PacketFalcon Packet Capture Appliance
High-speed Network Packet Capture, Analysis & Forensics
Lossless 10-100G Packet Capture Appliance for Deep Network Analysis
Accelerate Packet-Level Troubleshooting, Threat Investigation, and Compliance Visibility
Full PCAP Retention | Visual Dashboards | Wireshark Ready
CAPTURE
Capture every packet at sustained speeds up to 100Gbps with lossless write-to-disk performance. FPGA-accelerated SmartNIC architecture ensures nanosecond-accurate timestamps and zero data gaps—even in high-throughput environments.
FORENSICS
Retain and index full-fidelity packet data for rapid search, replay, and investigation. Historical PCAP visibility enables precise root cause analysis before, during, and after security or performance incidents.
ANALYTICS
Transform packet data into actionable insight with Layer 2–7 metadata extraction, expert event detection, and intuitive visualization. Integrated analysis tools accelerate troubleshooting, SLA validation, and compliance reporting.
Product Selector
| Product Model | Capture Option | Storage Option | Subscription & Support Option | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1/10G | 25G | 40G | 100G | 7TB | 15TB | 30TB | 60TB | 120TB | 150TB | 240TB | 300TB | 480TB | 1 Year | 3 Year | 5 Year | |
| PacketFalcon Compact | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | |||
| PacketFalcon Portable | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | ||
| PacketFalcon Mini X | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | ||||||||
| PacketFalcon Mini | Yes | Yes | Yes | Yes | Yes | Yes | Yes | |||||||||
PacketFalcon Compact 100G Packet Capture Appliance
The PacketFalcon Compact is a powerful, rack-mountable packet capture appliance engineered for high-speed, high-volume environments where zero packet loss and forensic precision are mission-critical. Delivering sustained 100Gbps full packet capture-to-disk performance, it is purpose-built for network troubleshooting, cyber forensics, incident response, and regulatory compliance. Capable of capturing and indexing every packet across enterprise, service provider, and defense-grade networks, the PacketFalcon Compact provides full visibility into traffic before, during, and after any incident.
At the heart of this high-performance packet capture appliance is an FPGA-accelerated engine featuring 10-nanosecond timestamping, PTP synchronization, and deduplication—ensuring forensic-level accuracy and traceability. With up to 300TB of onboard hardware-encrypted storage, it supports long-term retention at scale. Advanced features such as capture compression, intelligent filtering, dynamic packet slicing, and real-time capture optimization help maximize storage efficiency without compromising data fidelity. Integrated hardware RAID (0, 5, 6, 50, 60) further enhances performance and data protection, making it ideal for large-scale, mission-critical deployments. Supporting both PCAP and PCAP-NG formats, the PacketFalcon Compact integrates seamlessly with popular analysis tools like Wireshark and Suricata.
It also includes comprehensive, preloaded dashboards and analytics software—enabling IT and security teams to rapidly investigate traffic, correlate events, and take decisive action without third-party dependencies. Designed for deployment in data centers, NOCs, and SOCs, this enterprise-grade packet capture appliance offers unmatched speed, scalability, and forensic insight. The PacketFalcon Compact is the definitive solution for organizations that require deep, real-time network visibility and resilient, full-fidelity packet capture at scale.
- Protect SLA performance with sustained, lossless 100Gbps packet capture and up to 300TB NVMe on-board storage for extended forensic retention and historic packet replay that ensures no critical traffic is missed
- Accelerate MTTR through FPGA-accelerated SmartNIC architecture with nanosecond timestamp precision, rapid indexing, and instant packet search
- Advanced capture optimization (filtering, compression, slicing, deduplication) and PCAP/PCAP-NG export with Wireshark compatibility for seamless tool integration
- Strengthen compliance & audit readiness with full-fidelity packet retention and FIPS 140-2 encryption options
- Reduce operational risk with RAID storage and high-availability enterprise-grade 1U rack-mount design with redundant power and hot-swappable cooling
- Enable faster root cause analysis with complete historical packet visibility before, during, and after incidents
- Support regulatory mandates across finance, healthcare, critical infrastructure, and government environments
- Continuous 100Gbps capture-to-disk (CTD) lossless full packet capture (Up to 125Gbps with slicing and/or compression enabled).
