From Vienna to CERN: The European Innovation Behind Modern Network and Timing Infrastructure

Sub-nanosecond timing over Ethernet was not born in a product roadmap. It came out of CERN, where physicists needed the White Rabbit protocol to synchronize instruments across a particle accelerator with a precision that ordinary networking had no reason to attempt. The specification is now folded into IEEE 1588-2019 as the High Accuracy profile, and it has quietly become the reference point that timing vendors across Europe still measure themselves against.

That is a useful way to think about a handful of the vendors in Telnet’s own portfolio. They are not the biggest names in their categories, but they tend to be the ones doing the interesting engineering: a packet broker maker in Vienna, a clockmaker in western France that has been keeping time since before the telephone, a Suricata-based security platform built by open-source developers in Paris. Here is what each of them has been building lately.

Cubro: Precision Engineering With New Backing

Cubro has been designing network packet brokers, TAPs and probes out of Vienna since 2003, and in December 2025 the Swedish industrial group Addtech acquired a majority stake in the company. For a Telnet customer, the practical upshot is stability: Cubro keeps its Vienna engineering team and roadmap, now with a publicly traded parent behind it (Addtech trades on Nasdaq Stockholm).

The product itself keeps moving. Cubro’s Omnia platform runs application-layer classification directly on the packet broker, an architecture the company has been pushing further as encrypted traffic makes payload-based inspection less useful across the industry. It is the same “classify once, distribute everywhere” idea that shows up increasingly in how Telnet evaluates network visibility architecture generally, and Cubro is one of the vendors building toward it in hardware.

Profitap: Forty Years of TAPs, Reshaped for OT

Profitap’s roots go back to 1984 in Strasbourg, France, before the company relocated its headquarters and R&D to Eindhoven, Netherlands. That history matters less than what the team has done recently with it: the IOTA platform extends Profitap’s TAP and packet-broker lineage into portable, high-precision capture kits built for operational technology networks, where nanosecond-level timestamp accuracy in packet capture is often the difference between a diagnosable incident and a guess.

Profitap’s engineering has always leaned toward the physically compact and the field-deployable, and IOTA is the clearest expression of that instinct: fly-away capture kits that a field engineer can carry to a substation or a plant floor rather than a rack that has to be provisioned in advance.

Infosim: A University Spin-out That Stayed Independent

Infosim was founded in 2003 as a spin-out from the University of Würzburg, and more than twenty years later it is still headquartered there, still privately held, and still developing StableNet entirely out of its German R&D team. That kind of continuity is unusual in network management software, where consolidation is the norm.

StableNet’s release cadence has stayed active through that independence. Its unified approach to fault, performance and configuration management remains vendor-agnostic by design, which is a deliberate choice for a company that could have built a walled garden and didn’t.

Timebeat: Timing Software Built on Open Standards

Timebeat is a UK company building PTP and NTP synchronization as software first, hardware second, which is close to the opposite of how most of the timing industry has historically worked. Its stated position on vendor lock-in is blunt: interoperability is the point, not a concession. The Timebeat.app daemon replaces chrony, ntpd and ptp4l on a host, and the company’s grandmaster hardware line extends the same open approach into rack appliances and PCIe timecards.

Timebeat also builds explicitly for interoperability with White Rabbit-based networks, which is the same protocol lineage that opened this post. It is a small detail, but it says something about how connected European timing engineering still is to that original CERN work, even decades and several product categories removed from it.

Bodet: From Mechanical Clockmaking to Network Time

Bodet has been making clocks in Trémentines, France since the 19th century, long enough that the company’s own history predates the electrical grid it now helps synchronize. The relevant point for a network engineer is less the heritage and more what Bodet has done with it: its Netsilon line brings that clockmaking precision into NTP and PTP master clock appliances built for the same digital infrastructure everyone else in this post is building for.

Telnet has deployed Bodet clock systems where functional requirements could not be met by any other vendor and operational requirements were absolute. Performance has always met or exceeded the required standards.

Stamus Networks: Open-source Security Engineering Out of Paris

Stamus Networks was founded in 2014 by Éric Leblond and Peter Manev, both long-time core developers of Suricata, the open-source intrusion detection engine that much of the network security industry builds on in one form or another. Stamus is dual-headquartered in Paris and Indianapolis, but its product engineering and much of its leadership remain rooted in the same open-source security community that produced Suricata in the first place.

Clear NDR, Stamus’s flagship platform, turns that Suricata foundation into a full network detection and response system, and the company has kept contributing back to the open-source project rather than treating it purely as a dependency. That is a meaningfully different posture from most commercial NDR vendors, and it shows in how transparent Clear NDR is about what it is actually doing under the hood.

