GL Communications Inc.
 
 
Home >  VoIP Analysis and Simulation

PacketBroker – Passive Ethernet Tap

PacketExpert™Software Ver 5.8.25 | Download Now!
PacketExpert™ 10G Software Ver 6.11.8 | Download Now!

Overview

The PacketBroker is an optional application added to GL’s PacketExpert™ platforms, that allows the Ethernet test tool to be used as a highly precise non-intrusive Wirespeed Ethernet Tap with all the necessary features packaged within to capture real world traffic, define multiple filters for drilling-down to traffic of interest, generate triggers based on packet filters, and transmit filtered/aggregated/modified packets for deep-packet data analysis.
The PacketBroker application utilizes all these ports to support advanced features such as -

  • Network Tap - capable of handling bidirectional 100% wirespeed traffic up to 10 Gbps
  • Wirespeed Filtering - powerful and easy to use
  • Packet Modification to convey useful information like Timestamp, Filter number etc. inband
  • Output aggregation - both direction traffic multiplexed on the same output port
  • Record the output to a file for offline analysis with support for popular capture file formats such as *.pcap, *.ngpcap, *.hdl, and *.dat

PacketBroker is available is following 2 PacketExpert™ platform variants -

  • PacketExpert™ (PXE100) - This is a quad port USB based portable unit, of which 2 ports are of 10/100/1000Mbps Electrical or Optical (Port 2, Port 3), and other 2 are 10/100/1000Mbps Electrical only. The application captures on the 10/100/1000Mbps Electrical / Optical ports (Pass-through ports) and outputs the filtered and modified packets on output ports (Port1 and Port4) respectively, or aggregates the output to either Port1 or Port4.  All the features of high-end taps are packaged into this portable unit making it suitable for field testing and remote testing any point in the network.
  • PacketExpert™ 10G (PXG100) - This is a quad port USB based portable unit, of which 2 are 10 Gbps optical ports, and other 2 are 10/100/1000Mbps Electrical / Optical ports. The application captures on 10 Gbps optical ports (Pass-through ports) and outputs the filtered and modified packets is either aggregated or individually output on 1 Gbps Electrical/Optical ports.  All the features of high-end taps are packaged into this portable unit making it suitable for field testing and remote testing any point in the network.

The traffic on the output ports can be analyzed using packet analyzers such as PacketScan™-All IP analyzer or Wireshark®.

PacketExpert™ also supports Command line Interface (CLI)to access all the functionalities remotely such as Bert, LoopbackRFC 2544Record PlaybackIPLinkSim™, ExpertSAM™, and PacketBroker using TCL clients and MAPS™ CLI Server/Client Architecture.

Features

Capture

  • Capture packets non-intrusively over RJ-45 (Electrical) and SFP (Optical) ports at nano-second precision.
  • Supports capturing Full Duplex traffic (traffic from both directions) at wire speed (up to 10 Gbps on PacketExpert™ 10G and up to 1 Gbps on PacketExpert™)
  • Turn On/Off advanced features like Filters, Aggregation, Packet Modification, and Output traffic at run time

Filters

  • Supports a total of 32 filters per unit, with up to 16 user-configurable filters per port, combined into simple AND/OR expression
  • High filter definition flexibility – drill down to the bit level and define mask at bit level, so that each bit can either be filtered or ignored
  • Wide packet filters (Up to 120 bytes on PacketExpert™ 10G, and up to 40 bytes on PacketExpert™) that covers almost entire packet header up to UDP
  • Raw mode (bit-level) and Packet mode (layer-wise) filter configurations
  • Filter on various header fields like Source/Destination MAC Address, VLAN Id, MPLS Label, Source/Destination Ipv4 Address, Source/Destination UDP Ports
  • User defined filter offset to filter from any byte within the packet, including payload
  • Continuous mode (filters packets continuously) and Trigger mode (stops after the first packet detected and waits till the filter is enabled again)
  • Enable/disable individual filter at run time for maximum flexibility

Packet Modification

  • Modify filtered packets to include useful information like timestamp with nanosecond precision, filter number, port number etc. before sending out through the output ports

Aggregation

  • Aggregate packets filtered from both directions and send out on a single output port.