- Up to 2 high-speed FPGA SmartNIC capture cards supporting 1G/10G/25G/40G/100G interfaces
- 30TB to 300TB enterprise NVMe SSD storage capacity
- FPGA-based nanosecond-accurate timestamping with IEEE 1588v2 PTP support
- FPGA-based deduplication, dynamic packet slicing, and capture filtering
- 8GB/12GB hardware buffer for microburst absorption and traffic analysis
- Operating system on RAID 1 NVMe M.2 SSD (BOSS architecture)
- PCAP and PCAPNG support with intuitive WebUI for analysis and export
- Integrated expert event detection with Layer 2–7 visibility and metadata correlation
- Advanced visualization of communication flows, packet relationships, and performance metrics
- VoIP and video analysis with performance troubleshooting capabilities
- Optional hardware-encrypted capture storage (FIPS 140-2 compliant; ISO/IEC 27040 and NIST 800-88 aligned)
- 10G management interface
- 1U rack-mount chassis with redundant hot-swappable 2 x 700W Titanium power supplies
| SKU | SSD Storage | Capture Smartnic 1 | Capture Smartnic 2 |
|---|---|---|---|
| NX-LC-25G-*TB-CT-**Y | 30TB, 60TB, 150TB, 300TB | 4 x 1G/10G/25G SFP28 | |
| NX-LC-40G-*TB-CT-**Y | 30TB, 60TB, 150TB, 300TB | 2 x 40G QSFP+ | |
| NX-LC-100G-*TB-CT-**Y | 30TB, 60TB, 150TB, 300TB | 2 x 100G QSFP28 / 2 x 40G QSFP+ | |
| NX-LC-25G25G-*TB-CT-**Y | 30TB, 60TB, 150TB, 300TB | 4 x 1G/10G/25G SFP28 | 4 x 1G/10G/25G SFP28 |
| NX-LC-25G40G-*TB-CT-**Y | 30TB, 60TB, 150TB, 300TB | 4 x 1G/10G/25G SFP28 | 2 x 40G QSFP+ |
| NX-LC-40G40G-*TB-CT-**Y | 30TB, 60TB, 150TB, 300TB | 2 x 40G QSFP+ | 2 x 40G QSFP+ |
| NX-LC-25G100G-*TB-CT-**Y | 30TB, 60TB, 150TB, 300TB | 2 x 40G QSFP+ | 2 x 100G QSFP28 / 2 x 40G QSFP+ |
| NX-LC-100G100G-*TB-CT-**Y | 30TB, 60TB, 150TB, 300TB | 2 x 100G QSFP28 / 2 x 40G QSFP+ | 2 x 100G QSFP28 / 2 x 40G QSFP+ |
PacketFalcon Portable 100G Packet Capture Appliance
A compact, high-performance packet capture powerhouse designed for mobility without compromising speed, storage, or forensic precision. Built for field teams, tactical deployments, and mobile incident response, this ultra-fast solution delivers sustained 100Gbps full packet capture-to-disk performance in a rugged, portable form factor. Whether you’re troubleshooting network outages, investigating breaches, or responding to compliance audits, the PacketFalcon Portable provides before-during-after visibility with deep packet-level insight anywhere, anytime.
Equipped with a powerful FPGA-based architecture, the PacketFalcon Portable ensures precision with 10-nanosecond timestamping, PTP synchronization, and deduplication, making it ideal for high-stakes forensic and regulatory environments. It boasts an unmatched 480TB of onboard hardware-encrypted SED storage, supporting FIPS 140-2 compliance for secure handling of sensitive or classified data. With capture compression, intelligent filtering, dynamic slicing, and full RAID support (0, 5, 6, 50, 60), this system optimizes capacity and performance even under extreme data loads.
