20Gbps Packet Capture

Posted by fmadio | 100G Ethernet

Finally our 20Gbps dual port 2x10G capture system is available! Its been quite a bit more work than expected as 30M Packets/Sec processing isn`t easy, but we`ve done it and open for orders.

  • 20g packet capture
20Gbps Packet Capture

Based on customer feedback there`s been many requests for a 2x10G port capture system. Primary reason is to capture 10G line rate full duplex both Rx and Tx lines all in a single 1U package. Its stocked with full 20Gbps write bandwidth to a massive 2TB of cache (T for Tera Byte!), 16TB of raw HDD space, hardware time stamping and more! Its built upon our proven FMADIO10 packet capture software stack and existing hardware architecture.

Whats the Specification?

Very similar to the FMADIO10 10G packet sniffer. Primary difference is sustained 20Gbps (via 2x10G ports) to our blazing fast cache.

The Specs:

  • - 2x10G SFP/SFP+ Packet Capture Ports
  • - 1x10G SFP/SFP+ Management Interface
  • - 1x1G RJ45 Management Interface
  • - 2TB of SSD Cache
  • - 16TB(raw) HDD space
  • - Hardware Time Stamps
  • - PTPv2 Time Synchronization
  • - GPS Time Synchronization

Hardware wise its a slightly more powerful version of FMADIO10.

  • - 32GB ECC DDR4 RAM
  • - 6 Core 3.5Ghz Intel CPU (Single UP processor)
  • - 8 SSD`s for full 20Gbps+ write bandwidth
  • - 4 HDD`s for maximum storage capacity
  • - all in a compact 1U chassis

High Level Architecture

The system architecture is quite similar expect the pipes are bit larger (20Gbps), cache is bigger (2TB) and there is a sort/merge/filter stage in the pipeline. Other than that all the existing features and functionality of FMADIO10 are present in FMADIO20 for sustained 20G packet capture.

20g packet capture architecture 10g packet capture architecture

Single CPU 30M Packets / Sec

Yup that's correct 30Mpps, but actually we test at sustained 31.25M packets/second to add some margin and all on a single CPU core! It works out to be about 70-100 CPU cycles per packet that's entirely dominated by cache / data stalls. Why on a single core? because we merge the two packet streams together based on the hardware timestamp. Why not multi-thread it? .. because single process sorting is so much simpler, that is if you can hit the performance target! Net result is a beautifully merged packet stream in perfect time order. As there`s nothing worse than having packets out of time order when performing latency analysis.

What does it look like?

Almost exactly the same as FMADIO10, only difference is a few more 10G ports at the back of the chassis!

20g packet capture chassis front
20g packet capture chassis rear

Port Layout:
- 10G Capture A (in Green)
- 10G Capture B (in Blue)
- 10G Management interface (in Red)


Our 20Gbps packet capture device is a 1U 16TB capture device, that does full 20Gbps line rate (up to 2TB) with an outstanding GUI that's simple to use and includes our excellent microburst analysis toolkit. If you have any questions please contact us!