Output

  • Supports forwarding the filtered, modified and/or aggregated packets on selected ports

Statistics

  • Provides port level statistics like Total Frames/Bytes Received, Rx Frame Rate, Rx Data Rate, etc

 

Hardware Interface - PacketExpert™ 10G



PacketExpert™ Hardware Unit




Front Panel




Back Panel


  Standalone Tablet Inspired

Interfaces:

  • 2 x 1G Base-X Optical OR 10/100/1000 Base-T Electrical
  • 2 x 10G Base-SR, -LR -ER Optical only
  • Single Mode or Multi Mode Fiber SFP support with LC connector

Protocols:

  • RFC 2544 compliance

Bus Interface:

  • USB 2.0
  • None or USB 2.0

External Power Supply:

  • +12 volts, 2.2 Amps
  • +18 Volts, 3.0 Amps

Physical Specification:

  • Length: 6.39 in. (162.33 mm)
  • Width: 9.96 in. (252.93 mm)
  • Height: 2.10 in (53.34 mm)
  • Weight: 3.75 lbs. (1.7 kg)
  • Length: 6.39 in. (162.22 mm)
  • Width: 9.96 in. (252.93 mm)
  • Height: 2.59 in (65.96 mm)
  • Weight: 4.75 lbs. (2.15 kg)

 

Hardware Interface - PacketExpert™ 1G



Back Panel



Front Panel

Interfaces

  • 2 x 10/100/1000 Base-T Electrical only
  • 2 x 1000 Base-X Optical OR 10/100/1000 Base-T Electrical
  • Single Mode or Multi Mode Fiber SFP support with LC connector

Protocols

  • RFC 2544 compliance

Bus Interface

  • USB 2.0

Power

  • +9 volts, 2.2 Amps

Temperature

  • Operating Temperature: +5 to +40C
  • Non-Operating Temperature: -30 to +60C

Humidity

  • Operating Humidity: 0% to 80% RH
  • Non-Operating Humidity: 0% to 95% RH

Altitude

  • Operating Altitude: Up to 10,000 feet
  • Non-Operating Altitude:  Up to 50,000 feet

Physical Specification

  • Length: 8.45 in. (214.63 mm)
  • Width: 5.55 in. (140.97 mm)
  • Height: 1.60 in (40.64 mm)
  • Weight: 1.66 lbs. (0.75 kg)

Working Principle - 10G/1G Ports

Pass-through and Output Ports


10G ports in Pass-through mode and 1G ports are Output ports

The PacketExpert™ 10G hardware unit is equipped with both Electrical/ Optical ports (1000 Mbps) and only Optical ports (10G). The 10G: Port 1 and Port 2 optical only ports can be configured in Pass-through mode, and the 1G: Port1 and Port2 is used in either SFP or Electrical mode to act as output ports.


1G ports in Pass-through mode and 10G ports are Output ports

Similarly, the 1G: Port 1 and Port 2 can be used in either SFP or Electrical mode, which when configured in Pass-through mode, the 10G: Port1 and Port2 optical only ports act as output ports.

The Output ports the PacketExpert™ 10G unit in any of the above configurations can be connected to an external storage device or an analyzer for detail traffic analysis.

It is important to notice that although Pass-through ports and Output ports are both labelled with the port numbers, they are not interchangeable. Pass-through and Output ports have a fixed role and their purpose cannot be configured by users.

  • Pass Through Ports (2):
    In 10G mode, the Dual SFP 10 Gb/s ports, are generally connected in Pass Through to tap the network under test.

    In 1G mode, the Dual RJ-45 ports for electrical connection 10/100/1000BASE-T. Dual SFP ports for optical connection 1000 Mbps are connected in Pass Through to capture the network traffic.

  • Output Ports (2):
    In 10G mode, Dual SFP or RJ-45 based 1 Gb/s ports are used as Output Ports to forward capture packets to real-time packet analyzer.

    In 1G mode, Dual SFP based 10 Gb/s ports are used as Output Ports to forward capture packets to real-time packet analyzer.

The PacketBroker application, allows PacketExpert™ 10G to capture packets at wirespeed (up to 10 Gbps) non-intrusively over Optical ports at nano-second precision. It supports both Tapping (Pass through mode), and Tap-Filter-Aggregate-Modification modes.

