Wirespeed Ethernet Packet Capture and Playback
Wirespeed Capture and Playback testing provides Packet Capture, Filter, Aggregate, & Storage features in a portable unit.
Request a Demo / Quote Brochure
Overview
Wirespeed Capture and Playback testing is an optional application within PacketExpert™ 10G platforms. Record Playback module is a Wirespeed Ethernet Tap, which works as a High-Precision Wirespeed Traffic Generator in optical interfaces supporting up to 10 Gb/s. It supports all the features of high-end taps in a portable unit providing Wirespeed Packet Capture, Filter, Aggregate, & Storage (for offline analysis) over both 10G and 1G ports.
Wirespeed Capture and Playback is available in the following 2 PacketExpert™ platform variants -
- PacketExpert™ 1G (PXE100) – This is a quad port USB based portable unit, of which 2 ports are of 10/100/1000Mbps Electrical or Optical (Port 2, Port 3), and other 2 are 10/100/1000Mbps Electrical only. The application captures on the 10/100/1000Mbps Electrical/Optical ports (Pass-through ports) and stores the filtered data for offline analysis. It supports all the features of high-end taps in a portable unit providing mobility and storage capacity to reach any point in the network.
- PacketExpert™ 10GX (PXN100) - This is a quad port USB based portable unit, of which 2 are 10 Gbps Optical ports, and other 2 are 10/100/1000 Mbps Electrical/Optical ports. The 10 Gbps Optical ports can be down-shifted to support 1Gbps Electrical ports, thus offering 4 Electrical / 4 Optical 1 Gbps ports for ethernet testing. The same 10Gbps ports can also be converted to 2.5Gbps Optical/Electrical interface using appropriate SFPs. The application captures on 10 Gbps ports or 1 Gbps ports (Pass-through ports) and stores the filtered data for offline analysis. It supports all the features of high-end taps in a portable unit providing mobility and storage capacity to reach any point in the network.
The Record and Playback module allow users to use PacketExpert™ for -
- Continuous Simultaneous Capture and Playback over Multiple Ports
- Continuous Long Term Capture along with real-time transfer to host PC. This allows for huge file capture limitation being only the hard disk space
- Filter for packets of interest, reducing the bandwidth needed to transfer to host
- Record the captures to a file - supports popular capture file formats such as *.pcap, *.ngpcap, *.hdl, and *.dat.
- Continuous Playback on the same port where capture is running.
- Supports simultaneous capture or playback functions on multiple ports –both on 10G or 1G ports.
- Also supports simultaneous Packet Capture and Playback on the same port
- High Precision Wirespeed Ethernet Packet Forwarding from a captured file
- Precisely simulate/recreate live network traffic conditions.
- Supports the 'As per File" option. This option allows user to precisely regenerate the traffic from a pre-recorded file i.e. traffic is transmitted at the precise rate at which it was captured (by maintaining the recorded timestamps).
- High Precision Wirespeed Ethernet Packet Capture to a captured file
- Supports limited lossless capture and continuous capture modes.
- In lossless capture, the recording stops automatically when the Onboard buffer fills up.
- In continuous capture, the recording continues even after the Onboard buffer is full indicating discontinuous recording.
For both Capture and Playback, the application supports popular capture file formats such as PCAP/PCAP-NG (Wireshark® formats) that gives the users the flexibility in analyzing and recreating any kind of live network conditions. The traffic captured on a live network using packet analyzers such as PacketScan™-All IP analyzer or Wireshark® can be easily recreated in the lab using PacketExpert™-Playback feature.
The packets captured to an HDL file using PacketExpert™- Record feature can be analyzed and decoded using PacketScan™-All IP analyzer application.
PacketExpert™ also supports Command line Interface (CLI) to access all the functionalities remotely such as Bert, Loopback, RFC 2544, Record Playback, IPNetSim™, IPLinkSim™, ExpertSAM™, PacketBroker, ExpertTCP™, and Multi-Stream Traffic Generator and Analyzer using C#, Python, clients and MAPS™ CLI Server/Client Architecture.
Working Principle - PacketExpert™ 10G
The tap, filter, and aggregation modes of PacketExpert™ 10G Record Playback application are detailed below:
- Tap: Traffic is forwarded between the 10G/1G pass-through ports (Port 1 and Port 2) without any modification or delay.
- Filter: wire-speed filtering of Layer2/Layer3/Layer4 packets, with each port featuring up to 16 simultaneous filters each of 120 bytes in length. Filter can be set to any offset within the packet, which gives flexibility to filter any header field as well as the payload.
- Aggregation: The filtered traffic from both 10G/1G: Port 1 and Port 2 can be aggregated to present them as a single stream. This aggregated stream is temporarily stored in the onboard 8 GB DDR3 memory buffer.
- Transfer to host PC and Storage for Offline analysis: Then the data is transferred to the PC at USB 3.0 transfer rate of around 2 Gbps total rate in both the directions, where it is stored in any of the following file formats (DAT, HDL, PCAP, NGPCAP), which can be later analyzed (offline analysis) using tools such as GL's PacketScan™ or the open source Wireshark®.
