PacketBroker – Active Ethernet Tap

Working Principle - (4x 1Gbps ports or 2x 10Gbps ports)

10G ports in Pass-through mode and 1G ports are Output ports

The PacketExpert™ 10GX hardware unit is equipped with both Electrical/Optical ports (1000 Mbps) and only Optical ports (10G). The 10G: Port 1 and Port 2 optical only ports can be configured in Pass-through mode, and the 1G: Port1 and Port2 is used in either SFP or Electrical mode to act as output ports.

1G ports in Pass-through mode and 10G ports are Output ports

Similarly, the 1G: Port 1 and Port 2 can be used in either SFP or Electrical mode, which when configured in Pass-through mode, the 1G: Port3 and Port4 optical or Electrical ports act as output ports. Thus, all 4 ports on the unit is operating in 1Gbps.

The Output ports on the unit in any of the above configurations can be connected to an external storage device or to an analyzer for detail traffic analysis.

It is important to notice that although Pass-through ports and Output ports are both labelled with the port numbers, they are not interchangeable. Pass-through and Output ports have a fixed role and their purpose cannot be configured by users.

• Pass Through Ports (2): Span ports can be either 1G or 10G ports
  
  In 10G mode, the Dual SFP 10 Gb/s ports (10G: Port#1, Port#2), are generally connected in Pass Through to tap the network under test.
  
  In 1G mode, the Dual RJ-45 ports (1G: Port#1, Port#2) for electrical connection 10/100/1000BASE-T. Dual SFP ports for optical connection 1000 Mbps are connected in Pass Through to capture the network traffic.
  
  
• Output Ports (2): Drop ports can only be 1G
  In 10G mode, Dual SFP or RJ-45 (1G: Port#1, Port#2) based 1 Gb/s ports are used as Output Ports to forward capture packets to real-time packet analyzer.
  
  In 1G mode, Dual SFP based 10 Gb/s ports (1G: Port#3, Port#4) can be down-shifted to support 1Gbps (Electrical/Optical) ports, thus offering 4 Electrical / 4 Optical 1 Gbps ports for testing.

	Span (Pass-through) Ports	Drop (Output) Ports
10G ports	10G: Port#1, Port#2 Optical Ports	1G: Port#1, Port#2 Electrical/Optical Ports
1G ports	1G: Port#1, Port#2 Electrical/Optical Ports	1G: Port#3, Port#4 Electrical/Optical Ports

The PacketBroker application, allows PacketExpert™ 10GX to capture packets at wirespeed (up to 10 Gbps) non-intrusively over Optical ports at nano-second precision. It supports Tapping (Pass through mode) and Filter-Aggregate-Modification of the captured packets.

The 1G Electrical/Optical ports of the PacketExpert™ 10GX hardware can also be configured to non-intrusively capture network traffic at wirespeed.

PacketExpert™ operation is bi-directional, which means that both transmission directions are simultaneously processed by the equipment.

10G/1G - Tap, Filter, Aggregation, Packet Modification

• Tap: Traffic is forwarded between the Pass-through 10G/1G ports (Port 1 and Port 2) without any modification or delay, except processing the Ethernet FCS. The incoming frames' Ethernet FCS is checked and the frames with bad FCS are dropped. The frames with valid FCS are sent to the opposite port after stripping off the FCS. While sending the packet out of the opposite port, the FCS is recalculated and attached to the outgoing Ethernet frame
  
• Filter: Supports wire-speed filtering of Layer2/Layer3/Layer4 Ethernet packets, with each port featuring up to 16 simultaneous filters each of 120 bytes in length. Mono Trigger and Continuous filter modes are also supported. Filter can be set to any offset within the packet, which gives flexibility to filter any header field as well as the payload
  
• Packet Modification:  PacketExpert™ 10GX hardware modifies the filtered packets using an inband method of conveying information such as Timestamp (8 Bytes), Board Serial No. (1 Byte), Port No. (4 Bits), and Filter No. (2 bytes), to the (1G output ports) packet analyzer carrying this information in the packet's MAC header. The filtered packet's MAC header's Destination MAC Address (6 bytes) and Source MAC Address (6 bytes) fields are modified as below:


Hardware Modified Ethernet Packet Fields

• Aggregation & Output: The 10G/1G port 1 (Pass-through port) traffic filtered is normally sent out on 1G port1/1G port3 (Output port). Similarly, 10G/1G port2 traffic filtered is sent out on 1G port2/1G port4. Alternatively, the filtered traffic from both 10G/1G ports can be aggregated and sent out on a single 1G port as a single stream. Since the aggregated stream rate can exceed wirespeed rate of a single port, the aggregated traffic is buffered in the onboard 8 GB DDR3 RAM memory, before being sent out
  
  The traffic on Pass-through ports is filtered and is sent to Packet Modifier, which is then sent out on Output port. The Pass-through ports can be 10G/1G while the output ports can be only 1G ports. So, the traffic on Output ports are Filtered and Modified Traffic from pass-through ports

Filter Configuration - Filtering Mode

Each filter can be configured to run in either mono trigger or continuous filter mode.

Continuous mode is the normal filter operation mode where packets are set to filter continuously. In Mono Trigger filter mode, once the packet that matches the filter is filtered, filtering is stopped and, any further packets are not accepted, even if they match the filter. The first single matching packet is said to have “triggered” the filter. User can set the trigger again manually at run time. Correspondingly, Triggered/Filtered Packets statistics are logged.