20 Gbps Packet Capture and Analysis
The NT20E3-2-PTP accelerator provides full packet capture and analysis of Ethernet LAN at 20 Gbps with zero packet loss for all frame sizes. Intelligent features accelerate application performance with extremely low CPU load. Flexible time synchronization support is included with a dedicated PTP port.
Napatech Software Suite provides an efficient migration path by allowing you to mix and match ports and speeds. An advanced cooling design assures the required airflow while sensors monitor voltage, power, and temperature.
Also available in a NEBS level 3 compliant variant.
In order to protect networks from the most advanced cyber threats, our solutions deliver data to security applications such as:
Security data collection systems make it possible to discover and contain threats faster based on real-time data from critical network links.
Our solutions deliver data to applications that help governments see all data running through their networks. Recognizing malicious packages and suspicious patterns allows governments to take preemptive measures to stop criminals before or during an attack, safeguarding sensitive government information as well as the personal data of citizens.
Our solutions deliver data security to applications that analyze quality of experience. Doing so enables telecoms to improve quality, while better managing the bandwidth challenges posed by rich media applications.
Our solutions deliver data to, and receive data from, applications that enable telecom operators to simulate real-life subscriber behavior with a variety of applications and services. These applications generate insights that lead to better decision-making regarding infrastructure, service upgrades, and deployment.
Napatech accelerators are highly optimized to capture network traffic at full line-rate, with almost no CPU load on the host server, for all frame sizes. Zero-loss packet capture is critical for applications that need to analyze all the network traffic. If anything needs to be discarded, it is a matter of choice by the application, not a limitation of the accelerator.
Standard network interface cards (NICs) are not designed for analysis applications where all traffic on a connection or link needs to be analyzed. NICs are designed for communication where data that is not addressed to the sender or receiver is simply discarded. This means that NICs are not designed to have the capacity to handle the amount of data that is regularly transmitted in bursts on Ethernet connections. In these burst situations, all of the bandwidth of a connection is used, requiring the capacity to analyze all Ethernet frames. Napatech accelerators are designed specifically for this task and provide the maximum theoretical packet capture capacity.
A flow can be defined as Ethernet frames that are associated. The association can be created by comparing various information contained in the Ethernet and encapsulated protocol headers. One way of doing this is to calculate a hash value based on the specified header information. Then all frames with the same hash value are associated and handled in the same way.
Often, network applications need to look at flows of frames that are transmitted between specific devices (identified by their IP addresses) or even between applications on specific devices (identified i.e. by protocol and UDP/TCP/SCTP port numbers used by the application).
Napatech provides several hash value calculation methods, which use different information from various protocol headers in the Ethernet frame to calculate the hash value. This allows the correct hash calculation method to be selected depending on the kind of flows that need to be analyzed. Hash value calculation can also be configured for different types of flows. If only unidirectional flows need to be analyzed, one hash value is calculated for the flow from A to B and a different hash value is calculated for the flow from B to A. If bidirectional flows need to be analyzed, a sorted hash key can be used. This ensures that flows from either direction will receive the same hash value, and thereby be delivered and analyzed by the same CPU core, which is often the most efficient method for analysis.
Hash calculations can be based on the following protocol header information:
The hash value and hash key type are provided in the packet descriptor for each frame.
Modern servers provide unprecedented processing power with multi-core CPU implementations. This makes standard servers an ideal platform for appliance development. But, to fully harness the processing power of modern servers, it is important that the analysis application is multi-threaded and that the right Ethernet frames are provided to the right CPU core for processing. Not only that, but the frames must be provided at the right time to ensure that analysis can be performed in real time.
Napatech Multi-CPU distribution is built and optimized from our close knowledge of server architecture, as well as real life experience from our manufacturing customers.
Napatech accelerators ensure that identified flows of related Ethernet frames are distributed in an optimal way to the available CPU cores. This ensures that the processing load is balanced across the available processing resources, and that the right frames are being processed by the right CPU cores.
With flow distribution to multiple CPU cores, the throughput performance of the analysis application can be increased by orders of magnitude. Not only that, but the performance can also be scaled by using faster processors or more processing cores.
Napatech accelerators support different distribution schemes that are fully configurable:
Full line-rate transmit is an important capability for a number of test and analysis applications. Testing network performance under maximum load is increasingly important to not only assure quality of experience, but also to harden networks against attacks, such as Distributed Denial of Service (DDoS) attacks.
Napatech accelerators make it possible to build solutions where the maximum transmission capability can be achieved to thoroughly test network resilience.
With Napatech accelerators, the frames to be transmitted are either generated by the application, replayed frames that were previously captured to disk, or retransmitted frames received in an in-line configuration.
Frames that are generated for transmission, or host-based transmit, allow frames to be generated by the host and transmitted at line speed on the network. This is useful for load-testing of networks and devices or simulating network behavior for network management and security testing. Timing can be important in these cases to ensure that the right frames are transmitted at the right time and in the right order.
Replay-from-disk allows previously captured frames to be analyzed for troubleshooting or security purposes. In this case, it is important that timing is preserved to accurately recreate what happened. It can also be useful in these cases to change behavior to simulate different situations. For example, it can be useful to manipulate the inter-frame gap (IFG) to speed up or slow down transmission.