Seamlessly compatible with PCAP/PCAP-NG formats and tools like Wireshark and Suricata, the PacketFalcon Portable comes ready with out-of-the-box dashboards and built-in analysis software, enabling field teams to search, visualize, and investigate traffic in real time or retrospectively. Whether on a mission-critical site, inside a secure facility, or across multi-domain operations, the NEOX PacketFalcon Portable delivers enterprise-grade packet visibility and forensic depth in a truly mobile platform—empowering defense, government, and enterprise teams with rapid, on-demand network intelligence.
- Industry’s only 100Gbps-capable portable packet capture appliance
- Protect SLA performance in remote and mobile environments with sustained, lossless 100Gbps packet capture and up to 480TB high-speed storage for extended forensic retention and historic packet replay wherever visibility is required
- Accelerate MTTR in the field through FPGA-accelerated SmartNIC architecture with nanosecond timestamp precision, rapid indexing, and instant packet search for on-demand diagnostics
- Advanced capture optimization (filtering, compression, slicing, deduplication) and PCAP/PCAP-NG export with Wireshark compatibility enable seamless integration into existing SOC and NetOps workflows
- Strengthen compliance & audit readiness outside the data center and service provider with full-fidelity packet retention and optional FIPS 140-2 hardware-encrypted storage
- Reduce operational disruption with hot-swappable SSDs, ruggedized portable chassis design, and enterprise-grade performance engineered for tactical and mission-critical deployments
- Enable faster root cause analysis across distributed networks with complete historical packet visibility before, during, and after incidents
- Support regulatory and lawful intercept requirements in telecom, defense, critical infrastructure, and industrial environments
- Sustained and lossless 100Gbps full packet capture-to-disk
- Up to 3 high-speed FPGA SmartNIC capture cards supporting 1G/10G/25G/40G/100G
- 4 x SFP28 and/or 2 x QSFP+/QSFP28 network ports
- 7TB to 480TB SSD storage capacity
- FPGA-based nanosecond-accurate timestamping with IEEE 1588v2 PTP support
- FPGA-based deduplication, dynamic packet slicing, and capture filtering
- Optional self-encrypting drives (SED) with FIPS 140-2 hardware encryption
- 8GB/12GB hardware buffer for microburst absorption
- PCAP and PCAPNG support with integrated WebUI and fast search engine
- Integrated Layer 2–7 expert event detection and metadata analytics
- VoIP and video performance analysis
- 1+0 AC redundant-grade power architecture (1000W 80Plus Gold PSU)
- Portable chassis with side-to-side airflow and ruggedized construction
- Designed for field diagnostics, mobile operators, remote industrial and defense environments
| SKU | SSD Storage | Capture Smartnic 1 | Capture Smartnic 2 |
|---|---|---|---|
| NX-LC-25G-*TB-PT-**Y | 30TB, 60TB, 120TB, 240TB, 480TB | 4 x 1G/10G/25G SFP28 | |
| NX-LC-40G-*TB-PT-**Y | 30TB, 60TB, 120TB, 240TB, 480TB | 2 x 40G QSFP+ | |
| NX-LC-100G-*TB-PT-**Y | 30TB, 60TB, 120TB, 240TB, 480TB | 2 x 100G QSFP28 / 2 x 40G QSFP+ | |
| NX-LC-25G100G-*TB-PT-**Y | 30TB, 60TB, 120TB, 240TB, 480TB | 2 x 100G QSFP28 / 2 x 40G QSFP+ | 4 x 1G/10G/25G SFP28 |
PacketFalcon Mini X 25G Packet Capture Appliance
The PacketFalcon MiniX is a high-performance, portable packet capture appliance engineered for today’s most demanding network visibility and cybersecurity operations. Designed for environments where speed, precision, and data integrity are critical, the MiniX delivers sustained 25Gbps full packet capture-to-disk performance in a rugged, compact form factor. Ideal for forensics, incident response, network troubleshooting, and compliance, it enables both real-time and retrospective traffic analysis—capturing every packet before, during, and after an event with surgical accuracy.
