
Aggregator C400
High-Density 400G Network Packet Broker

The Cubro Aggregator C400 is a carrier-grade, high-performance Network Packet Broker (NPB) designed for the next generation of 400 Gbps and 100 Gbps data center architectures. By providing full visibility into high-speed links, the C400 ensures that security, monitoring, and analytics tools receive exactly the traffic they need without packet loss.
Main Features of Aggregator C400
- Advanced Header Modification: Full support for OSI Layer 2, 3, and 4 header manipulation, including stripping or adding VLAN tags, MPLS labels, MAC/IP addresses, and L4 Port numbers.
- High-Density Connectivity: 32 x 400 Gbps ports via low-power QSFP112 interfaces.
- Massive Scale: Supports up to 7000 parallel filter rules with zero performance degradation.
- Throughput & Latency: Powered by a non-blocking architecture delivering up to 25.6 Tbps backplane performance with sub-700ns latency.
- Protocol Support: Native support for IPv4/IPv6, load balancing, making it ideal for large-scale enterprises.

Why Choose the C400?
- Zero Licensing Fees: All software features and applications are included in the hardware price. No per-port or per-feature hidden costs.
- Price Performance Ratio: By focusing on the core high-demand features of 400G aggregation and load balancing, the C400 offers the best balance of throughput and budget efficiency in the Cubro portfolio.
- 2-Year Warranty: Includes a base 2-year warranty period for peace of mind in mission-critical environments.
Functions & Benefits of Aggregator C400
- 40G & 100G to 400G Aggregation (n:1, 1:n; n:n)
- Break-out from 400G to 4 x 100G of every port
- Easy to configure via secure Web GUI, CLI and REST API
- Load balancing: L2 / L3 / L4 hash-based, session aware load balancing
- Filtering on multiple parameters including VLAN tags, IP addresses and TCP / UDP port numbers and much more.
- Header Modification of OSI Layer 2 to 4
- SNMPv2c and SNMPv3 support
| Number of Ports | 32 x 40/100/400 Gbps (QSFP/QSFP28/QSFP112) Break-out from 400G to 4 x 100G Break-out from 100G/40G to 4 x 25G/10G |
| Link/Port Aggregation | 1:1; 1:n; n:1; n:n – at all port/link speeds |
| Jumbo Frame Support | Supports Jumbo Ethernet frames with a size of up to 9600 bytes |
| Traffic distribution/load balancing | Traffic can be easily distributed to single ports, parallel ports or load-balancing groups |
| Filtering | Up to OSI Layer 4 including MAC, VLAN, Ethertype, IPv4/IPv6 Addresses, IP Protocol type, Layer 4 Port Numbers |
| Tag Stripping | VLAN, MPLS |
| Throughput / Latency | Non-blocking architecture with 25.600 Gbit/s throughput |
| Buffer | 64 Mbyte with intelligent buffer management to avoid congestion due to micro-bursts |
| Supervision/Logging | SNMPv2c and SNMPv3; Syslog and Web Log function |
| Unit Control | WebUI (HTTPS), CLI (SSH) and RestAPI via 10/100/1000B-T management interface |
| MTBF | 171.250 hours |
| Electrical Power | Dual 100-240V AC or 36-72V DC available |
| Cubro Vitrum Support | Yes |