The 1G Electrical/Optical ports of the PacketExpert™ 10G hardware can also be configured to non-intrusively capture network traffic at wirespeed.

PacketExpert™ operation is bi-directional, which means that both transmission directions are simultaneously processed by the equipment.


10G/1G - Tap, Filter, Aggregation, Packet Modification
  • Tap: Traffic is forwarded between the Pass-through 10G ports (Port 1 and Port 2) without any modification or delay. This makes the Ethernet link connected between Ports 1 and 2 (10G ports) act as a transparent full duplex Ethernet link, so that the connected devices/networks will not notice that a device is connected between them.

  • Filter: Supports wire-speed filtering of Layer2/Layer3/Layer4 Ethernet packets, with each port featuring up to 16 simultaneous filters each of 120 bytes in length.  Mono Trigger and Continuous filter modes are also supported.  Filter can be set to any offset within the packet, which gives flexibility to filter any header field as well as the payload.

  • Packet Modification:  PacketExpert™ 10G hardware modifies the filtered packets using an inband method of conveying information such as Timestamp (8 Bytes), Board Serial No. (1 Byte), Port No. (4 Bits), and Filter No. (2 bytes), to the (1G output ports) packet analyzer carrying this information in the packet's MAC header. The filtered packet's MAC header's Destination MAC Address (6 bytes) and Source MAC Address (6 bytes) fields are modified as below:


    Hardware Modified Ethernet Packet Fields
  • Aggregation & Output: The 10G port 1 (Pass-through port) traffic filtered is normally sent out on 1G port 1 (Output port). Similarly, 10G port2 traffic filtered is sent out on 1G port2. Alternatively, the filtered traffic from both 10G ports can be aggregated and sent out on a single port as a single stream. Since the aggregated stream rate can exceed wirespeed rate of a single port, the aggregated traffic is buffered in the onboard 8 GB DDR2 RAM memory, before being sent out.

    The traffic on 10G port 1 (Pass-through Port) is filtered and is sent to Packet Modifier, which is then sent out on 1G port 1 (Output port). Similarly, traffic captured on 10G port 2 (Pass-through Port) is filtered, modified and sent out on 1G port 2 (Output Port).

    So, the traffic on Output 1G ports 1 & 2 are Filtered and Modified Traffic from pass-through 10G ports 1 & 2 respectively.

Working Principle - 1G Ports

The PacketExpert™ hardware unit is equipped with both RJ-45 ports (Electrical) and SFP ports (Optical). The Port 2 and Port 3 can be used in either SFP or Electrical mode, and are generally called as Pass-through ports.

The Ports 1 and Port 4 are RJ-45 ports, and are generally called as the Output ports. When these are used, connect the PacketExpert™ unit with an external storage device or an analyzer.

It is important to notice that although Pass-through ports and Output ports are both labelled with the port numbers, they are not interchangeable. Pass-through and Output ports have a fixed role and their purpose cannot be configured by users.

  • Pass Through Ports (2): Dual SFP or RJ-45 based 1 Gb/s ports. The Ports 2 and 3, are generally connected in Pass Through Mode to tap the network under test.

  • Output Ports (2): Dual RJ-45 ports for electrical connection 10/100/1000BASE-T. The Output Ports interfaces are used to forward captured packets to real-time packet analyzer.

The schematic below summarizes the different functions such as tap, filter, packet modification, and aggregation of PacketExpert™ (up to 1000 Mbps) PacketBroker application.

1G - Tap, Filter, Aggregation, Packet Modification

The tap, filter, packet modification, and aggregation modes of PacketExpert™ are detailed below:

  • Tap: Traffic is forwarded between the Pass-through ports (Port 2 and Port 3) without any modification or delay. This makes the Ethernet link connected between Ports 2 and 3 act as a transparent full duplex Ethernet link, so that the connected devices/networks will not notice that a device is connected between them.

  • Filter: It supports wirespeed filtering of Layer 2/ Layer 3/ Layer 4 Ethernet packets, with each port featuring up to 16 simultaneous filters each of 40 bytes in length.  Mono Trigger and Continuous filter modes are also supported. Filter can be set to any offset within the packet, which gives flexibility to filter any header field as well as the payload.