At its core, the MiniX features a powerful FPGA-based capture engine that ensures high-throughput ingestion with zero packet loss. Forensic-grade 10-nanosecond timestamping, PTP synchronization, and deduplication ensure complete accuracy and consistency in captured data. With up to 32 TB of onboard NVMe storage and optional Self-Encrypting Drives (SED), this packet capture appliance protects sensitive data through robust hardware-level encryption—ideal for regulated sectors and mission-critical deployments.
Advanced capabilities such as dynamic slicing, intelligent capture filtering, and on-the-fly compression help optimize storage while focusing on the most relevant network traffic. All data is stored in PCAP or PCAP-NG formats and is fully compatible with analysis tools like Wireshark and Suricata, ensuring seamless integration with existing security workflows.
Bundled with intuitive dashboards and built-in analytics software, the PacketFalcon MiniX offers out-of-the-box visibility and rapid investigation tools without the need for third-party solutions. Whether deployed in SOCs, remote field sites, or tactical environments, this compact packet capture appliance delivers unmatched performance, mobility, and insight. The MiniX is the next evolution in portable packet capture—empowering cybersecurity teams to respond with speed, confidence, and precision.
- Protect SLA performance at remote sites and branch locations with sustained, lossless 25Gbps packet capture and up to 32TB onboard storage for targeted forensic retention and historic packet replay
- Accelerate MTTR in distributed environments through FPGA-accelerated capture architecture with nanosecond timestamp precision, rapid indexing, and instant packet search for fast troubleshooting
- Advanced capture optimization (compression, slicing, deduplication) and PCAP/PCAP-NG export with Wireshark compatibility enable seamless integration into existing SOC and NetOps workflows
- Strengthen compliance & audit readiness in space-constrained deployments with full-fidelity packet retention and portable, power-efficient design
- Reduce operational overhead with ultra-compact form factor, low power consumption, and flexible desktop, under-desk, or remote-site installation
- Enable faster root cause analysis across branch, edge, and tactical networks with precise packet-level visibility before, during, and after incidents
- Support distributed enterprise, industrial, and service provider edge deployments with scalable, cost-effective full-packet capture
- Sustained lossless full packet capture up to 25Gbps with 7TB–32TB internal SSD storage capacity in compact, lightweight portable chassis
- High-speed FPGA SmartNIC capture card supporting 1G/10G/25G with 4x SFP28 network ports
- Nanosecond-accurate timestamping with IEEE 1588v2 PTP support
- • FPGA-based deduplication and dynamic packet slicing
- 4GB/8GB hardware buffer for microburst absorption
- PCAP and PCAPNG support with integrated WebUI and fast search engine
- Layer 2–7 metadata extraction and expert event detection
- VoIP and video analysis capabilities
- External 150W AC power
| SKU | SSD Storage | Capture Smartnic |
|---|---|---|
| NX-LC-25G-7TB-MX-**Y | 7 TB | 4x 1G/10G/25G SFP/SFP+/SFP28 |
| NX-LC-25G-15TB-MX-**Y | 16 TB | 4x 1G/10G/25G SFP/SFP+/SFP28 |
| NX-LC-25G-30TB-MX-**Y | 30 TB | 4x 1G/10G/25G SFP/SFP+/SFP28 |
PacketFalcon Mini 10G Packet Capture Appliance
The PacketFalcon Mini is a next-generation, ultra-compact packet capture appliance purpose-built for modern IT, security, and compliance teams that require complete network visibility without the bulk. Designed to deliver high-performance full packet capture, indexing, and historical analysis in a lightweight, energy-efficient form factor, it’s the ideal field-ready solution for advanced packet capture, forensic analysis, troubleshooting, and incident response. Engineered with a fanless passive cooling system, this quiet yet powerful packet capture appliance delivers sustained 10Gbps capture-to-disk performance. Its robust FPGA-based architecture ensures zero packet loss, even under peak traffic conditions. With up to 32TB of onboard storage using high-performance SATA drives and support for hardware RAID configurations (0, 5, 6, 50, 60), the PacketFalcon Mini offers both capacity and resilience.
