NIKSUN and the case for keeping every packet

The hedge fund had a problem that looked, at first, like a problem with trading. Decisions were going wrong. Somewhere in the machinery that carries market prices to the systems that act on them, information was disappearing. A sophisticated operation could make an unsophisticated mistake: respond to an incomplete picture of the market.

NIKSUN’s account of the unnamed customer describes what NetVCR and NetTradeWatch uncovered: bursts of bandwidth use, sequence gaps and missing market data. The useful discovery was beneath the trading decision, in the plumbing that supplied it. Sub-second analysis made the gaps visible. The published account identifies the mechanism; it does not put a dollar value on the recovered trading performance.

It is a good introduction to a company whose product name, NetVCR, sounds as though someone has left a video cassette in the server room. The name has aged better than the cassette. Record now. Examine later. The difficult part is knowing how much of the past to keep.

A recorder before a verdict

Parag Pruthi founded NIKSUN in 1997, following doctoral work on modeling packet traffic with chaotic maps. In a 2019 interview, he described a problem with trying to reduce the internet to a tidy set of measurements. New applications could appear before their vulnerabilities were understood. The information needed to explain an outcome depended on the particular problem being investigated.

That observation gives the company its intellectual shape. Decide too early which data matters, and you may discard the thing that answers the next question. A traffic summary can tell you that a connection existed. A retained packet can provide much more of the actual exchange. Which detail becomes decisive may only be apparent after the incident.

In his 2018 discussion with security specialist Ed Amoroso, Pruthi offered a brisk explanation of the engineering demand. Customers wanted capture without packet loss, even as traffic rates increased. They also needed the resulting record indexed so an analyst could find something in it. A warehouse is of limited use if every investigation begins by emptying its shelves.

“the packets they miss are inevitably the ones their analysts need.”Parag Pruthi, speaking with Ed Amoroso, 2018

NIKSUN’s answer combines recording with search and reconstruction. Its Knowledge Warehouse brings retained traffic and other operational data into an indexed record. An analyst can start from a suspicious connection or a performance symptom and work back through the activity around it. The company’s motto, Know the Unknown, becomes less mysterious when translated into that sequence.

One traffic record, several jobs

A security analyst and a network engineer can arrive at the same incident from different directions. One wants to know whether a large transfer is theft. The other wants to know why an application is slow. Looking at a common traffic history can help both establish what happened before debating what it means.

The product range divides those jobs. NetDetectorLive handles network detection and forensic investigation. NetVCR concentrates on network and application performance, with session diagrams that help localize delay. LogWave adds log and event correlation. NetOmni brings distributed NIKSUN units into a central view. NetTradeWatch specializes in trading traffic, where an out-of-sequence message deserves more attention than its size might suggest.

The customer problems make these distinctions easier to understand than the acronyms do. In NIKSUN’s healthcare case, operational disruption led investigators to malicious user agents and malware disguised as a PDF. In a telephony case, dropped calls at an auto services franchise traced to improper network load balancing. A manufacturer’s troublesome industrial traffic led to a programmable logic controller configuration issue.

These are vendor-published accounts, mostly with customers unnamed. They illustrate the range of investigations the tools are designed to support. They are also a reminder that a strange network event need not be an attack. Sometimes the culprit is a configuration setting with excellent credentials and terrible judgment.

The buyers include enterprises, governments and service providers. NIKSUN reports more than 1,000 enterprise and government customers across over 30 countries. Its emphasis on sensitive infrastructure explains features such as offline deployments and role-based access. In May 2025, the company announced a fifth consecutive Common Criteria certification covering its NetOmni and NetDetector/NetVCR/LogWave suite. Certification applies to evaluated products and requirements; a buyer still has a deployment to design.

Memory has a price

Keeping the record sounds easy until the arithmetic arrives. A sustained 100-gigabit-per-second stream represents 12.5 gigabytes each second. Over a day, that is approximately 1.08 petabytes of raw traffic before compression or storage overhead. A packet recorder is also a retention decision, made repeatedly and paid for in capacity.

NIKSUN sells dedicated appliances and software, with virtual, public-cloud and vendor-managed cloud options. Its appliance range extends from portable troubleshooting units to clustered systems. Current marketing describes 100 Gbps capture and multi-terabit scaling; those are company specifications to test against the proposed configuration and actual traffic mix.

The business model follows the deployment: enterprise hardware and software sales, cloud subscriptions, support and partner distribution. The managed cloud offering also targets smaller organizations. Customers can begin with a particular monitoring job and expand into the wider platform. That makes the sales conversation about both the immediate incident and the infrastructure the buyer is willing to operate.

For a sense of how long this has been an enterprise purchase, contemporary coverage around the 2001 financing reported product prices of $15,000 to $70,000, with associated consulting ranging from $100,000 to $1 million. Those figures belong to that period. Today, the practical route is a scoped proposal. Storage, traffic access, required modules and support belong in that discussion alongside the license.

The costs are organizational too. Someone has to choose capture points, govern access to sensitive traffic and decide how long evidence remains available. Encryption can preserve useful connection information while concealing content unless appropriate decryption is configured. A recorder cannot retrieve traffic that never reached it. A storage window cannot answer a question about an event it has already aged out.

The company that had to rebuild its own memory

There is an uncomfortable episode in NIKSUN’s history. A 2011 SiliconIndia profile reported that a fire at its headquarters in 2008 destroyed more than 250 servers and their data, with water and soot affecting the laboratory and inventory. The business was also facing a recession. A company selling evidence preservation had lost part of its own working infrastructure.

The profile described Pruthi treating the rebuilding as an opportunity to replace legacy systems. It also recorded his preference for a business that would last over a quick financial exit. NIKSUN’s present company materials emphasize in-house engineering of its operating system, data warehouse and analytics. That is the culture it presents publicly: a business built around owning the machinery underneath the answer.

The AI still needs something to read

By September 2026, the language around that machinery had changed. NIKSUN announced Olympus 6.1, following its April release of NIKOS Max. The pitch now combines unified network and security data with AI-assisted operations. Maya AI is presented as a natural-language route into investigations, with actions carried through workflows governed by permissions and approvals.

That development fits the older premise. An assistant can be more useful when an explanation leads back to the recorded activity. A buyer should be able to inspect what informed the answer and what action followed it. The central attraction is less typing and less movement between consoles. The hard test is whether the underlying evidence supports the conclusion.

NIKSUN sits across markets often purchased separately: packet capture, network performance, detection and forensic analysis. NETSCOUT is a relevant alternative in network monitoring; Riverbed and ExtraHop overlap in parts of performance and analytics. Feature coverage varies by product. NIKSUN’s case rests on combining retained traffic and several operational jobs in one architecture. A comparison should examine that architecture under load, rather than count boxes on a feature chart.

The useful lesson is available even to someone who never buys NIKSUN. Bring a past incident to a monitoring demonstration. Ask the vendor to reconstruct it. Measure capture loss at the busiest moment, then test the search over the retention window you actually need. Look at the evidence behind an automated verdict. The hedge fund’s missing messages are a fine reminder: the network can fail in the spaces between the numbers everyone is watching.