The Common Thread

None of these companies are chasing the same trend at the same time. Cubro is scaling with new capital behind it. Profitap is pointing forty years of TAP engineering at OT networks. Infosim has stayed independent long enough to keep StableNet vendor-agnostic on principle. Timebeat is building timing software that assumes interoperability rather than lock-in. Bodet is doing to network time what it has done to mechanical clocks for over a century. Stamus is building commercial security on an open-source foundation it still maintains.

What connects them is a certain patience with hard engineering problems, the same patience that turned a CERN physics requirement into an IEEE standard. Telnet works with all six because each one solves a specific, technical problem well, not because of where they happen to be headquartered. But it is worth noticing, occasionally, how much of the interesting work in this industry keeps coming out of the same part of the world.

Want to know where any of these fit into your network? Get in touch with our team and we’ll help you figure out what makes sense.

Infosim® provides any-to-any IoT management with StableNet®

infosim logo

The unprecedented complexity of IoT is bringing together a universe of “things” that were not designed to work together or share data. Data is increasing exponentially. Competitive edge often depends on getting new services to market quickly. New management systems can take years to roll out.

Now there’s StableNet® — an innovative, flexible platform from Infosim® that delivers any-to-any management. Based on high-performance Intel® architecture, StableNet brings new levels of interoperability and assurance to both legacy and modern infrastructure.

StableNet® helps ensure protocols, networks, databases, and applications can talk to each other securely. It provides holistic, end-to-end visibility to simplify management of complex systems and speed time to insight for informed decision making.

StableNet® is a certified Operational Support System with integrated configuration, fault, performance, and services management, including fully automated root cause analysis. It works seamlessly across vendors, silos, systems, and technologies and can be operated in legacy or highly dynamic flex-compute or cloud environments.

Intel® architecture adds essential business-level capabilities, enabling increased performance, manageability, connectivity, analytics, and advanced security. Infosim®’s modular licensing model allows companies to pay for what they need, and scale up or down as their business evolves.

With StableNet® powered by Intel technology, the common “zoo” of management systems becomes manageable — helping your business to thrive and compete in our connected world.

Watch Intel’s video below about Infosim’s StableNet

To learn more about Infosim, and StableNet, or to sign up for your free trial, visit our website here

 Thanks to Infosim for this article and video

Infosim’s SDN/NFV-enabled Security Architecture for Enterprise Networks

Infosim® together with University of Würzburg, TU Munich & genua mbH

Key Learning Objectives 

  • ​The SarDiNe Research Project
  • Fine-grained Access Control in SDN Networks
  • Resiliency and Offloading for a Firewall Virtual Network Function
  • SDN/NFV & Cloud managed by StableNet®

The ever-increasing number and complexity of cyber threats is continuously causing new challenges for enterprises to keep their network secure. One way to tackle these challenges is offered by SDN/NFV-enabled approaches.

Next stop Würzburg, join the SarDiNe research group, talking about the prospects of a seamless integration of SDN/NFV-based security operations into existing networks. The SarDiNe research team just came back from SIGCOMM 2017 in L.A. where they presented a demo about SDN/NFV-enabled security for enterprise networks. For this Webinar, Infosim got four of them to talk about the joined research project and the demo they presented.

Watch the webinar below

Try your free 30 Day StableNet trial here today

 Thanks to Infosim for this article and webinar

Infosim: Go with the flow – choose the right tool though!

NetFlow is a handy tool in the daily work of Network Admins and Analysts. It can be used to measure traffic in networks from an End-to-End perspective, and allows the filtering by several types of data:

  • ​Time
  • Source/destination IP
  • Source/destination port numbers (at least for UDP and TCP)
  • Ingress interface SNMP ifIndex TOS information
  • AS numbers
  • TCP flags
  • Protocol type

How does it work?

NetFlow information is exposed by compatible routers or switches. These can be configured to send their NetFlow data in a well-defined format to a dedicated collector that is responsible for storing the data. A reporting engine can then access the data storage and perform analysis, create a statistic, plot charts for the end-user, etc. But, when drilling down into the details, it is unfortunately not as easy as it sounds.

Flow fragmentation

Originally developed by Cisco, NetFlow has developed into an open standard (https://tools.ietf.org/html/rfc3954), but has also spawned other types of Flow implementations over time, like sFlow, cFlow, jFlow, IPFIX, only to name a few. Some of them are compatible with each other, others are not – like NetFlow and sFlow. Furthermore, also the orginal NetFlow specifications have experienced multiple revisions, and in the wild, there are different versions. Maintaining support for all those versions is not trivial.

Data storage

As NetFlow is a passive monitoring tool, you cannot simply query the Flow emitters. Quite the contrary, data is sent once – via UDP. What’s worse is that the data volume, which might be considerably high, is likely to be sent in bursts. That means the Flow collector must be able to handle all the incoming packets with sufficient speed. If there are packet drops or I/O problems, the data is lost. To perform in a Telco-grade network, the monitoring solution must be well-designed and decouple data collection from necessary data preprocessing and storage.