Advanced features such as capture compression, dynamic slicing, intelligent filtering, and deduplication help optimize storage use while focusing only on critical network traffic. Whether for proactive threat hunting or post-event forensic investigations, the PacketFalcon Mini guarantees no loss of crucial data. All traffic is stored in PCAP/PCAP-NG formats and integrates seamlessly with analysis tools like Wireshark and Suricata.
With 10-nanosecond hardware timestamping via FPGA-based PTP, it provides forensic-grade accuracy for event reconstruction. Preloaded dashboards and analytics tools offer real-time visibility out of the box—no complex setup or external integrations needed. Whether deployed in secure operations centers, mobile teams, or tactical edge environments, the PacketFalcon Mini delivers unmatched performance, portability, and reliability. In today’s high-stakes digital landscape, this compact packet capture appliance ensures every packet is captured, every time.
- Protect SLA performance at branch offices and remote sites with sustained, lossless 10Gbps packet capture and up to 32TB onboard storage for targeted forensic retention and historic packet replay
- Accelerate MTTR in distributed environments through FPGA-accelerated capture architecture with nanosecond timestamp precision, rapid indexing, and instant packet search for rapid troubleshooting
- Advanced capture optimization (compression, slicing, deduplication) and PCAP/PCAP-NG export with Wireshark compatibility enable seamless integration into existing SOC and NetOps workflows
- Strengthen compliance & audit readiness in space-constrained deployments with full-fidelity packet retention and compact, cost-efficient design
- Reduce operational overhead with low power consumption, fanless operation, and flexible desktop or remote-site deployment
- Enable faster root cause analysis across edge, branch, and tactical networks with precise packet-level visibility before, during, and after incidents
- Support distributed enterprise, industrial, and service provider environments with scalable, entry-level full-packet capture
- Sustained lossless full packet capture up to 10Gbps with 7TB–32TB internal SSD storage capacity
- FPGA SmartNIC capture card supporting 1G/10G with 4 x SFP28 network ports
- Nanosecond-accurate timestamping with IEEE 1588v2 PTP support
- FPGA-based deduplication and dynamic packet slicing
- 4GB/8GB hardware buffer for microburst absorption
- PCAP and PCAPNG support with integrated WebUI and fast search engine
- Layer 2–7 metadata extraction and expert event detection
- VoIP and video analysis capabilities
- External 330W AC power adapter
- Compact portable chassis with passive convection cooling (fanless design)
| SKU | SSD Storage | Capture Smartnic |
|---|---|---|
| NX-LC-25G-64GB-7TB-M-**Y | 7 TB | 4x 1G/10G/25G SFP/SFP+/SFP28 |
| NX-LC-25G-64GB-15TB-M-**Y | 15 TB | 4x 1G/10G/25G SFP/SFP+/SFP28 |
| NX-LC-25G-64GB-30TB-M-**Y | 30 TB | 4x 1G/10G/25G SFP/SFP+/SFP28 |
Frequently Asked Questions
• 1 What options are available for a packet capture appliance in this product family?
NEOX PacketFalcon family includes four (4) models: two smaller, lightweight, and portable models (Mini & Mini X) that provide 10/25Gbps capture-to-disk (CTD) performance, and two 100Gbps (and below) CTD performance models (Portable & Compact), one portable and one rack-mountable.
