FEDERAL BUREAU OF INVESTIGATION

Finance and Facilities Division

Procurement Section

Request for Information

Request for Information (15F0626RFITBC01)

FBI Operational Technology Division (OTD)

Ethernet Sniffer

02/23/2026

DISCLAIMER:

THIS NOTICE IS FOR INFORMATIONAL PURPOSES ONLY. THIS IS NOT A REQUEST FOR

PROPOSAL OR QUOTE. IT DOES NOT CONSTITUTE A SOLICITATION AND MUST NOT

BE CONSTRUED AS A COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY

FORM ARE NOT OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO

AWARD A CONTRACT AS A RESULT OF THIS ANNOUNCEMENT. NO FUNDS ARE

AVAILABLE TO PAY FOR PREPARATION OF RESPONSES TO THIS ANNOUNCEMENT.

ANY INFORMATION SUBMITTED BY RESPONDENTS TO THIS TECHNICAL

DESCRIPTION IS STRICTLY VOLUNTARY.

INTRODUCTION

Responses to this RFI may be used to formulate final requirements and/or to identify qualified vendors capable of meeting those requirements. The description below outlines preliminary requirements envisioned for the FBI/OTD Ethernet Sniffer. The information gathered may be used to formulate acquisition strategies for competitive solicitations.

BACKGROUND

The FBI is the principal investigative arm of the United States (U.S.) Department of Justice (DOJ). It is charged with gathering and reporting facts, locating witnesses, and obtaining evidence in cases involving federal jurisdiction. The mission of the FBI Operational Technology Division (OTD) is to deliver technology-based solutions, which enable and enhance the FBI’s intelligence, national security, and law enforcement operations.

FBI, OTD is conducting market research, seeking available sources that offer a commercially available product that meets all of the contemplated requirements identified below.

CONTRACTOR QUALIFICATIONS

This RFI is open to manufacturers who offer software and platforms related to the categories described in the BACKGROUND and CONTEMPLATED REQUIREMENT. FBI/OTD prioritizes

COTS that adheres to stringent security, compliance, and data protection standards. This RFI is for market research only to request input from potential providers of platforms/software with the stated requirements. The Government requests the following information:

1. Company name and business size.

2. Provide evidence to show that your company can provide the requested products and/or required resources (i.e. technical ability, personnel, and experience). Information provided must be succinct and related to the requested information in this RFI. All submissions must be unclassified. Submissions must be no longer that 15 pages in length.

3. Address whether your company has a GSA Schedule. If able to provide the services on schedule, provide the schedule and SIN. Please list any additional Government Wide

Acquisition Contracts (GWAC) your company can provide these services through.

4. Provide licensing/subscription models with pricing structure associated with your response, to include estimated cost of these structures for government assessment of budget impacts.

5. Any other assumptions, comments, concerns, and/or questions relating to the contemplated services.

6. Address whether your company has resellers and if so, do you have small business resellers.

CONTEMPLATED REQUIREMENT

The FBI, OTD has a requirement for a high-performance and fully customizable Ethernet packet capture capability, hereafter referred to as a “sniffer”, with the following requirements:

• The sniffer must be a software application designed to be installed and operated on any industry-standard x86 physical & virtual computer using the Ubuntu Server operating system (OS), version

24.04 and later.

• The sniffer must run as an unattended service within the OS in a “headless” manner (ie, no keyboard or other user interface is required), and operation must not depend on or require the use of a Linux X server.

• The sniffer must operate in a promiscuous, receive-only mode, and transmit no frames while a capture is active.

• The sniffer must receive and make available for further processing all Ethernet frames regardless of type, size or Frame Check Sequence (FCS) validity.

• The sniffer must operate with any commercial-off-the-shelf (COTS), PCIe-based Network

Interface Card (NIC), and must operate successfully with any current Intel Corp PCIe NIC.

• The sniffer must be available as a containerized solution (Docker/OCI).

• Multiple, independent instances of the sniffer must be supported, with each instance receiving a complete copy of packet data from the specified NIC(s). The number and performance of instances will be limited only by the system’s resources, such as number of processors and amount of memory.