Correlating the data

Once the data is collected, you would want to make use of it via reports, for example. As you likely have multiple Flow emitters in your network, it is also likely that you have to handle multiple Flow versions. Therefore, it is crucial to preprocess and transform the Flows into a unified data format to provide version-spanning reporting. If you have a large network, you will need multiple Flow collectors to handle the vast amount of data. In order to provide also collector-spanning reporting, you will eventually need a central database where it all comes together.

However, bringing it all together is often not enough. Flows only contain “raw” information about source and target: IP addresses, ports, and protocol information. Most of this only becomes valuable in a bigger scope – when you correlate the IP addresses to actual devices and their related services and topology. This enables you to not only track top talkers in your network, but also keep an eye on the impact, which should be done with a method that incorporates fault management.

Integration

Most likely, there are multiple monitoring tools in place. Maybe that is because no tool has covered it all yet, or because of different departments and different preferences of the people in charge. As such, NetFlow tools will presumably never be isolated, but always part of a bigger picture. That’s why it is important to have a rich set of northbound interfaces. A relay functionality can be a big help if certain Flows should be also redirected to legacy systems due to some existing business process, or just temporarily while the new solution is evaluated without touching the daily business of the NOC.

Another integration aspect is the support for multi-tenancy. Service providers often offer statistics and other report data to their customers to give them an overview of their purchased services’ performance. As Flow packets do not carry any customer information, correlation between Flows and customers is not a trivial task.

How to choose the right tool?

​Over the years, many companies and people have realized the benefits of NetFlow. As a result, you now have dozens of free and commercial tools to choose from. As you will have noticed, a good NetFlow solution faces lots of requirements, and it is hard to cover them all.

Many free solutions do not have many contributors and consequently have to focus on different parts of the NetFlow eco system – which is often about collecting, storing, and reporting. Whereas coverage of the different Flow protocols is often good, there is still room for improvement especially on the integration side. It is also the case that those free tools often do not scale well enough to be used in a Telco environment.

Besides community-driven solutions, there are also some free professional solutions developed by companies. Most of them have a business model that allows free usage of the basic functionalities, but limits the integration, correlation, or storage functionalities. To unlock those features, you have to buy the paid version, which is reasonable, as it is made by a company that needs to pay its employees.

The unified approach

Eventually, it is likely that you will end up using a proprietary solution for your NetFlow requirements if you want to implement a solution in an advanced environment and make use of all NetFlow has to offer. That is, in a nutshell, End-to-End visibility of traffic in your network, which can only be achieved if your NetFlow tool can integrate very well in your inventory, performance, and fault management setup. As integration costs can be considerably high, a unified monitoring tool, even if it only provides basic Flow analysis and reporting capabilities, might provide the best ROI in this scenario.

Whatever road you take, make sure to keep the big picture in mind and try not to waste time implementing a solution that leads to a dead end. More information is available here on a Netflow monitoring technology solution.

Thanks to Infosim for this article.

Infosim’s Veni, Vidi, Vici: Seeing as an integral part of conquering your network Webinar

Infosim’s Global Webinar

Julius Caesar knew that, in order to conquer an issue, you need to get a good overview of the situation you are facing. In this Webinar, Infosim shows you how an ideal visualization solution can help you conquer your network issues.

Join Paul Krochenski, Sales Manager at Infosim®, and Jason Farrer, Sales Engineer at Infosim®, for a Webinar to find out more about the powerful visualization options offered by StableNet®.

Key Learning Objectives:

  • ​Unified visualization as a key to success
  • Getting to the point with customizable dashboards and reports
  • Learning from our customers’ best practices [live demo]

 Click here to register for a free 30 day trial of Infosim’s StableNet

Thanks to Infosim for this article and webinar.

Infosim’s StableNet Based on Intel Architecture Provides Any-to-Any Connectivity for IoT

Enabling data-driven insight and holistic visibility

Perhaps the central challenge as the Internet of Things (IoT) becomes a driving force in the worldwide economy is enabling secure, manageable, seamless connectivity across diverse things, protocols, systems, and infrastructures. The difficulties and risks are similar for organizations from service providers and enterprises to Telco. On the one hand, there are myriad vendors, applications, protocols, configurations, and management systems that are neither integrated nor interoperable. On the other, the sheer volume of data is ever-increasing and a digitally savvy global population and workforce are placing new demands on businesses large and small. New management systems can take years to rollout, delaying new services and revenue streams, and increasing maintenance costs. These factors create a set of complex, costly obstacles facing organizations for whom modernization is a competitive necessity.

You can download this white paper on Infosim’s Solution Brief, to learn how your organizations can easily and cost-effectively overcome the monitoring hurdle’s to take full advantage of smart systems that deliver seamless connectivity and data-driven intelligence.

Thanks to Infosim/Intel for this article