• 2 Are there any other packet capture appliance products NEOX offers in addition to this family?
Yes. NEOX also offers the PacketGrizzly packet capture appliance, which offers much more extensible storage options, suited for bigger and longer-lasting data applications.
• 3 Which PacketFalcon packet capture appliance models are portable and can be moved around?
PacketFalcon Mini, Mini X, and Portable are all portable. However, Mini and Mini X are designed to be placed under the desk or on a shelf in a rack and can be moved around. You still need an external monitor to be plugged in for analysis. PacketFalcon Portable is purpose-built for mobile applications with a carrying case and built-in monitor.
• 4 Which PacketFalcon packet capture appliance models are rack-mountable?
PacketFalcon Compact is a 1RU rack-mountable product designed for the data center.
• 5 What are the capture speeds NEOX packet capture appliance products can support the highest?
NEOX packet capture appliances can support 1, 10, 25, 40, and 100Gbps “sustained” packet capture, unlike the competition, where capture speed can burst to 100Gbps for a shorter duration only.
• 6 What is the minimum and maximum on-board storage capacity NEOX packet capture appliance products can support?
NEOX PacketFalcon packet capture appliances can support a minimum of 7TB and a maximum of 480TB onboard SSD storage. Should you need more storage capacity, you can consider PacketGrizzly products.
• 7 What kind of storage is available on your packet capture appliances?
NEOX PacketFalcon supports solid-state disk (SSD) storage that is much faster for concurrent read/write, i.e., capture and analysis operations. It has a longer shelf life and fewer chances of going corrupt for data loss. We also offer storage encrypted disks (SED) option for more sensitive deployments.
• 8 How do I know how much storage capacity I need to order?
It depends on the packet sizes, the traffic rate, and any capture filters turned on – as well as smart features such as storage compression. You can use the Storage Capacity Calculator provided under each PacketFalcon model.
• 9 Do you support Wireshark with your packet capture appliances?
Yes. Wireshark is always an option. However, all PacketFalcon appliances ship with enterprise-grade analysis software with more advanced features and analysis capabilities.
• 10 What are the analysis software license costs?
The NEOX PacketFalcon onboard analysis software is a subscription license for 3 years by default. However, 1-year and 5-year options are available as well for budget constraints or for long-term peace of mind.
• 11 Do you support breakout cables for lower speeds to capture from and multiple concurrent captures?
Yes. All PacketFalcon packet capture appliances support the breakout option and concurrent capture streams. However, we highly recommend the dual-capture SmartNIC option so you can natively plug the 10/25G and 40/100G ports to it.
• 12 Do NEOX PacketFalcon packet capture appliance products ship with optics?
No. You have to order the optics separately, and we recommend ordering the NEOX pre-qualified optics for peace of mind.
• 13 How do I plug the packet capture appliance into my network? Do I also need to buy TAPs?
Yes, you would need TAPs or a Network Packet Broker for out-of-band capture. SPAN is possible but not recommended, to fully capitalize on the high-performance capture potential of PacketFalcon. There are several economic cost options available with NEOX PacketRaven portable TAPs.
• 14 What are the service and support options available?
NEOX PacketFalcon ships by default with a 3-year Silver support level. It can be upgraded to the Gold level. A 1-year and 5-year option is also available under each service tier. See the Service & Support page.
• 15 Can I get the pricing or see a demo of the product?
Of course. You can Request a Quote or Request a Demo anytime.
FEATURED RESOURCES
Network Visibility for Our Customers
Infographic
Why You Need Packet Capture
Video
Why Use Network Packet Capture
Case Study
100G Packet Capture in Telecom Network
Deployment
SERVICE & SUPPORT
Unparalleled Multi-Level Service & Support for Peace of Mind
All NEOXPacketFalcon Capture Appliances come with NEOX SILVER Support and can be upgraded to GOLD Support for advanced replacement in case of a hardware failure.