High-end monitoring tools from vendors like Splunk, SolarWinds, or Gigamon are expensive, often licensed by throughput. If a company feeds these tools "dirty" data—duplicate packets, Layer 2 keep-alives, or irrelevant video streaming traffic—they are paying premium prices for noise.
The market responded with "Network TAPs" (Test Access Points) – passive splitters that copied traffic. However, TAPs alone could not filter, de-duplicate, or load-balance traffic. Cubro recognized a niche: the need for a "middlebox" that sits between the physical fiber and the security tools. This led to the development of the (Expert Access) and later the Fiber XP series. Unlike competitors who built NPBs as an afterthought to their switching OS, Cubro built its devices from the ground up using FPGA (Field-Programmable Gate Array) technology. This architectural decision positioned Cubro as the go-to vendor for environments where latency below one microsecond and zero packet loss are mandatory. cubro network
Cubro addresses this through a sophisticated portfolio of . These devices act as the traffic controllers of the visibility network. They take raw feeds from SPAN ports and TAPs, aggregate them, filter out the noise, and deliver precise, relevant data to the monitoring tools. This ensures that a 100G link doesn’t overwhelm a 1G monitoring tool, and that security analysts aren't drowning in irrelevant packets. However, TAPs alone could not filter, de-duplicate, or
[ Production Physical / Virtual / Cloud Infrastructure ] │ ▼ [ Layer 1: Passive Network TAPs ] ◄── Permanent, zero-loss capture │ ▼ [ Layer 2: Network Packet Brokers (NPBs) ] ◄── Aggregation, filtering, L4-L7 processing │ ▼ [ Layer 3: Downstream Analytics & Security Tools ] ◄── NDR, SIEM, Firewalls, DPI Blog overview of Cubro Network Visibility Unlike competitors who built NPBs as an afterthought
The workhorses of the fleet. The EXA48F (48 x 10G ports) and the FIBER XP 8x100G are ubiquitous in data centers. They support "Any-to-Any" mapping—any input port can send traffic to any output port or group of ports. Advanced features include NetFlow generation directly from the NPB (offloading routers) and L2-L4 header manipulation .
Cubro’s implementation uses a 5-tuple hash (Src IP, Dst IP, Src Port, Dst Port, Protocol) computed in hardware. It ensures that every single packet belonging to a specific Zoom call, file download, or attack signature is sent to the exact same monitoring tool port. Furthermore, if a monitoring tool fails, Cubro supports —the entire flow is shifted to a backup tool without breaking sessions. This is a massive improvement over standard LACP or ECMP hashing.