FREMONT, Calif. – November 09, 2026 -- Niagara Networks has launched TLS 1.3 decryption for its ePacketron platform that delivers more than 90 Gbps of throughput and scales to 1 million concurrent decrypted sessions, according to the company's own performance testing.
The upgrade supports up to 110,000 new decrypted TLS sessions per second. It also adds Encrypted Client Hello (ECH)-aware selective inspection and post-quantum key-exchange support.
ECH adoption erodes hostname-based monitoring
ECH, defined in RFC 9849, protects sensitive TLS handshake information, including the actual destination hostname. That reduces the effectiveness of conventional passive monitoring and hostname-based security policies. Post-quantum cryptography adds new key-exchange mechanisms that security infrastructure must support to keep inspecting traffic.
Instead of blocking ECH or downgrading connections to non-ECH TLS, ePacketron maintains ECH-aware negotiation for supported enterprise-managed clients and permits authorized, policy-driven inspection.
Hybrid post-quantum key exchange is the default configuration
The decryption engine prefers hybrid TLS 1.3 key exchange using X25519MLKEM768, which combines classical X25519 with ML-KEM-768. ML-KEM-1024 is also supported when negotiated with compatible peers. Selective interception of eligible ECH-protected connections is subject to enterprise certificate trust and client compatibility.
Policies can apply decryption, logging, blocking or encrypted bypass based on supported destination intelligence and security requirements. Decrypted traffic is mirrored to downstream tools, and selected flows can be delivered to existing NDR, IDS/IPS, SOC and NOC platforms through Niagara's packet broker architecture.
Offloading shifts compute from security tools to a 600 Gbps acceleration layer
The capabilities build on ePacketron's acceleration architecture, which provides up to 600 Gbps of Layer 4-7 packet processing. Offloading TLS decryption, traffic filtering, packet transformation and optimization from downstream tools is intended to improve inspection efficiency and extend the value of existing security infrastructure. Security teams can prioritize traffic needing deeper analysis and leave private encrypted communications untouched.
Founder and CEO Ben Askarinam said the company is extending ePacketron beyond conventional packet brokering into what he called a new generation of Network Intelligence. Its stated aim is to give organizations greater control over encrypted traffic visibility.
Release ships with FabricFlow 12.14; demos run at Cisco Live Melbourne
The capabilities are released for ePacketron with FabricFlow 12.14. Niagara said product availability, supported deployment configurations and licensing details will be provided separately. The company will demonstrate the solution at Cisco Live Melbourne, November 9-12, 2026, Booth B14.