  • Aggregation: The Port2 (pass-through port) traffic filtered is normally sent out on Port1 (output port). Similarly, Port3 traffic filtered is sent out on Port4. Alternatively, the filtered traffic from both Port 2 and Port 3 can be aggregated and sent out on a single port as a single stream. Since the aggregated stream rate can exceed wirespeed rate of a single port, the aggregated traffic is buffered in the onboard 2 GB DDR2 RAM memory, before being sent out. 

  • Packet Modification:  Filtered packets can be modified to insert useful information within the packet itself.  PacketBroker uses an inband method of conveying this information to the packet analyzer by carrying this information in the packet's MAC header itself. The filtered packet's MAC header's Destination MAC Address (6 bytes) and Source MAC Address (6 bytes) fields are modified as below:

    The PacketExpert™ hardware modifies the received packets and replaces the Source and Destination MAC Addresses (of 12 bytes) fields with Timestamp (8 bytes), Filter No. (2 bytes), Board Serial No. (1 byte), and Port No (4 bits) fields. 4 bits at the end are unused and is set to Zero. The new CRC (4 bytes) is calculated for the modified fields and is appended.


    Hardware Modified Ethernet Packet Fields

Filter Configuration - PacketExpert™ 10G

Wirespeed filter within PacketBroker supports Raw Mode and Packet Mode filter configurations. Filter can be set to each bit in the packet (Raw mode) or each field (Packet Mode).

In Raw mode, each bit can be set to "Filtered" or "Don't care" condition via filter mask. Each filter has 2 sets (Value and Mask) each of 120 bytes length. Value contains the actual filter data used for comparing. Mask is used to indicate the bit/bytes to be compared or ignored. Various packet field values can be edited directly as per the layer stack (L2/L3/L4) selected.

For each filter, offset can be set to any byte within the packet (from 0 to 15999 ) which gives flexibility to filter any field within any protocol header, or even the payload.

Up to 16 simultaneous filters can be applied per port with “AND” /”OR” condition set to combine all the filters. Further, each filter can be set to either Accept or Reject the packet.



Filter Editing in Raw Mode

In Packet mode, the user can create filters if layer stack of the incoming packets are known, then the filter can be set for individual fields. The supported layer stack and the editable parameters for each of the layer is as below:

  • MAC Layer Filtering for MAC layer, Hex fields like Source and Destination MAC Addresses, and Len/Type layer parameters can be edited individually with the value and mask.
  • VLAN layer Filtering - For VLAN Layer, VLAN Id field can be filtered by specifying the fixed value, or providing the range, or setting it to ANY.
  • MPLS Layer Filtering - for MPLS layer, the MPLS stack parameter (MPLS Label) can be filtered by specifying the fixed value, or providing the range, or setting it to ANY.
  • IP Layer Filtering - for IP layer, the IP layer Source and Destination Address parameters can be filtered by specifying the fixed value, or providing the range, or setting it to ANY.
  • UDP Layer Filtering – for UDP layer, Source and Destination ports can be filtered by specifying the fixed value, or providing the range, or setting it to ANY.


Filter Editing in Packet Mode

Each filter can be configured to run in either mono trigger or continuous filter mode.

Continuous mode is the normal filter operation mode where packets are set to filter continuously. In Mono Trigger filter mode, once the packet that matches the filter is filtered, filtering is stopped and, any further packets are not accepted, even if they match the filter. The first single matching packet is said to have “triggered” the filter. User can set the trigger again manually at run time. Correspondingly, Triggered/Filtered Packets statistics are logged.



Continuous/Mono Trigger Packet Filter Mode

 

Filter Configuration - PacketExpert™ 1G

Wirespeed filter within PacketBroker supports Raw Mode or Packet Mode filter configurations. Filter can be set to each bit in the packet (Raw mode) or each field (Packet Mode).

In Raw mode, each bit can be set to "Filtered" or "Don't care" condition via filter mask. Each filter has 2 sets (Value and Mask) each of 40 bytes length. Value contains the actual filter data used for comparing. Mask is used to indicate the bit/bytes to be compared or ignored. Various packet field values can be edited directly as per the layer stack (L2/L3/L4) selected.

For each filter, offset can be set to any byte within the packet (from 0 to 2047) which gives flexibility to filter any field within any protocol header, or even the payload.

