Cubro Blog

Case Study: Packet Slicing Saves Cost on Flow Monitoring

Customer requirement: Monitoring of 96 100 Gbit links in a Data Centre with VXLAN

Technical Challenges: The increase in network speed requires tools which can keep pace with the changing requirement and make the data centre highly reliable. The network visibility tools need to provide real-time accurate analysis for network management and operations team. The solution involves dealing with two issues:

Challenge 1: Aggregation in high bandwidth

Challenge 2: The possibility to do packet slicing, tagging, and VXLAN removal in multiple of 100 Gbit line rate.

Cubro Solutions:

Packet slicing: Packet slicing is the only way to save cost on the monitoring devices because a full bandwidth monitoring in that scale is out of any budget.

VXLAN removal: The feature VXLAN removal saves bandwidth and most monitoring tools cannot handle VXLAN.

VLAN tagging: VLAN tagging is done because the customer wants reports based on links. 

The advantage of packet slicing is to bring the traffic load down. Consider a typical loaded 100 Gbit link 80/20 % with an average packet size of 1000 bytes which can transport 12 million packets per second (see table below). If you now slice the packet at 100 bytes which is enough information for typical network monitoring, you can transport 111 million packets on a 100 Gbit port and 44 million packets on a 40 Gbit port. This is a factor 4 or 10 in terms of load and price for the monitoring tools. 

Below are some examples with cPacket as partner using a cVU unit as monitoring device. 

As a more advanced option, a cStore device can be connected in the second stage of the aggregation layer and can be fed with a portion of unsliced data for forensic capture.

This solution is possible because the performance of the EXA32100 is extremely good and one unit can easily handle the slicing of the full traffic. 

Here is the third example of a high bandwidth flow monitoring solution:


This aggregation and slicing solution can also feed the Cubro high-performance Netflow Probe. The probe can handle up to 120 Gbit traffic unsampled NetFlow and provide DPI information as well.

Related Products:



Why do you need subscriber aware visibility?


No comments made yet. Be the first to submit a comment
Already Registered? Login Here
Sunday, 20 May 2018