In June 2015, we had launched SYNESIS, the world’s first packet recorder supporting 100GbE. In this blog, we would like to share the background of this development of 100GbE SYNESIS Portable, it is still the only product in the world which can capture up to 100 Gbps (as of October 25, 2018).
To begin with, we imagine the simple situation; when we need a packet capture ?

Then,what would you do, if there is an incident in the network and we need to capture packets? 

You may say that you would bring a laptop PC and capture packets with Wireshark.

 

However, what if the network speed is 10G or higher?  Since Wireshark records the captured data on memory, the PC cannot often keep up the speed to handle the data and freeze at the end. As the capture performance also depends on your PC capacity,there is no guarantee of no packet loss.  Therefore, it would not be a good idea to capture traffic over 10 G with Wireshark.

 

To solve this high speed traffic issue for the final goal “Complete Capture at any speed”, using a bulky rackmount packet recorder would be a good solution.  As data can be captured and saved for a long time, it helps us to solve issues smoothly by analyzing the traffic and identifying the root cause.

 

However, again, what if the packet capture is not installed in the current network?  Would you purchase a new rackmount packet recorder and install it on site?  In this case, it would take a long time before starting to capture packets, also it costs to install a system, at each location.

 

Now this is the scene where a portable packet capture is useful.  A portable packet recorder is attractive because of its portability and convenience.  If you have one portable packet recorder , you can bring it to any site wherever a fault occurs and just start capturing.

 

However, again and again, what if the traffic is 100GbE and portable is needed?

This is what we thought in 2014 , when we had started to develop SYNESIS.

There are already some product to capture packets at a full rate of 1 Gbps or 10 Gbps. However, our target in 2014 which we started development of SYNESIS, was how to provide the portability with keeping the reliability to capture “The Coming Network 100GbE” .

 

We tried to find out the manufacturer who was willing to develop a portable system for 100 G with us , but no one wants to explore with us because the network speed was typically 1 G or 10 G at that time, and 100G  seemed “Too early stage” as commercial base.

 

After months ,finally we decided to develop a 100G packet recorder by ourselves.This was the moment of our quantum leap.

 

Feature

 

1. Portability

 

The main feature of SYNESIS Portable is its portability despite its high capture performance.  “Portability” means that the system is light enough to carry and robust enough to withstand shock during transportation.  We achieved this goal by adopting a dedicated chassis and SSD, which is lighter and less impacted by physical shock than HDD.

 

You can just go to a site only with SYNESIS Portable in a carrying case and capture packets.  Nothing else is needed, because a monitor, a keyboard and a touchpad are included in the chassis.  You can either analyze traffic onsite or bring back the data to analyze with different tools.  PacketReplayer® (*1) can be also used to transmit the captured packets to an evaluation network at the lab.

If your travel could be more tough, we can provide you a hard carrying case for long-distance transportation.

 

2. Capture performance

 

Capture performance is the most important feature for SYNESIS Portable.  SYNESIS Portable uncompromisingly pursues 100% capture performance at wire rate.  However, it is not easy to combine this with portability.

Usually, the bottleneck of capture is the writing performance into the storage.  In order to capture traffic of 100 G, it would be necessary to save data nearly 12.5 GB “every second” by simple calculation.  Can you imagine how long it would take to copy data of 12.5 GB to your PC storage?  You can probably understand how difficult it is to prepare storage that can withstand 100 Gbps rate continuously, for a longtime.

 

In the case of a portable , it is more difficult to keep the saving data inside due to lack of space in the chassis.  This is why the problem of storage performance is more crucial for a portable than rackmount.

 

For hardware, we developed a dedicated chassis for 100 G capture which allows to mount the number of SSD which can realize 100G capture performance. Also we developed the effective data writing way. In 2015, we finally launched our 100GbE packet recorder .  As mentioned above, SYNESIS Portable is the only product in the world that captures 100 Gbps traffic as of today (October 25, 2018).

Writing data using parallelization and load balancing

 

 

Challenges

 

1. Heat Issue

Normally, you do not need to worry about the heat issue.  If you use rackmount system, the heat issue can be solved simply with airflow space.  In the case of a portable , however, appropriate ambient temperature is very important point to keep the performance, as many discs are  installed in a limited space and thus difficult to get a enough airflow.  Although SSD releases less heat than HDD, the controller which is used in most SSD tends to limit the performance once the temperature exceeds a certain value.  This fatally affects the capture performance.  In addition, considerable heat is released by the capture card and transceiver.

 

Decline in writing performance due to the temperature exceeding the usable temperature range of SSD

 

Based on our experience with rackmount packet recorder , we achieved 100G capture on a portable chassis nearly one year before the official release of SYNESIS.  However, further difficulty lay ahead. Initially we chose 15mm thick SSD for better performance, but we could not solve the heat issue.  Hence, we tried to solve the heat issue by increasing the chassis size by 20 % compared to the current chassis.  However, it is no longer “Portable” as the size is too big and too heavy. Therefore, we decided to select SSD and re-design the chassis again.

 

After months of feasibility, we adopted 7mm thick SSD, improved the airflow in the entire chassis, and completed an ideal portable product with keeping the portability and performance, in a general ambient temperature up to 35deg C .  The airflow inside of chassis was optimized by a fan for the disc bay ( where SSD is installed)  Consequently, SYNESIS Portable can be used for a long-time capture without deterioration in performance (although some noise from the fan is unavoidable).

 

Future

 

As a next step we try to achieve Bidirectional 100G, i.e. 200 G performance.  The current mainstream PCI Express 3.0 only achieves 8 GT/s per lane or 128 GT/s for 16 lanes, i.e. throughput of less than 128 Gbps, which is a bottleneck.  Once a motherboard supporting PCI Express 4.0 becomes available, the throughput of 16 GT/s per lane or 256 GT/s for 16 lanes can be achieved.

 

 

The storage performance is no longer  bottleneck on our machine.  The performance of 200 Gbps will be achieved without much difficulty, once the surrounding environment such as PCI Express becomes ready.

 

PacketReplayer is an optional feature of SYNESIS which is able to replay the data captured by SYNESIS from commercial network.

 

© Copyright 2018 TOYO Corporation. All rights reserved. All trademarks used in this document are the property of their respective owners. TOYO reserves the right to change product content and product specifications without prior notice.