• The sniffer must not require any remote activation or any other remote network communication during installation and must not require any ongoing communication with any remote device to maintain operation. Once installed, the sniffer must operate in perpetuity without any further licensing or connectivity requirements.

• A site license must be provided to allow for unlimited installation of the sniffer by the relavent

OTD unit during the period of performance.

• The sniffer must not store any received packet data to any non-volatile or readily accessible media (e.g. a RAM disk) without having validated that the defined capture criteria has been met.

• Each sniffer instance must be configurable with a set of filters used to define the capture criteria, e.g., the conditions within a given data packet that must be satisfied to determine if that packet is to be silently dropped or stored to a non-volatile media.

• Filters that define the capture criteria must consist of one or more modules which may be combined in any AND/OR/NOT logical combination, with each module containing one or more specific condition combined in any AND/OR/NOT logical combination to be met from within the data packet being considered for capture.

• The sniffer must provide an application programming interface (API) to extend the filtering and capturing capabilities to allow for the development and integration of custom filtering capabilities, to include the complete asynchronous control of the entire received packet buffer and flow filter chain.

• The sniffer must support an application programming interface (API) to extend the adapter capturing capabilities to allow for the development of virtual adapters to provide packets to the sniffer from custom sources. These virtual adapters must subsequently be available to any and all sniffer instances as a packet source.

• The sniffer must include integrated filtering capabilities, including but not limited to the ability to match or exclude on any combination of the following packet header fields:

a. MAC address

b. IPv6 or IPv4 address, with or without a subnet mask

c. TCP or UDP port number

d. VLAN tag or MPLS label

• A persistent event log must be provided that records both information and severe sniffer application events, packet errors, collection start and stop times, as well as user and API authentication events

• The sniffer must provide an application programming interface (API) for custom sniffer filtering and virtual adapter modules to log arbitrary events to the sniffer event log.

• Each sniffer instance must provide relevant network statistics, including but not limited to, total packets/bytes from the NIC, packets/bytes that matched the defined capture criteria, as well as max & average overall packet/byte rates of each.

• The sniffer must provide an application programming interface (API) for custom sniffer filtering and virtual adapter modules to report arbitrary statistics to the sniffer statistics interface.

• The sniffer must provide a Representational State Transfer (REST) API allowing for the full configuration, management and monitoring of the sniffer and its functions. Any action a user or administrator can perform must be available through the API such as authentication, capture configuration and start/stop, filter configuration, statistics query of any sniffer capture instance as well as query and review of the sniffer event log.

• The sniffer must write captured packets to disk in an industry-standard, time-stamped PCAP format, including support for file name rotation based on user-defined maximum file size or period timeout.

• The sniffer must be available for purchase as a commercial and generally available product.

Demonstrations may be requested as a result of the RFI response(s). If the respondent(s) is determined to meet the preliminary RFI requirements, a secondary RFI will be released. The respondent(s) will be required to complete a signed Nondisclosure Agreement (NDA) to receive the secondary RFI including minimum performance specifications.

DISCLAIMER and RESPONSES

THERE IS NO COMMITMENT BY THE GOVERNMENT TO ISSUE A SOLICITATION

AS A RESULT OF THIS RFI. THIS IS BEING ISSUED SOLEY FOR INFORMATIONAL

AND PLANNING PURPOSES AND DOES NOT CONSTITUTE A SOLICTIATION. IN

ACCORDANCE WITH FAR 15.201(e), RESPONSES TO THIS NOTICE ARE NOT OFFERS

AND CANNOT BE ACCEPTED BY THE GOVERNMENT TO FORM A BINDING

CONTRACT. THIS IS NOT A REQUEST FOR PROPOSAL OR QUOTE. IT DOES NOT

CONSTITUTE A SOLICITATION AND MUST NOT BE CONSTRUED AS A

COMMITMENT BY THE GOVERNMENT. RESPONSES IN ANY FORM ARE NOT

OFFERS AND THE GOVERNMENT IS UNDER NO OBLIGATION TO AWARD A

CONTRACT AS A RESULT OF THIS ANNOUNCEMENT. NO FUNDS ARE AVAILABLE

TO PAY FOR PREPARATION OF RESPONSES TO THIS ANNOUNCEMENT. ANY

INFORMATION SUBMITTED BY RESPONDENTS TO THIS TECHNICAL

DESCRIPTION IS STRICTLY VOLUNTARY.

