PacketExpert™ - Wirespeed Ethernet Packet Capture and Playback
PacketExpert™ Software Ver 4.1.31 is Now Available! Download it here
PacketExpert™-Record Playback module is designed for High-Precision Wirespeed Packet Forwarding (up to 1 Gbps) and Wirespeed Packet Capture, Filter, Drop (for real-time analysis) & Storage (for offline analysis) over optical or electrical interfaces. It supports all the features of high-end taps in a portable unit providing mobility and storage capacity to reach any point in the network.
The Record and Playback modules allows users to use PacketExpert™ for -
- Continuous Simultaneous Capture and Playback over Multiple Ports
- Continuous Long Term Capture along with real-time transfer to host PC. This allows for huge file capture limited being only the hard disk space
- Filter for packets of interest, reducing the bandwidth needed to transfer to host
- Record the captures to a file - supports popular capture file formats such as *.pcap, *.ngpcap, *.hdl, and *.dat.
- Continuous Playback on the same port where capture is running.
- Supports simultaneous capture or playback functions on multiple ports - Port 1, Port 2, Port 3 of PacketExpert™; Port 2 and Port 3 can support Electrical or Optical interfacing.
- Also supports simultaneous Packet Capture and Playback on the same port
- High Precision Wirespeed Ethernet Packet Forwarding from a captured file
- Precisely simulate/recreate live network traffic conditions.
- Supports the 'As per File" option. This option allows user to precisely regenerate the traffic from a pre-recorded file i.e. traffic is transmitted at the precise rate at which it was captured (by maintaining the recorded timestamps).
- High Precision Wirespeed Ethernet Packet Capture to a captured file
- Supports limited lossless capture and continuous capture modes.
- In lossless capture, the recording stops automatically when the Onboard 2 GB buffer fills up.
- In continuous capture, the recording continues even after the Onboard buffer is full with discontinuous recording indication.
For both Capture and Playback, the application supports popular capture file formats such as PCAP/PCAP-NG (Wireshark® formats) that gives the users the flexibility in analysing and recreating any kind of live network conditions. The traffic captured on a live network using packet analysers such as PacketScan™-All IP analyzer or Wireshark® can be easily recreated in the lab using PacketExpert™-Playback feature.
The packets captured to an HDL file using PacketExpert™- Record
feature can be analysed and decoded using PacketScan™-All IP analyzer
Modes of Operation
Record and Playback feature has following modules –
- Record Only mode - Can perform following operations –
- Capture packets to files simultaneously on 2 GigE ports (electrical or optical)
- Up to 2 GB of traffic can be captured using the onboard 2 GB memory.
- Record and Playback mode - Can perform following operations –
- Continuous Capture, Filter, and Storage simultaneously on up to 3 GigE ports (electrical or optical)
- Continuously Playback packets using pre-recorded files simultaneously on up to 3 GigE ports (electrical or optical)
- Simultaneously Capture and Record on 3 ports
- Record and Playback utilises 1 GB each of the 2 GB on board memory available as a temporary buffer
- Record Only or Playback Only mode – Can perform following operations –
- Transmit packets at wirespeed using pre-recorded files simultaneously on up to 3 GigE ports (electrical or optical)
- Upto 2 GB of traffic file can be loaded into the onboard 2 GB memory for wirespeed playback.
- Record and Playback (per port) mode - Can perform following operations –
- Wirespeed Packet Capture, and Filter along with Playback simultaneously on each of the 3 GigE ports (electrical or optical) independent of operations on other ports
- Capture and Playback utilises 1 GB each, of the total 2 GB memory available onboard, as a temporary buffer.
Wirespeed Packet Capture
The application allows continuous or limited capture of Ethernet packets using the 2 optical or electrical GigE ports. The captured packets are transferred to the host via the USB 2.0 interface at run time and stored on the host PC’s hard disk. The capture can either run continuously or be limited to a specified file size (MB), number of packets, or specified time duration.
- Comprehensive multi-port receive testing capabilities at wirespeed
- Records the received packets into a file up to hard drive capacity (limited by disk write speed)
- Packets can be captured continuously (till user manually stops the capture or up to hard drive capacity) or limited by a specified size in MB, specified packet count, or specified time duration
- Supported output file formats are *.pcap, *.ngpcap, *.hdl, and *.dat
- Test non-intrusively over electrical and optical ports
- Wirespeed capture and storage can be accomplished utilising the onboard DDR2 memory size of 2GB
- High precision timestamp is recorded along with the packet. Precision up to 10s of nanoseconds possible.
