1. preface
as ip networks have significantly developed into broadband and therefore enabled time delay, the service diversification is inevitable. ip networks can bear various services including data, sound, images and video, which is the trend for telecommunications networks, data networks and enterprise networks. according to various demands of ip networks, those including monitoring, audit and traffic analysis have also become complex, requiring new targeted products and solutions introduced.
targeting for ip traffic collection, exprobe, designed by embedway, provides solutions to various service applications.
2. product overview
exprobe is enhanced traffic aggregating and distributing appliance with high density of interfaces, abundant working mode, flexible deployment, and convenient maintenance. it is adaptable for diverse application environment, such as network information monitoring, network application analysis, signaling analysis etc.
exprobe provides intelligent traffic selection on multiple links simultaneously. it features data flagging, aggregation, filtering, duplication and load balancing output. it is quite suitable for high density links, high traffic load links, and high complexity links. exprobe is far more than normal network capturing equipment. it integrates traffic distributer, filter, analyzer and load balancer into single one device, providing flexible and effective solutions of data acquisition, such as network security, protocol analyzer and signaling analysis systems etc.
● all the interface can be set to input or output flexibly
● full duplex line speed processing without any packet loss, taking the advantage of fpga hardware
● support full traffic aggregation and distribution, with the integration of user session
● providing detailed traffic statistics on interfaces
● traffic duplication on interface or filtering rules
● support gtp and gre tunnel protocol, as well as traffic distribution by internal ip address. powerful packet classification, based on input interface, 5-tuple value, characteristics field and application protocol etc.
● support multiple monitoring model, including many to one aggregation, one to many duplication, upstream/downstream separation and session aware load balancing
● support precise timestamp flagging
● friendly management interface, providing sophisticated command line interface, web and snmp interfaces
● detailed multiple level system logging
● support multiple device interconnection and uniform management
3. typical case illustration
3.1 idc content audit monitoring system
● support traffic collection of various ethernet links, including 10m/100m/1000m/10g ethernet links.
● filter traffic, that is to identify the exact traffic of http, email, etc, to discard useless traffic and thus to relieve the stress of service systems.
● load balancing without data missing to ensure content-related packets being forwarded to the same processing device.
3.2 enterprise/campus network traffic analysis and ids cluster system
● support the way of splitting or port mirroring to collect and distribute traffic of various ethernet links, including 10m/100m/1000m/10g.
● support the distribution filtering and load-balance forwarding based on packet features, and work as the front-end platform for traffic collection of content monitoring & traffic analysis system.
● meanwhile as the distributor for ids, support various forwarding ways and provide clustering solutions for ids.
3.3 operator traffic analysis and value-added service system
● collect broadband traffic from one/multiple bras and authentication server uplinks. provide front-end data collection & filtering & distribution for various internet value-added service, including green internet, information transmission, user action analysis, illegal sharing, illegal voip detection, etc.
● filter and forward traffic according to different content different service requires, in order to relieve the stress of service system.
● provide data integrity load balancing for large traffic service. stand-alone system can be extended to multi-machine distributed processing.
4. summary
as the front-end device supporting ip services, exprobe has developed a comprehensive solution to meet various complex demands in multiple fields.
