  Many reasons make NFV an attractive paradigm for IT security: lowers costs,
agile operations and better isolation as well as fast security updates,
improved incident responses and better level of automation. On the other side,
the network threats tend to be increasingly complex and distributed, implying
huge traffic scale to be monitored and increasingly strict mitigation delay
requirements. Considering the current trend of the net- working and the
requirements to counteract to the evolution of cyber-threats, it is expected
that also network monitoring will move towards NFV based solutions. In this
paper, we present D- StreaMon an NFV-capable distributed framework for network
monitoring realized to face the above described challenges. It relies on the
StreaMon platform, a solution for network monitoring originally designed for
traditional middleboxes. An evolution path which migrates StreaMon from
middleboxes to Virtual Network Functions (VNFs) has been realized.