- Wirespeed filter to capture only traffic of interest
- Displays some useful statistics that help user to check the progress of the capture
Wirespeed Packet Filters and Triggers
The Record to File feature includes a powerful “Wirespeed filter” that allows user to filter out unwanted traffic, and continuously capture the traffic of interest. The limitation being only the hard disk size and the disk write speed. Features of the Wirespeed packet filter are listed below:
- Filter packets and record only packets of interest
- Capture simultaneously on 2 ports with 40 bytes deep filter per port (for record Only module) or on 3 ports with 16 bytes deep filter (for Record and Playback module) and set filter on any one of the ports or all ports
- Packet filtering can be based on all Layer 2 (Ethernet), Layer 3 (IP) Layer 4 (UDP/TCP) Headers
- Up to 16 filters can be defined per port. Each filter is up to 40/16 bytes wide
- Filter can be set to each bit in the packet (Raw mode) or each field (Packet Mode)
- Generates a trigger (1 Microsecond pulse) for each packet that passes the filter
Supports both Raw mode/Packet mode filter editing. In Raw mode, each bit can be set to ‘filtered’ or ‘don’t care’ condition via filter mask. For each filter, offset can be set to any byte within the packet (from 0 to 2000) which gives flexibility to filter particular fields within protocol headers, and also the payload. Up to 16 filters can be defined, and “AND” /”OR” condition can be set to all the filters. Further, each filter can be set to either Accept or reject the packet.
Wirespeed Filter - Raw Mode
In Packet mode, user can define the Layer structure (Protocol Stack) of the packet, define the offset and edit individual field's data/mask.
Wirespeed Filter - Packet Mode
Playback Packets from File at Wirespeed
The application permits transmission of packets from a pre-recorded file. The pre-recorded packets are read from the file present on the host PC hard disk and transferred to the PacketExpert™ hardware via the USB 2.0 interface at run time for transmission.
Most important feature of the playback application is that the traffic can be played back at exactly the same way as it was captured. During playback, the relative timestamps for each packet transmitted is maintained exactly like in the source file. Since playback happens in the hardware, it can achieve nanosecond accuracy in maintaining the timestamps.
The transmission can be limited to a specified number of packets, or set to play the file till the end-of-file, or continuously play the file. The supported file formats from which the packets can be transmitted are *.pcap, *.ngpcap, *.hdl, and *.dat. The file used for playback can be created using the Record-to-File application. Transmission file sizes are limited only by the hard drive size.
- Playback packets from the captured or pre-recorded files
- Playback can be done on up to 3 ports simultaneously.
- Each port can transmit a file separately and independently (in Record and Playback (Per Port) module). ‘As per File’ option allows the users to playback the traffic exactly the same way as it was captured it maintains the timestamp when it was captured, and also sends out the packets from the same port as it was captured.
- Captured traffic on one port can be transmitted on the same or any other port – will be redirected to the correct port at run time.
- Packets can be transmitted either continuously, limited by number of packets, or till the end-of-file (EOF)
- Packets transmission is from USB2.0 to DDR2 and playback is based on time-stamp depending on the captured rate
- The supported file formats from which the packets can be transmitted are DAT (.dat - GL proprietary), HDL (.hdl - GL Proprietary and can be used for offline analysis by GL’s PacketScan™), PCAP (.pcap - used by Wireshark®) and NGPCAP (.pcapng/.ntar – Next Generation Wireshark®) formats. This file used for playback can be created using the Record-to-File application or can be a file captured by Wireshark®
- Displays some useful statistics that help user to check the progress of the playback
Results and Statistics
Record statistics display includes Capture Duration, Total Rx Frames, Frames not matched to filter, Frames matched to filter, Overflowed Frames, Overflowed Count, Transferred Frames, Disk Write Rate (bytes/sec), Disk Write Buffer Utilization (%), and Capture File Size
Playback from file statistics includes Playback time, Total number of transferred frames to onboard buffer, and Total frames transmitted parameters
Aggregate Filter Statistics gives the number of frames passing a particular filter configuration.
Aggregate Filter Statistics
|Complete Test Report can be exported in PDF or CSV formats. The report details can also be customized with user-defined Title, Header, Footer, and Logo prior to generating.
Complete Test Report - PDF
PacketExpert™ Main Page
Back to PacketExpert™