Up to 16 simultaneous filters can be applied per port with “AND” /”OR” condition set to combine all the filters. Further, each filter can be set to either Accept or Reject the packet.



Filter Configurations (Raw and Field Edits)

Each filter can be configured to run in either mono trigger or continuous filter mode.

Continuous mode is the normal filter operation mode where packets are set to filter continuously. In Mono Trigger filter mode, once the packet that matches the filter is filtered, filtering is stopped and, any further packets are not accepted, even if they match the filter. The first single matching packet is said to have “triggered” the filter. User can set the trigger again manually at run time. Correspondingly, Triggered/Filtered Packets statistics are logged.



Continuous/Mono Trigger Packet Filter Mode

Packet Modification

The PacketExpert™ hardware modifies the received Original Ethernet packets at pass-through ports and replaces the Source and Destination MAC Addresses (of 12 bytes) fields with Timestamp (8 bytes), Filter No (2 bytes), Board Serial No. (1 byte), and Port No (4 bits) fields as shown in the figure. The new CRC (4 bytes) is calculated for the modified fields and is appended. The Hardware modified packets are then sent on Output ports.

The 1 byte “Board Serial Number” field can be configured to either take the Board serial number automatically from the connected PacketExpert™ unit or user can manually configure own numbering. This helps in identifying which PacketExpert™ board captured the packet, useful especially when multi devices are connected.



Packet Modification Field Configurations

Port Statistics

PacketExpert™ 10/1G PacketExpert™ 1G

Detailed Tx Rx frame statistics per port are provided. In addition to statistics like Frame Count, Frame Rate, Link Utilization, other statistics like Frame Type (Unicast/Broadcast/Multicast, VLAN), frame lengths (64, 65-127, 1024-1518, Oversized, Undersized), and FCS Error Frames are also provided.

The following figure displays Tx and Rx port-wise statistics for 1G: Port3.


10G/ 1G Port Statistics


1G Port Statistics

 

Buyer's Guide

Please Note: The XX in the Item No. refers to the hardware platform, listed at the bottom of the Buyer's Guide, which the software will be running on. Therefore, XX can either be ETA or EEA (Octal/Quad Boards), PTA or PEA (tProbe Units), UTA or UEA (USB Units), HUT or HUE (Universal Cards), and HDT or HDE (HD cards) depending upon the hardware.

Item No. Item Description
PXE107
PXG107
PacketBroker™ - 1G
PacketBroker™ - 10G

PXE108
PXG108

Multi-Stream Traffic Generator and Analyzer - 1G (on PXE100) (up to 12 users) (includes ExpertTCP™)
Multi-Stream Traffic Generator and Analyzer - 10G (on PXG100, PXG101) (up to 16 users) (includes ExpertTCP™)

PXG100 PacketExpert 10G™
PXG101 PacketExpert 10G™ with Tablet
PXE100
PXE104
PXE112
PXE124
PacketExpert™
PacketExpert™ - SA (4 ports) 
PacketExpert™ - SA (12 Ports)
PacketExpert™ - SA (24 Ports)
PXE105
PXG105
Wire speed Record /Playback - 1G
Wire speed Record /Playback - 10G
PXE106
PXG106
ExpertSAM™ - 1G
ExpertSAM™ - 10G
IPN110 IPLinkSim™ WAN Link Emulator
(1 Gbps, 2 active ports)
IPN510 IPLinkSim™ WAN Link Emulator
(10/1 Gbps, 2 active ports)
  Related Software
ETH100 PacketCheck™
PKS100 PacketGen™ (includes PacketScan™)
PKV100 PacketScan™ (Online and Offline)
PKB100 RTP ToolBox™
IPN701
IPN702
IPNetSim™ Handheld Network Impairment Generator 
IPNetSim™ Handheld Remote Option
PKS120
PKS121
PKS122
PKS123
PKS124
PKS130
MAPS™ SIP Emulator 
MAPS™ SIP Conformance Test Suite (Test Scripts)
MAPS™ MEGACO Emulator
MAPS™ MEGACO Conformance Test Suite (Test Scripts)
MAPS – MGCP Protocol Emulation with Conformance Test Suite
MAPS™ SIGTRAN Emulator

* Specifications are subject to change without notice

 
 
Home Page Sitemap Global Presence Email