SLIDE 1
1
818 West Diamond Avenue - Third Floor, Gaithersburg, MD 20878 Phone: (301) 670-4784 Fax: (301) 670-9187 Email: info@gl.com Website: http://www.gl.com
1
(Wire-speed Ethernet Tap)
2
PacketExpert PacketBroker (Wire-speed Ethernet Tap) 818 West - - PowerPoint PPT Presentation
PacketExpert PacketBroker (Wire-speed Ethernet Tap) 818 West - - PowerPoint PPT Presentation
PacketExpert PacketBroker (Wire-speed Ethernet Tap) 818 West Diamond Avenue - Third Floor, Gaithersburg, MD 20878 Phone: (301) 670-4784 Fax: (301) 670-9187 Email: info@gl.com 1 1 Website: http://www.gl.com Supported Platforms
SLIDE 2
SLIDE 3
3
Ethernet Technology
SLIDE 4
4
Just bigger Pipes, but same Ethernet packets
SLIDE 5
5
Non Intrusive Network Monitoring
- Packet Capture and analysis is the core of
Network monitoring
- When monitoring live networks, non intrusive
monitoring is very important so as not to disturb the network being monitored
- Non intrusive monitoring is achieved by
sniffing a live network link connecting two network nodes, and copying the packets without altering them in any way or disturbing the link
SLIDE 6
6
Wirespeed Filtering
SLIDE 7
7
Port Mirroring
SLIDE 8
8
Disadvantages of Port Mirror/SPAN Method
- Depends on switch CPU for processing it -
burdening it
- Packets may drop
- No Filters
- Tx and Rx direction are not separated
SLIDE 9
9
Pass-through and Output Ports
- The PacketExpert™ 10G hardware unit is equipped with both Electrical/Optical ports (1000 Mbps) and only Optical ports (10G).
The 10G: Port 1 and Port 2 optical only ports can be configured in Pass-through mode, and the 1G: Port1 and Port2 is used in either SFP or Electrical mode to act as output ports.
SLIDE 10
10
PacketBroker in Network
SLIDE 11
11
Features
- A network tap like application, with additional advanced features like
➢ Active network tap - capable of handling bidirectional 100% wirespeed traffic upto 1 Gb/s ➢ Wirespeed Filtering - powerful and easy to use ➢ Packet Modification to convey useful information like Timestamp inband ➢ Output aggregation - both direction traffic multiplexed on the same output Based on PacketExpert™ hardware platform
- Ports 2 and 3 act as the Active/Pass through ports
- Ports 1 and 4 act as the Output ports
SLIDE 12
12
Packet Tap, Filter, Aggregation, Modification, & Output
SLIDE 13
13
Capture Traffic of Interest
SLIDE 14
14
Wirespeed Filter
SLIDE 15
15
Filter Configuration Menu
SLIDE 16
16
Filter Configuration Options
SLIDE 17
17
Dynamically Enable/Disable Filters
SLIDE 18
18
Dynamically Enable/Disable Filters
SLIDE 19
19
Filter Configuration in Raw Mode
SLIDE 20
20
Filter Configuration in Packet Mode
SLIDE 21
21
Continuous Filter Mode
SLIDE 22
22
Mono Trigger Filter Mode
SLIDE 23
23
Packet Aggregation User Interface
The filtered traffic is combined and sent out through a single output port If the combined bandwidth exceeds the wirespeed of the output port, may cause packet loss. Hence, the onboard memory (2 GB DR2 RAM) is used as a temporary buffer to store the traffic
before sent out at wirespeed. Thus, upto 2 GB of traffic can be buffered.
SLIDE 24
24
Packet Modification
Need to convey very useful information such as the timestamp, port number, filter number etc. to the analysis
tool
May not have the flexibility to convey it outband – may need to do it inband PacketBroker provides this functionality by conveying it in the MAC header of the output packets
SLIDE 25
25
Packet Modification…
- Timestamp, Filter Number, Board Serial Number and Port Number fields are written on top of the Src MAC address and
Dst MAC Address fields
- Ethernet CRC is recalculated
- Original MAC header will be lost, but many times, this may be fine if interest is only in higher layers (IP, TCP/UDP etc)
SLIDE 26
26
Packet Modification
SLIDE 27
27
Packet Modifier Enable/Disable
SLIDE 28
28
PacketModifer Field Config Menu
SLIDE 29
29
Packet Modifier Field Configuration
SLIDE 30
30
Packet Modifier Board Serial Number Config UI
SLIDE 31
31
Port Statistics
SLIDE 32
32