Tapping in layer 1
Tapping guarantees that every packet is being sent from the network to the monitoring device. It is a layer 1 technique to get access to network traffic without interfering the original traffic or losing information. Several times when the SPAN port is overloaded, packets get dropped before reaching the monitoring device. There is also the possibility of losing some of the error packets that may be causing problems. If this data is not sent to the monitoring device because it is dropped, it is impossible to troubleshoot. The purpose of tapping is to solve issues related to monitoring and lawful interception. Depending on the physical situation and speed requirements (from very slow 2 Mbit up to very fast 100 Gbit links), optical or copper interfaces can be chosen. A network link (connection) has two directions, which means that for a 100 Gbit link, the user has to handle up to 200 Gbit. The major issue in tapping a network is not interfering the original traffic. Due to this challenge, it is necessary to choose a tool which is built with a deep knowledge of layer 1. Several customers have been using Cubro’s layer 1 solutions for over a decade.
Cubro’s network packet brokers are capable of steering traffic in many ways. The tools are passive and are deployed in-line behind TAPs. They can be used with or without bypass protection. Data centres are constantly trying to lower network cost and increase content control. Steering includes load balancing and traffic tunnelling. Cubro supports all major tunnel techniques including VLAN, MPLS, GRE, NVGRE, GENEVA and VXLAN. TAP networks today can be very complex, as there are often several packet brokers involved. Cubro has systems with more than 1000 ports.
Filtering up to layer 7
Filtering is another major solution needed to support monitoring applications and make optimal use of the monitoring tool's capacity. Cubro products can filter in all 7 layers depending on the equipment. This capability helps the user to save money because only the relevant traffic needs to be monitored and collected. Cubro NPBs support thousands of filters from 2000 in the smallest unit up to 1 million in the biggest. The number of filters has no impact on the performance of the unit. Filtering application makes the monitoring tools operate more efficiently.
Separation of traffic
Cubro's network packet brokers support the ever-increasing traffic volume. Often specific traffic must be forwarded to specific devices. Cubro products can help to offload the analysing devices with their filter (separation) capabilities.
Aggregation and filtering application
The Packetmaster EX2, a top quality network packet broker, is connected to several devices, for instance, span ports. The traffic from various sources can be aggregated to one stream to a monitoring device. This application reduces the overhead associated with each transmission. The appliances can be set up to share the traffic load by load balancing and even filtering the data. This means that only the traffic of interest is sent out to the appliances, which minimizes the possibility of oversubscribing the 1GbE monitor ports. This feature gives you complete visibility over your network.
Load balance up to multiple 100 G with Cubro NPB
Load balancing is vital because analysing and capturing devices are only capable of handling a certain amount of traffic. Cubro network packet brokers help to load balance the traffic to several devices which share the load. This load balancing is very flexible and supports many ports. This application maximizes throughput, minimizes response time, and avoids overload.
Symmetric load balancing
Symmetric load balancing, or session-aware load balancing, is supported on all Cubro G4 Packetmasters at no extra charge. In addition, 10 LB groups with 16 ports are also supported. Symmetric load balancing is a mechanism that interchanges the source and destination addresses to ensure that bidirectional traffic - specific to a particular source and destination address pair flows out of the same member of a trunk group.
The cross-connect is bidirectional, so packets received on the first interface are transmitted out the second interface, and those received on the second interface are transmitted out the first interface.
500 X 10 Gbit port cross-connect with 400 Gbit non-blocking backbone
- EX20400 is connected over 4 x 100 Gbit to one EX32100 to build a 500 port 10 Gbit cross- connect
- The connection is layer 2 transparent
- To ensure full control and secure transfer, all traffic is transported in VXLAN tunnels across the system
- At the output, the VXLAN tunnel head is removed
- Centralized management
100 Gbit port cross-connect full mash
- In this application 6 EX32100s are connected to a fully mashed cross-connect with 162 available 100 Gbit ports (27 per box)
- The interconnection between the boxes can be done with one link, or with two or more depending on the required bandwidth
- The table above shows how many units can be interconnected and how many ports are available
100 Gbit port cross-connect with central unit
- In this application 6 EX32100s are connected to a central unit with 186 available 100 Gbit ports (31 per box)
- The interconnection between the boxes can be completed with one link, or with two or more depending on the required bandwidth
- The table shows how many units can be interconnected and how many ports are available
The user defines the connected endpoint and the application finds the best and shortest way to the endpoint. However, it is also possible to define a hard-coded way.
