Network monitoring interface card

A network monitoring interface card (NMIC) or network monitoring card, sometimes informally called a capture card, is similar to a network card (NIC). However, unlike a standard network card, an NMIC is designed to passively (and silently) listen on a network. At a functional level, an NMIC may differ from a NIC in that the NMIC may not have a MAC address, may lack the ability to transmit, and may not announce its presence on a network. Advanced NMICs have features that include the ability to offload CPU-intensive processing from a system's CPU, accurate time measurement, traffic filtering, and the ability to perform other application-specific processing.

Organizations often use a dedicated interface for all management traffic and thus create a management network. This is done to minimize the impact on production traffic, ensure the integrity of management traffic, and it helps by measuring true production traffic, not the traffic generated by the act of measuring traffic. This is a separate function from NMICs that are used for data collection and processing.

NMICs are typically used in intrusion detection and prevention (IDS/IPS), lawful interception, flow analysis, network monitoring, and protocol analyzer systems.

Notable manufacturers include Endace, SolarFLare and Intel.

See also

• Egress filtering
• Flow analysis
• Ingress filtering
• Intrusion-detection system (IDS)
• Lawful interception
• Network monitoring
• Network tap
• Packet analyzer
• SS7 probe
• TCP Offload Engine (TOE)
• TCP segmentation offloading
• Unified Threat Management (UTM)