Re: 10GigE capture

[Loris Degioanni <loris.degioanni () cacetech com>]

On 5/13/2010 8:30 AM, Stuart Kendrick wrote:
> Has anyone built their own 10GigE probe? I'm imagining just doing the same thing
> I've done for 1GigE: NICs from Intel, Cory Satten's Gulp, the fastest storage
> array I can afford, and a SPAN port.
>
> I've vaguely thought of making the primary storage SSD, to which Gulp writes,
> then buying slow disk and using a cron job to copy files off SSD as fast as
> possible.  But I haven't actually tried this yet.
>
> And I'm imagining that Cace will deliver a 10GigE version of TurboCap at some point.

Actually, CACE is going to start offering a 10G solution very soon. As a 
matter of fact, in few weeks.

We'll offer the same three alternatives that are currently available for 1G:

- card alone
- appliance kit (card + optimized dump to disk software + remote 
analysis software)
- turn-key appliance

Pricing will be extremely competitive.

> Have any tips for me?

- don't use SSD drives. They are not that much faster when dumping a lot 
of data sequentially, they have a shorter lifespan, and they are 
expensive. If you need more disk performance, increase the number of 
drives: it's much more cost effective.
- be sure to know what your bottlenecks are before designing the system
- be careful when you read the packets for analysis: unless you use 
tricks, it will completely destroy the write performance.

Loris Degioanni, CTO
CACE Technologies
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe