The Easiest, Most Reliable Way to Capture, Replay and Analyze User Communications in Real Time including email, Web mail, Instant Messages (IM), Blogs, Web page views, Attachments, and more.

One, easy-to-use system captures it all

netReplay® is the only solution that records application content across network protocols, regardless of content type, platform, address, or port - without affecting network performance.
More…

Far more than a packet recorder

Unlike solutions that serve only as packet recorders, netReplay® utilizes deep packet inspection that allows it to reassemble content into the original format.  This enables retrieved content to be replayed exactly as it appeared in the original user communication.
More…

Unmatched storage capacity

netReplay’s intelligent Forensic Information Fingerprinting Engine™ (FIFE™) maximizes storage efficiency, thereby allowing one terabyte to act as ten terabytes.  netReplay’s intelligent deep-packet inspection and content capture effectively cuts out the recording of duplicate data and network content "noise."
More…

Powerful real-time indexing and forensic fingerprinting

netReplay® creates a repository of text-indexed message content, encompassing user communications and associated metadata entering or leaving the network in real-time.  It is this unique feature that empowers netReplay’s unequaled alerting, search, and retrieval capabilities.
More…

Proactive alerts

netReplay® can preempt problems by monitoring the content of communications and providing real-time alerts to management based on policy.  For example, alerts can be triggered by keywords, user ID, content types, or protocols.
More…

User-friendly interface speeds searches

netReplay's intuitive, hyperlinked graphical user interface makes it easy for anyone to quickly conduct searches. Content can be searched by keywords, user ID, document name, and other criteria - there’s simply no more powerful tool for tracking suspect content and conducting forensic investigations!
More…

More on netReplay®

Unique High-Performance Solution

Featuring a 64-bit Linux operating system, netReplay® applies an extreme computing approach to empower intelligent, best-practice content monitoring and forensic investigation.  It is the first, highly scalable, enterprise-ready network content recorder to capture, index and seamlessly replay user communications across a network environment in real-time.

Key Attributes

• Turnkey solution - out-of-the box, pre-configured to immediately capture data.
• Flexible filters - captures based on your criteria including "everything", "everything but", and "nothing except".
• Easy-to-use - "point and click forensics" with an intuitive interface that allows for quick training of technical and non-technical personnel.
• Passive, non-intrusive device that is easily deployed anywhere on the network.
• High speed monitoring for organizations with high bandwidth network traffic.
• FIFE™ technology allows one terabyte acts as ten terabytes - storing up to 10 times the amount of relevant data - by far the highest capacity in the industry.
• Ability to extend storage (and push archives) to NAS or SAN.
• Scalable - the potential to monitor and record for more than 10,000 users or employees.
• Reassembly of content from live network connection or from imported tcpdump full packet capture sessions (e.g.: Wireshark, Ethereal).

netReplay® Datasheets

netReplay® 2500 PORTABLE Datasheet (PDF)
netReplay® 4500 Datasheet (PDF)
netReplay® 8500 Datasheet (PDF)

Real-time Monitoring and Alerts

netReplay® proactively monitors the content of network communications and provides real-time alerts, based on policy.  For example, alerts can be:

• Triggered by keywords, user ID, content types, or protocols, plus many more user-defined criteria.
• Used for network security to detect unauthorized access, leakage or theft of confidential and/or personally identifiable information (PII).
• Leveraged to detect abuse of network resources by monitoring access to IT security user defined, prohibited websites or by full text content parsing.

Key Attributes

• Real-time content analysis facilitates alerts while also enabling netReplay® to reassemble collected data into original content format (e.g.: web pages, e-mails, IM conversations).
• Maximum flexibility and control of alert settings used to monitor for evidence of misconduct, inappropriate materials, leakage and theft of data.  Alert rules can be based on policy, user ID (IP address, MAC address, NT/AD username), Web sites accessed, textual content, objects and conditional event triggers, and more.

Content Indexing and Storage

netReplay® creates a repository of text-indexed message content, encompassing user communications and associated metadata entering or leaving the network in real-time.  netReplay’s intelligent Forensic Information Fingerprinting Engine (FIFE™) maximizes storage efficiency by only storing unique objects, significantly reducing storage requirements by 30-90% when compared to inefficiency of full packet dumps.  This enables one terabyte to act as ten terabytes - storing up to 10 times the amount of relevant data - by far the highest capacity in the industry.

In addition, FIFE™ provides forensically accurate evidence of user activity that helps prevent and dispel false accusations while expediting the "discovery to disciplinary action" process.  It is the combination of these unique features that empowers netReplay's unequaled alerting, search and retrieval capabilities.

Key Attributes

• Captures inbound and outbound messages.
• Exclude or include certain traffic by source, type and content or other user-selectable criteria.
• Real-time text indexing of emails, web-mail, IM conversations, websites, etc.
• Replay email, web-mail, Instant Messaging and more.

Management Reporting

netReplay® uniquely offers contextual, perpetual drill-down as well as summary reporting that covers statistics and information from network activities to contextual insights.  Network reporting focuses on content usage across the network (e.g.: number of accesses, amount of data sent/Kb, etc.), while contextual reporting enables finite granular detail of relevant content associated with a user within a few clicks.

netReplay’s pre-configured summary reports include:

• Most active user(s): identified by IP address, MAC address and NT/AD username.
• Most active protocols: (e.g.: Web, E-mail, IM, SSL, File transfers).
• Most active Content type: (e.g.: Application, Image, Video, Audio, etc.)
• Most active Alerts: Based on user criteria.

Key Technical Specifications:

System 3U or 5U rack-mount* or portable (*19inch complete with side-rails) Dual 64-bit CPUs (expandable with dual-core) 4GB or 16GB of RAM Dual-port Gigabit (copper) Ethernet DVD-ROM drive (for loading software) VGA graphics RAID subsystems and operational storage Capture & Replay Capability Email & attachments Web Instant Messaging (IM) File transfers (FT) Compressed files Content types (over 510) AND MORE …

Storage 0.8TB or 1.6TB (RAID-10 unformatted, hot-swappable) of on-line storage 2.2TB or 5.2TB (RAID-5 unformatted, hot-swappable, hot spare) of off-line (archival) storage Additional off-line storage can be added as necessary through CIFS or NFS attached storage - e.g.: NAS (Network Attached Storage) or SAN (Storage Area Network) Uses Forensic Information Fingerprinting Engine (FIFE™) to achieve maximum storage efficiency