NGNTA 4.2 Ships Real-Time Fragmentation Analysis & Faster Flow Charts

Fragmentation attacks — overlapping fragments, teardrop-style reassembly abuse, and oversized fragment floods — are an old technique that still shows up in the wild because they're cheap to attempt and easy to miss without dedicated visibility.

NGNTA 4.2 adds a new fragmentation analysis module to the Traffic Analysis dashboard, tracking fragment counts, reassembly failures, and overlapping-fragment events per link in real time, alongside your existing flow and protocol statistics.

• Live counters for fragmented packets, reassembly timeouts, and overlap anomalies, broken out by source and destination.
• Automatic correlation with existing threat scoring, so a fragmentation spike from a single source contributes to that source's overall risk score.
• New alert type: FRAGMENTATION_ANOMALY, available in the Threat Alerts feed and via the REST API.

On high-throughput links, the previous version of the Traffic Analysis dashboard could lag a few seconds behind live traffic during peak load. 4.2 moves flow chart updates onto a streaming WebSocket connection with incremental client-side rendering, instead of polling and redrawing the full chart on every refresh.

In internal testing on a 40 Gbps aggregation link, chart update latency dropped from roughly 2.5 seconds to under 400 milliseconds, with no increase in browser CPU usage.

$ ngnta-cli sensor status --link core-agg-01
link:        core-agg-01
throughput:  38.7 Gbps
render_mode: streaming (v4.2)
chart_lag:   0.31s  (was 2.6s on v4.1)
frag_alerts: 3 active

• New native SIEM connector for Splunk Cloud, in addition to the existing generic REST webhook integration.
• REST API rate limits increased from 60 to 300 requests/minute on Pro and Enterprise tiers.
• Log Auditing exports now support CSV in addition to PCAP for filtered packet captures.
• Dark mode contrast improvements across the Threat Alerts and Log Auditing views.
• Fixed an issue where custom mitigation playbooks could be duplicated when edited concurrently by two admins.

NGNTA 4.2 is rolling out automatically to all cloud-managed sensors this week. Self-hosted deployments can upgrade via the standard sensor update channel — no configuration changes or downtime are required, and existing alert rules and playbooks carry over unchanged.

Fragmentation analysis and the Splunk Cloud connector are available on Pro and Enterprise tiers. Sub-second chart rendering is available across all tiers, including Edge.

Questions about the upgrade? Talk to our support team →