We get asked alot, "why is your 10Gbps Packet capture price so good?". Almost all our clients have some disbelief about our prices. There`s a secret to our pricing and how we achieve such affordable packet capture systems. Its`s not magic just high quality engineering, we discuss the how`s and whys in this post.
Bring Build Your Own Device
It seems like an eternity since we begun this 100Gbps 40Gbps and 10Gbps packet sniffer journy, but it started simply as "build a device you want, yourself". At the time we were running high end, low latency networking apps but our infrastructure sucked, I mean it truly sucked. Packet capture was adhoc at best, processing and storing packet data was horrible, all because we didnt assigned time specifically to packet capture infra. We looked around for a complete solution, couldn't find anything reasonably priced and spending $100K+ on a name brand system felt so wrong. Thus the DIY 10Gbps packet capture system began.
Our 10Gbps Packet Capture
Over time our 10G packet capture system evolved, morphed and evolved some more until we built a business from it. The business goal is to make 10Gbps packet capture ubiquitous. And to achieve that you must design specifically around price from day 1. Our competitors use alot of expensive hardware, dual socket 3U or 5U servers with ludicrous amounts of RAM and enough disks to keep you heated in the winter. And that works, there`s no doubt 10G packet capture can be done.
But is it efficient ? absolutely not. You certainly dont need dual socket 18 core CPU system with 128GB of RAM to capture a 10Gbps, 20Gbps, 40Gbps and even 100Gbps line rate 64B packets.
One of our biggest price advantage`s is a low end hardware specification. This is intentional and the result of an excellent design to keep costs down. For example our 10Gbps system is only 16GB of ECC RAM with a single 4 Core 3.5Ghz CPU. The 20Gbps system is slightly more, 32GB ECC RAM, single socket 6 Core 3.5Ghz system. And even our 40Gbps system runs on a single socket 8 core CPU. But full disclosure... our 100Gbps packet capture system does use 2 CPU sockets, sorry!
Ofcourse all these systems have no problem processing line rate 10G @ 14.88Mpps, 20G @ 29.76Mpps, and 40G @ 59.52Mpps. The secret is relentlessly tested and ruthlessly optimized blazing fast code. There`s alot of performance optimization tricks of the trade in our system, plenty of AVX2 intrinsics and a splash of assembler when you really need some juice.
Todays Linux x86 systems, CPU cycles and IO bandwidth are plentiful, its how you use those resources that`s important. For our packet capture systems its simply, Efficient code == Lower hardware specification == Better prices.
Another advantage is storage architecture. We specifically designed the storage system as a hybrid SSD/HDD. As in reality (almost) nobody needs true sustained 24/7 10Gbps line rate capture. Bursting for minutes or hours absolutely, we have 1TB (10Gbps) or 2TB(20Gbps) of SSD cache to capture full line rate.
To put 10Gbps line rate 24/7 into perspective, for 24Hours thats 10e9 * 60(min) * 60 (hour) * 24 (day) / 8(bits) = 108TB / day. Are you really capturing 108 Terabytes a day? If you are, then your mini-NSA 10Gbps line rate clandestine blackops capture spec needs... 12-16 x 3.5" 7.2K RPM magnetic disks (dont get me started on 15K RPM disks) and full 20Gbps needs 24 or more - SSD`s are too expensive for 108TB of storage! All those resources adds hardware cost and maintenance cost for so many magnetic disks.
We took to the alternate approach and made the bet 99% of customers aren`t capturing 108TB /day and prefer the benefits of a hybrid SSD/HDD model.
All up, this business started out as our own 10Gbps packet capture system and has evolved into the rock solid products you see today. Years of man hours have gone into the system and due to parallel deployments, it has already booked a decade`s worth of real production hours. We believe 10G packet capture should be ubiquitous, and done correctly its not expensive at all.
... so we deliver the highest quality packet sniffer on the market at a reasonable price!