The schematic below summarizes the different modes of PacketExpert™ Record Playback application.
Record and Playback application working with PacketExpert™ 10G Ports
Working Principle - PacketExpert™ 1G
The tap, filter, and aggregation modes of PacketExpert™ Record Playback are detailed below:
- Tap: Traffic is forwarded between the pass-through ports (Port 2 and Port 3) without any modification or delay.
- Filter: wire-speed filtering of L2/L3/L4 packets. The packets that are traffic compliant with any of the set filters is forwarded to the drop ports (Port 2 to Port 1, and Port 3 to Port 4) and can be analyzed using a real-time packet analyser.
- Aggregation: Alternatively, the filtered traffic from both Port 2 and Port 3 can be aggregated to present them as a single stream. This aggregated stream is saved to the onboard 2 GB memory card (SD) in any of the following file formats (DAT, HDL, PCAP, NGPCAP). Then the data is transferred to the PC at 350 Mbps rate, which can be later used for offline analysis.
The schematic below summarizes the different modes of PacketExpert™ Record Playback module.
Record and Playback application working with PacketExpert™ 1G
Features
- Operation modes - Tapping (Pass through mode), and Tap-Filter-Aggregate modes.
- Capture packets non-intrusively on multiple ports simultaneously at nano-second precision.
- Supports 16 filters per SFP / Ethernet port.
- Filter on various header fields like Source/Destination MAC Address, VLAN Id, MPLS Label, Source/Destination Ipv4 Address, Source/Destination UDP ports Supported file formats for recording are *.pcap, *.hdl, *.dat, and *.pcapng/*.ntar
- Packets can be captured continuously (till user manually stops the capture or up to hard drive capacity) or limited by a specified size in MB, packet count, time duration, or capture continuously (until the disk is full)
- Capture a very large file size (up to hard disk capacity) by filtering traffic of interest, reduce the capture rate to < USB 3.0 transfer rate (around 2 Gbps total rate, includes both the directions)
- Result count includes the total number of packets received by the port as well as the host, dropped packet, number of bytes written to the file, disk write buffer utilization, and disk write bytes/sec
- Provides Port level statistics like total frames/bytes received, Rx Frame rate, Rx Data rate etc.
| PacketExpert™ 10G | PacketExpert™ 1G |
|---|---|
Capture packets non-intrusively over 10G Optical ports and 10/100/1000 Mbps Electrical/Optical ports simultaneously at nano-second precision. |
Capture packets non-intrusively over 10/100/1000 Mbps Electrical/Optical ports (Port2 and Port3) simultaneously at nano-second precision. |
Wirespeed capture and storage can be accomplished utilizing the onboard DDR3 memory size of 8GB |
Wirespeed capture and storage can be accomplished utilizing the onboard DDR2 memory size of 2GB |
Record Configuration - PacketExpert™ 10G
Wire-speed Packet Filters and Triggers
Capture Traffic of Interest
The Record to File feature includes a powerful “Wirespeed filter” that allows user to filter out unwanted traffic, and continuously capture the traffic of interest. The limitation being only the hard disk size and the disk write speed.
Some of the main features of the Wirespeed packet filter are listed below:
- Filter packets and record only packets of interest
- Filter can be set to each bit in the packet (Raw mode) or each field (Packet Mode) for greater flexibility
- Up to 16 filters can be defined per port. Each filter supports filtering on the following fields:
- Source/Destination MAC Address, Ethernet Len/Type field
- VLAN Id/Priority
- MPLS Label
- IP Source/Destination Address, ToS/DS field, Protocol field
- UDP Source/Destination Ports
- TCP Source/Destination Ports
- Frame Size
- Generates a trigger (1 Microsecond pulse) for each packet that passes the filter
- Each field can be set to match to a fixed value or Range of values
- Turn on/off each of the 16 filters at run time. A 'Not' feature is available for each filter – user can either capture a packet that matches the filter or capture all packets that do not match the filter. This can also be toggled at run time
| PacketExpert™ 10G | PacketExpert™ 1G |
|---|---|
Up to 120 bytes wide filter that covers almost entire packet up to UDP |
Up to 40 bytes wide filter that covers almost entire packet up to UDP |
16 filters can be combined using 'OR' or 'AND' combination |
'OR' or 'AND' operators not supported during filtering |
Hardware filtering in Record Only mode supports both Raw mode and Packet mode filter editing. In Raw mode, each bit can be set to ‘filtered’ or ‘don’t care’ condition via filter mask. For each filter, offset can be set to any byte within the packet (from 0 to 15999) which gives flexibility to filter a particular field within protocol headers, and also the payload.
Wirespeed Filter
Up to 16 filters can be defined, and “AND” /”OR” condition can be set to all the filters. Further, each filter can be set to either accept or reject the packet.
Wirespeed Filter - Raw Mode
In Packet mode, user can define the Layer structure (Protocol Stack) of the packet, define the offset and edit individual field's data/mask. Users can create filters by configuring various header fields for MAC, VLAN, MPLS, IP, and UDP layers such as Source/Destination MAC Address, VLAN Id, MPLS Label, Source/Destination Ipv4 Address, and Source/Destination UDP Ports.