WHAT SHOULD BE INCLUDED IN YOUR RESPONSE

1. All interested parties must submit capability packages in response to this notice.

2. Do submit succinct, thoughtful responses to the requirements/questions listed in this RFI.

3. Do submit comments that address the FBI's requirements, assumptions, conditions or contemplated approaches to this future acquisition.

4. Do submit information and suggestions that may encourage new, different, or innovative approaches that would result in products, solutions, and direct savings to the FBI.

WHAT SHOULD NOT BE INCLUDED IN YOUR RESPONSE

1. Do not submit proposals or offers.

2. Do not submit past performance information or general descriptions of corporate experience.

3. Do not submit requests to be considered for award or to be notified of a future solicitation.

4. Do not submit requests to be added to a mailing list or distribution list.

5. Do not submit questions or comments not related to this RFI.

6. Do not respond via telephone.

RFI SUBMITTAL INSTRUCTIONS:

Interested manufacturers are requested to submit their responses to the Contracting Office addressing all requirements of this RFI. Submissions must be provided in Word, Excel or PDF searchable format 8 ½ x 11-page size, no more than 15 pages (includes cover page) in length, single spaced, 12 point font, one-inch margins, Times New Roman Font, demonstrating ability to meet the FBI’s requirements. Any terms and conditions applied to test licenses must be provided as a separate file, not included as part of the page limitation.

The documentation must include as part of the response an introductory page outlining the information below.

Contractor Legal/DBA Name:

Address:

Point of Contact:

Telephone:

Email Address:

UEID Number:

Cage Code:

Facility Clearance (if applicable):

Applicable NAICS Codes:

Standard Business Size:

GSA Schedule:

NASA SEWP Contract:

*If the vendor is a small business, an explanation of the vendor’s ability to perform at least 50% of the tasks described in this SOW

FINANCE AND FACILITIES DIVISION | PROCUREMENT SECTION

REQUEST FOR INFORMATION (RFI) TEMPLATE

Attachment AS - Request for Information (RFI) Template

Version 1.2 Page 6

Additional information augmenting the required business data and response outlining capabilities and answers to all six (6) items under Contractor Qualifications must include:

• The type of work the vendor has performed in the past in support of the same or similar requirement to include the type of contract and method of contracting (GSA, GWAC, other contracting vehicle).

• The specific technical skills the vendor possesses which ensures capability to meet the objectives and requirements.

The completed package must be sent via email to tbcutright@fbi.gov. Submissions must be received no later than 12pm Eastern Time on March 23rd, 2026. Questions or comments regarding this notice may be addressed to Contracting Officer (CO) Tyler Cutright via email at tbcutright@fbi.gov by March 4th, 2026, at 12pm Eastern Time. All questions must be submitted using the RFI Question Template that is attached to this notice. Questions that are not submitted using the RFI Question Template attachment may not be answered. All questions received prior to the March 4th deadline will receive a response by March 11th, 2026. All correspondence must take place in writing. No phone calls will be accepted regarding this RFI. Feedback regarding your response will not be provided. The Government reserves the right to engage responding companies with clarification questions or direct follow-up on product capabilities or information to further understand a response. The Government reserves the right to test products that should be provided as an option in response. The Government reserves the right to issue a secondary

RFI if the respondent(s) meets initial RFI requirements. This outreach will be at the

Government’s discretion.

This RFI is for planning purposes only and must not be considered as a request for proposal or an obligation on the part of the FBI to acquire products or services. No entitlement to payment of direct or indirect costs or charges by the FBI will arise because of contractor submission of responses to this RFI or the FBI’s use of such information. The FBI reserves the right to reject, in whole or in part, any contractor’s input resulting from this RFI. Responses to this RFI will not be returned. All questions regarding the RFI must be in writing prior to submission date. The cost of responding to this RFI must be exclusively borne by the contractor and no costs will be reimbursed by the FBI.

mailto:tbcutright@fbi.gov.

mailto:tbcutright@fbi.gov