Packet Recorder and Playback
High Density Network Traffic
Packet capture and analysis is crucial for managing large and small-scale networks. Tools to capture and replay are often useful for service providers who wish to make field captures of malignant behavior and want to carefully reproduce them in a lab.
Recorded high speed data can be used not only for examining each packet in real-time, but also examining trends across packets or streams of related packets to predict potential issues or potential illicit activity. Playing back the recorded high speed data can recreate the real-time packet network in the lab for further diagnosis.
GL’s Packet Recorder and Playback application allows Playback and Record modes of operation simultaneously. In Record mode, high rate real-time traffic can be recorded with precise hardware time stamping. The Record feature includes a powerful Hardware Filter that allows user to filter out unwanted traffic, and continuously capture the traffic of interest. The limitation being only the hard disk size and the disk write speed. The application supports file formats such as PCAP (Wireshark® format), HDL (GL Proprietary format), and 3GDAT (GL HD Proprietary format).
In Playback mode, you can re-transmit or playback the recorded traffic file on selected network interface ports, and further analyze this using any packet analyzer such as GL’s PacketScan™. Live traffic captured on a network using the Recorder utility, PacketScan™, or Wireshark® can be easily recreated in the lab.
The Packet Recorder and Playback application is designed to be used as an Add-on software with GL’s PacketScan™ HD network appliance with HD NIC of 1 GigE, 20 GigE and 40 GigE adapters and deployed at critical locations in IP networks to detect problems and avert them.
The traffic captured on a live network using packet analyzers such as PacketScan™-All IP analyzer or Wireshark® can be easily recreated in the lab using Playback feature.
- Packet Recorder:
- Captures 100% packet data on high speed lines (maximum of 5 Gbps data rate)
- Capture packets non-intrusively over Ethernet (Electrical) and Optical ports at Nano-second precision
- Recording can be done on single port or combination of one or more ports. Multiple instances of recorder can run simultaneously.
- Flexible options to record traffic continuously based on File size, File count, Frame count and Duration.
- Record only traffic-of-interest by applying hardware filters – up to 10 hardware filters can be defined for each port
- Create up to 10 user defined hardware filters to filter-out traffic based on MAC, 802.1Q (VLANs), IPv4 /IPv6, TCP, UDP, SIP, and RTP parameters
- Supports both IPv4 and IPv6
- Provides statistics of captured frame count, dropped frame count, recorded frame count capture rate, frame rate, recorded files count, and more.
- Playback File:
- Replay the pre-recorded traffic files at the same rate at which it is captured (maximum of 5 Gbps data rate)
- Provides options to playback single file or multiple sequential files.
- ‘Replay as per File’ option allows to playback the traffic in the same way as it was captured.
- Provides statistics of total frames transmitted, under sized frames count, oversized frames count and different sized frame count etc.
- Provides general statistics, per port statistics and aggregated statistics to help check the progress of the recorder and playback operations.
Requires GL’s HD Network Interface adapters
High Density Network Adapters can be any of the following types -
- 4x 1 Gbps – requires 850/1310 nm SFP Module; Ethernet/Optical SFP modules
- 2x 10 Gbps – requires 10GBASE-SR SFP+; Optical only
- 1x 40 Gbps – requires MTP/MPO Connector for CFP2; Optical only
Hard Disk: SSD hard disk (For faster I/O operations) compatible with SATA verIII or RAM Disk.
System Configuration: 2U system with 32 GB to 128 GB RAM.
Supports defining up to 10 filters at Layer 2, 3, 4, and 5
- MAC: Frames can be filtered out based on Source MAC address, destination MAC address, Ether Type and FCS Error.
- VLAN 0, 1, 2: Filters frames based on Tag protocol ID, User Priority, CFI, and VLAN ID.
- IPV4: Frames can be filtered based on Source IP Address, Destination IP Address, Protocol Type, Header Length, Differentiated Services, Ds_ECN, DS_CodePoint, Total Length, Check Sum Error, IP Datagram ID, Fragmentation Offset, Flag_DontFragment and Flag_MoreFragments.
- IPv6: Frames can be filtered based on Source IP address, Destination IP address, Next Header, and Payload Length.
- ARP: Frames can be filtered based on Sender MAC Address, Target MAC Address, Sender IP Address, Target IP Address and Option Code.
- TCP: In TCP layer Frames, can be filtered based on source port, destination port and check sum error.
- UDP: In UDP layer Frames can be filtered based on source port, destination port, check sum error, UDP length and payload. For more details, refer to
- SIP and RTP: SIP and RTP packets can also be filtered based on source port or destination port.
Max Rate is 5 Gbps
Max Rate is 5 Gbps
Recorder application provides various options to capture the high density real-time traffic and store the recorded traffic into a file.
The number of recorded files can be saved sequentially or with Timestamp.
The application can capture the traffic continuously until user stops the recorder. The recorder can be stopped automatically after creating specified number of files, or the traffic can be over-written by keeping latest number of files.
User interested traffic can be filtered using Hardware Filter option.
Example: Filtering SIP and RTP Traffic
The below Hardware Filter expression filters SIP packets runs over standard UDP port 5060 and filters RTP packets on even ports after port number 1023.
Example: Applying Checksum Errors to Capture Error Packets
Applying filters on MAC, IP, TCP, UDP can filter good checksum and bad checksum error packets. If the value is set to True it will filter-out wrong checksum or corrupted packets.
Example – Filtering HTTP Packets
Applying filters on TCP Source and destination ports can filter HTTP packets. In this example the TCP Source and destination port value is set to ’80’ for HTTP and ‘443’ for HTTPS. This will capture either of the packets whichever is True.
Record statistics display includes, Captured Fames, Dropped Frames, Recorded Frames, Capture rate, Frame Rate (Frames\sec), Recorded Files, Current Recording Files, and Recorded Duration.
Port Aggregate Statistics
Aggregate Statistics displays both recording and playback statistics for all the ports. Aggregate statistics includes Total Frames, Byte Length Frames (64-1518 Byte Length Frames), Oversized Frames, and Undersized Frames.
Recorder and Per Port Aggregate Statistics
Single or multiple recorded files can be replayed on any of the available port with the same frame rate or user defined frame rate.
The application can playback the recorded traffic continuously until user stops the playback. The playback can be stopped after playing N number of files, or after specified duration.
Playback statistics includes, Transmitted Frames, Frame rate (Frames\sec), Current iteration, Playing back FileName, and Playback Duration.
Playback and Per Port Aggregate Statistics
Please Note: The XX in the Item No. refers to the hardware platform, listed at the bottom of the Buyer's Guide, which the software will be running on. Therefore, XX can either be ETA or EEA (Octal/Quad Boards), PTA or PEA (tProbe Units), UTA or UEA (USB Units), HUT or HUE (Universal Cards), and HDT or HDE (HD cards) depending upon the hardware.