By clicking on a point, the route is shown as a highlighted path. The application supports any combination of layout, full mesh and central in any combinations and it is self-learning in how the units are connected. Also, we provide all types of traffic statistics.
EX Series for Copper monitoring
There are different ways to access full-duplex traffic on a network for analysis. The EX Series can be connected directly to a live copper link 10/100/1000 without TAPs. The user can set up filters and send the traffic out to the 4 x 10/100/1000 Mbit interfaces. This traffic is small enough to be captured with a standard laptop. This function also allows for the traffic to be removed and inserted in the live links.
EX Series as Media Converter
The EX Series can also work as a media converter from:
- Copper to Fiber 1 Gbit
- Copper to Fiber 10 Gbit
- Fiber 10 Gbit (SM) to Fiber 10 Gbit (MM), 40 Gbit, 100 Gbit, etc.
100 Gbit aggregation with Packetmaster EX32100
The EX32100 is connected via the Cubro optical TAPs to a 100 Gbit live link.
The aggregation feature combines the traffic in both directions to one 100 Gbit output for monitoring purposes. Using the filtering capability of the Packetmaster EX32100 a user can select only the portion of the traffic needed to solve the network problem. Filtering of data ensures that each monitoring or inline security tool receives exactly the right data.
Simplify monitoring and troubleshooting
The Packetmaster EX48400 delivers true link layer visibility solutions by supporting 4500 layer 4+ filters.These filters can be used to redirect a small portion of the traffic to a low end (in terms of bandwidth) monitoring tool like a PC with Wireshark. The filtered traffic can be used to troubleshoot routing issues on 100 Gbit link. It is also possible to feed several monitoring probes with specific traffic.
Monitoring and troubleshooting is a vital part of maintaining and running networks. Growth in traffic and increase in the number of applications has made filtering an important feature for troubleshooting. Our products simplify monitoring and improve troubleshooting. Cubro offers smart filtering in any OSI layer with an in-line rate up to 100 Gbit; it is session-aware and application-aware in layer 7.
Filtering – 4500 Flow Rules
A total of 4500 flow rules (filters) can be set in Cubro network packet brokers.The fields marked with a red dot can be used as a match for a packet, either alone, combined or with wildcards. For IPSrc and IP, Dst supernets are supported.
Available actions after a positive match include –
- Send out : to one or more ports it is even possible to send it through the input
- Drop : delete the specific packet
- Modify : modify specific fields in the matched packets, VLAN, MPLS, MAC SRC, MAC DST, PORT, VLA, Priority and many more.
- Add VLAN : the unit can tag a VLAN on the input to separate the traffic after aggregation
- Strip VLAN : VLAN can be removed, Q in Q is supported
- Add MPLS : add an MPLS Tag to a matched packet
- Strip MPLS : remove an MPLS Tag from a matched packet
- Stacking of rules : this function makes it possible to generate very complex filter rules.
This function allows the user to select the media by changing the SFP. The unique design also supports CWDM / DWDM and BIDI SFP.
Amplification for monitoring
It is common to use optical splitters to monitor the traffic in a network, but a splitter also reduces the optical power on the active link. This can cause transmission problems, especially in multimode networks with higher bandwidths (10 Gbit). A Cubro Media Converter 10 G for amplification can help solve this problem. The user can enlarge the transfer range of the media dramatically without risking errors on the data.
Conversion of traffic
This application makes it possible to connect two dissimilar media types. The most common use of media converter is transmission between fiber and copper to extend the network or introduce fiber optic cabling to a copper based network. The user can convert traffic into a usable form, convert on a physical level from copper to fibre interfaces or vice versa. The application also enables a user to convert bandwidth from 10 to 1 Gbit. The user can convert or modify the traffic so that the tools can handle it, removing tunnels or removing labels like VLAN and MPLS.
With the 10 Gb ports on the EXA products, it is possible to convert the traffic from a mobile core network to 1 Gb so that a conventional PC with Wireshark can be used. The 10 Gb traffic can be converted to 1 Gb and also filtered down to one specific mobile user for capture by the tool.
Layer 7 Filtering for troubleshooting
With filtering application, the user can define the specific traffic that should be visible and exclude the traffic which is not required. This application allows reducing the amount of tool capacity needed.
VoLTE SIP filtering (with S1-MME/S1-U interface input)
VoLTE RTP/RTCP filtering (with S1-MM/S1-U interface input)
This application helps to troubleshoot VoLTE traffic in a mobile network. It is available on all EXA models.