tool can cover several network segments.
• Filtering — selects traffic by VLAN, IP/MAC address, port, and protocol, and, in advanced mode, by pattern (e.g., regular expressions over Layer 7 data).
• Replication — sends the same copy of traffic to several tools at once (e.g., to IDS, NDR, and a packet recorder).
• Deduplication — removes duplicate packets that show up when the same traffic is captured in several places (e.g., on both sides of a device). It eases tool load and avoids inflated counts.
• Slicing (packet truncation) — cuts the payload and keeps the headers, when a tool only needs metadata. It saves bandwidth and storage.
• Data masking — hides sensitive fields (e.g., card numbers, personal data) before traffic reaches a tool. It helps meet GDPR, PCI DSS, and HIPAA requirements.
• Decapsulation (stripping tunnel headers) — removes the “wrapping” layers of traffic (GRE, VXLAN, ERSPAN, GENEVE, MPLS) so tools see the original packets they could not otherwise interpret.
• Load balancing — spreads traffic across several copies of the same tool (e.g., an IDS sensor cluster) when a single interface cannot carry the full bandwidth. It can feed, say, 40G of traffic into four 10G interfaces.
• Timestamping — adds a precise timestamp to packets, useful for latency analysis and for tying events together.
• Metadata generation (NetFlow / IPFIX) — produces short summaries of traffic (in newer models, the so-called NGNPBs).
• TLS/SSL decryption — selectively decrypts traffic so tools can look inside encrypted sessions (in selected models).

How does an NPB differ from a TAP and a SPAN port?

A TAP (Test Access Point) is a device inserted into a link that makes a faithful copy of all passing traffic without affecting production. A SPAN (mirror) port is a switch feature that copies traffic from selected ports or VLANs to a separate port — convenient, but it loads the switch, drops packets under congestion, and may skip error frames.

TAPs and SPAN ports deliver traffic but do not manage it. An NPB sits one floor above: it takes streams from many TAPs and SPAN ports, then combines, filters, removes duplicates, and distributes them to tools. In short, TAP/SPAN is the source of visibility, and the NPB is the layer that organizes it. A simple TAP aggregator does only basic combining and filtering; a full NPB adds deduplication, slicing, masking, decapsulation, and load balancing.

How does an NPB differ from a network switch?

A switch forwards production traffic and decides where to send it based on MAC addresses and a switching table — its goal is to deliver each frame to the right address. An NPB works on a copy of the traffic, off to the side of the main flow, takes no part in production communication, and — unless set up otherwise — does not change packets. Where traffic goes follows from its filtering rules and from mapping ingress ports to egress ports, not from learning addresses. An NPB therefore does not replace a switch, or vice versa — these are two different roles.

Why is an NPB important for security?

From a SOC and network-monitoring point of view, an NPB is the foundation of packet visibility on which threat detection rests:

• Data quality for NDR/IDS — NDR tools (Network Detection and Response, that is, detection and response based on network traffic) and IDS/IPS systems work better the cleaner and more complete the traffic they get. Deduplication avoids inflated counts, and decapsulation exposes traffic hidden inside tunnels that would otherwise slip by.
• Removing blind spots — combining traffic from many TAPs and SPAN ports lowers the risk that some part of the network goes unwatched. And unwatched gaps are a classic way to evade detection.
• Scaling detection — load balancing lets you handle links faster than a single sensor, so detection keeps pace with 40/100/400 GbE traffic.
• Protecting tools from overload — filtering and slicing send only relevant traffic to sensors. Fewer dropped packets and less risk that an attack slips through while a tool is saturated.
• Forensics and packet capture — a complete, sorted copy of traffic feeds full packet capture recorders and post-incident analysis; timestamps help reconstruct the sequence of events.
• Compliance and privacy — masking sensitive fields lets you share traffic with tools and teams without breaching GDPR, PCI DSS, or HIPAA.

One thing to keep in mind: an NPB does not detect threats itself — it is only the layer that delivers data. If it is misconfigured (filters too aggressive, no deduplication, a missed tunnel), it directly weakens the detection of the tools that depend on it. NPB rules are therefore best treated as part of the monitoring policy, not a one-time setting.

Where is an NPB placed in the network?

NPBs go where you can see the most: at the internet edge, between trust zones, at the data center, in front of server farms, and in segments with east–west traffic (that is, communication inside the data center). Traffic is taken from TAPs on important links or from SPAN ports on core and distribution switches. In virtual and cloud environments, the equivalent of a physical NPB is a software broker (vNPB / cloud packet broker) that collects traffic from hypervisors and virtual networks, extending visibility across hybrid environments.

Learn more

• Secure Access Service Edge (SASE) — NPBs can feed SASE tools with selected traffic for inspection and policy enforcement.
• Probe (Sonda) — A probe collects traffic and can receive filtered packets from an NPB for analysis.
• Network TAP — A TAP copies live traffic, which an NPB can aggregate, filter, and forward.
• North-South vs East-West Traffic — NPBs help route north-south and east-west traffic to the right monitoring tools.
• NSM (Network Security Monitoring) — NPBs support NSM by delivering relevant packets to security monitoring systems.
• Deep Packet Inspection — NPBs can send traffic to DPI engines for payload inspection and analysis.
• NPM (Network Performance Monitoring) — NPBs provide packet streams to NPM tools for measuring network performance.
• Microsegmentation — NPBs can mirror traffic from microsegments to monitoring and security tools.