Wirespeed Filter - Packet Mode
The configured filters can further be enabled/disabled at any time, even when the Record Only application is started, and filtering is going on. Easy-to-use check option allows to turn on/off each of the 16 filters at run time. A 'Not' feature is available for each filter – user can either capture a packet that matches the filter or capture all packets that do not match the filter. This can also be toggled at run time.
Filter Setup
Results and Statistics
Record statistics display includes Capture Duration, Total Rx Frames, Frames not matched to filter, Frames matched to filter, Overflowed Frames, Overflowed Count, Transferred Frames, Disk Write Rate (bytes/sec), Disk Write Buffer Utilization (%), and Capture File Size.
Record Statistics – PacketExpert™ 10G
Record Statistics – PacketExpert™ 1G
Aggregate Filter Statistics gives the number of frames passing a particular filter configuration.
Aggregate Filter Statistics
Features
- Packets transmission is from USB 3.0 to Onboard memory buffer and playback is based on time-stamp depending on the captured rate
- Playback packets from the captured or pre-recorded files
- Playback can be done on both ports simultaneously
- Each port can transmit a file separately and independently. ‘As per File’ option allows the users to playback the traffic exactly the same way as it was captured
- Captured traffic on one port can be transmitted on the same or any other port – will be redirected to the correct port at run time
- Packets can be transmitted either continuously, limited by number of packets, or till the end-of-file (EOF)
- Highly accurate Playback based on the recorded nanosecond timestamp
- Supported file formats are DAT (.dat - GL proprietary), HDL (.hdl - GL Proprietary and can be used for offline analysis by GL’s PacketScan™), PCAP (.pcap - used by Wireshark®) and PCAP-NG (.pcapng/.ntar – next generation Wireshark®) formats
- Supports Pause frame transmission with user defined quanta on each port independently
- Displays some useful statistics that help user to check the progress of the playback
- Port Mapping option to configure the playback ports, available only for playing the file as per captured file (As per File) option
| PacketExpert™ 10G | PacketExpert™ 1G |
|---|---|
|
|
|
|
Playback-from-file - PacketExpert™ 10G |
Playback-from-file - PacketExpert™ 1G |
Results & Statistics
Playback from file statistics includes Playback time, Total number of transferred frames to onboard buffer, and Total frames transmitted parameters
Playback-from-file Statistics
PacketExpert™ 10G
Playback-from-file Statistics
PacketExpert™ 1G
Features
In Record and Playback mode, both playback from file and capture to file can be done simultaneously at wirespeed. The onboard memory is available separately for capturing and transmission of data. Most important feature of the playback application is that the traffic can be played back at exactly the same way as it was captured with ‘As per File’ option. During playback, the relative timestamps for each packet transmitted is maintained exactly like in the source file. Since playback happens in the hardware, it can achieve nano-seconds accuracy in maintaining the timestamps.
| PacketExpert™ 10G | PacketExpert™ 1G |
|---|---|
|
|
Record and Playback – PacketExpert™ 10G |
Record and Playback – PacketExpert™ 1G |
Filters and Triggers (available during recording)
Capture Traffic of Interest
| PacketExpert™ 10G | PacketExpert™ 1G |
|---|---|
Up to 120 bytes wide filter that covers almost entire packet up to UDP |
Up to 40 bytes wide filter that covers almost entire packet up to UDP |
|
|
Results and Statistics
Aggregate Statistics displays both recording and playback aggregated statistics for all the supported ports.
Aggregate Statistics – PacketExpert™ 10G |
Aggregate Statistics – PacketExpert™ 1G |
Resources
Please Note: The XX in the Item No. refers to the hardware platform, listed at the bottom of the Buyer's Guide, which the software will be running on. Therefore, XX can either be ETA or EEA (Octal/Quad Boards), PTA or PEA (tProbe Units), XUT or XUE (Dual PCIe Express) depending upon the hardware.
| Item | Description |
|---|---|
| PXN100 | PacketExpert™ 10GX |
| PXE100 | PacketExpert™ 1G |
| PXN105 | PacketExpert™ Wirespeed Record / Playback for PXN100 |
| PXE105 | PacketExpert™ Wire speed Record /Playback for PXE100 |
| CXN100 | CLI Server for PXN100 |
| CXE100 | CLI Server for PXE100 |
| PacketExpert™ 10GX - Brochures |
|---|
| PacketExpert™ 10GX |
| PacketExpert™ 10GX - Capture / Playback |
| PacketExpert™ 10GX mTOP™ |
| PacketExpert™ 10GX CLI |
| PacketExpert™ 1G - Brochures |
| PacketExpert™ 1G |
| PacketExpert™ 1G - Capture/Playback |
| PacketExpert™ 1G - mTOP™ |
| PacketExpert™ 10GX - Presentations |
| PacketExpert™ 10GX |
| PacketExpert™ 10GX - Capture/Playback |
| PacketExpert™ 1G - Presentations |
| PacketExpert™ 1G |
| PacketExpert™ 1G - Capture/Playback |
Webinar
Comprehensive Ethernet Testing Solutions