The EXA40 Sessionmaster is a multifunctional network appliance. It combines a Layer 4 network packet broker with one or two high performance multi core CPU‘s (see drawing).
The EXA40 understands network protocols, not only by the port number but can also decode protocols similar to a Probe. This feature is vital to do keyword and regular expression search and to produce useful results. The Sessionmaster EXA40 Series focuses on the mobile core network, metropolitan area network (MAN), and Internet data center (IDC) big data monitoring.
This design allows for maximum flexibility and security.
The Asic layer is a non blocking network packet broker which is used to do basic layer 4 filtering and steering the traffic to one of the Session Fabric CPU’s.
On the Session Fabric the higher layer software is running applications like:
- GTP load balancing
On inner IP address
- IMSI filtering
IMSI range (black and whitelist)
- Regex search
- Keyword search
- GTP tunnel remover
- Meta data enrichment
- SIP, RTP correlation
Filter on phone# and correlate RTP traffic
On inner IP address
- MAC IN MAC tunnel remover
- GTP-U Correlation, Tagging, and Packet Filtering
Success story:SMS intercept application, by redirect SS7 MAP traffic transported on a Sigtran link
In this application the EXA40 works inline in a sigtran link. The challenge is to extract on packet level on this stream which holds the TEXT messages content. To do this an advanced regex filter is used. The matched packets are removed from the live link and forwarded to a server application. After processing the packets, they are sent back to the EXA40. The EXA40 reinserts the packets in the live link. The challenge is the complex regex filter and the near real time speed. Each transaction must be done under 20 ms to avoid corrupting the link. And this is possible with Cubro’s EXA40.
! Note: The power footprint is important on 24/7 running devices