Techniques for implementing a software-based packet broker in a visibility network are provided. According to one embodiment, the software-based packet broker can comprise a network device and a cluster of one or more processing nodes. The network device can receive a control or data packet replicated from a core network and forward the control or data packet to the cluster of one or more processing nodes. At least one processing node in the cluster can then execute, in software, one or more packet processing functions on the control or data packet, where the one or more packet processing functions are operable to determine an egress port of the network device through which the control or data packet should be forwarded to a probe/tool of the visibility network for analysis.