Ports
- 32 x 40 Gbps / 100 Gbps /400 Gbps full duplex Ports for any kind of QSFP/QSFP28/QSFP112
- Every port supports break-out to 4 x 10G/25G/100G
- *Each port can be input and/or output, depending on the application and configuration
Performance
- Performance up to 25.600 Gbit/s
- Non-blocking design
- Boot time from power on to working is 120 sec
Management
- Management Port: (1) RJ45 10/100/1000 Mbit Configuration
Operating specifications
- Operating Temperature: 0ºC to 45ºC
- Storage Temperature: -10ºC to 70ºC
- Relative Humidity: 10% min, 95% max (non-condensing)
Mechanical specifications
- Dimension (WxDxH): 440 x 480 x 44 mm
- Weight: 12.0 kg
- Airflow: Front-back
Electrical specifications
| AC | Operating Voltage: 100~240V; 50/60Hz Maximum Voltage: 90~264V; 47~63Hz |
| DC | Maximum Voltage: -40~-72V |
- Maximum Power Consumption: 650W
- Power Supply Module: 2 (redundant & hot- swappable)
Certifications
- Compliance and Safety:
- EN 61000-3-2:2019; EN 61000-3-3:2013/A1:2019;
- EN 62368-1:2014; EN 55035/2017/A11:2020;
- EN 55032:2015/A1:2020
- EU Directives compliance: 2014/35/EU and 2014/30/EU
- RoHs Compliance: RoHS 6
Aggregation
The C400 receives traffic from a single or multiple 100 Gbps or 400G Gbps link(s) via the monitoring ports of an inline tapping device. The incoming traffic can be further aggregated to a single or multiple outputs to connect analysers and monitoring tools as required.
In the below example the C400 aggregates up-and downstream traffic of a 400 Gbit link to a single output port of e.g. 100 Gbps capacity for more economical usage of connected traffic probes/analytics systems.
By utilizing the various filtering capabilities available on the C400, users are able to further reduce the traffic volume that needs to be processed, allowing for a more accurate and quick analysis and troubleshooting.
Furthermore, incoming traffic can be VLAN-tagged per physical port for easy identification of the original physical port of a packet.
Filtering capabilities
The Aggregator C400 supports up to 7000 parallel running IPv4/IPv6 filters. These filters can be used to redirect a selected part of the incoming traffic to a low bandwidth monitoring tool.
Filtering parameters include:
| Layer 2 | Layer 2.5 | Layer 3 | Layer 4 |
|---|---|---|---|
| MAC Src / Dst | MPLS | IPv4 Src / Dst | Port Src / Dst |
| VLAN tag | IPv6 Src / Dst | ||
| Ethertype | Protocol (TCP/UDP/SCTP) |
Session-aware Load-balancing
Load-balancing is a vital function to distribute traffic across different monitoring tools evenly and correctly. The Cubro C400 supports Session-Aware Load balancing that allows every packet belonging to the same conversation/flow to be sent to the same physical output port within a load-balancing group. This ensures that connected packet sniffer or other monitoring tools get every packet of a given conversation. The C400 maintains the association of packets with each flow or conversation between any two network endpoints such that all traffic from a given flow will be output from a consistent monitor port within a load balanced group.
Flow association is done by examining selected fields within each packet and performing a mathematical algorithm called hash key calculation. The result of the calculation is used to consistently separate and distribute traffic to specific ports within a load balanced group. Depending on the requirements, the C400 allows different hash key calculations methods ensuring that packets always arrive at the correct interface of the monitoring appliance.

Other functions
- Active Tunnel Endpoint capability to receive and de-encapsulate GRE traffic
- Timestamping with 1ns resolution based on NTP or PTP
- Packet Truncation to forward only headers of a packet
- Filtering inside packet payload by means offset and pattern
- VLAN push for packet identification
Product Components
- Cubro Aggregator C400
- AC/DC power supply modules
- Power cord
- Transceivers not included
| Part Number | Description |
|---|---|
| CUB.AGG-C400 | Aggregator C400 32 x 400G, Dual AC powered |
| CUB.AGG-C400-DC | Aggregator C400, 32 x 400G, Dual DC powered |
Additional Resources
Looking for product support?
Get in touch with our technical team now


Our newsletter provides thought leadership content about the industry. It is concise and has interesting content to keep you updated with what’s new at Cubro and in the industry. You can unsubscribe anytime with a single click.
Your e-mail address is only used to send you our newsletter and information about the activities of Cubro Network Visibility. You can always use the unsubscribe link included in the newsletter.



