When packets are forwarded from a network packet broker to the capture device, the latency can occur and timestamps may be incorrect
●Background of the Task
Network Packet Broker (NPB) efficiently receives and aggregates or duplicates packets from various sources. This eliminates the need for separate management of traditional SPAN or Network TAP, simplifies complex networks, and can lead to reduced operational costs.
NPB also has the capability to timestamp within the packet the time the packet was received. This allows network monitoring based on packet reception times.
In captured data, the timestamp is added as the time of packet reception by the capture device. However, there may be discrepancies between the time the packet passes through various points in the network and the time it reaches the capture device. Therefore, analyzing based on the timestamp of the capture device may result in the inability to accurately analyze the performance of the network.
●SYNESIS Solutions
SYNESIS supports the timestamp feature of the following network packet broker (NPB) vendors:
- CGS Tower
- VSS Monitoring compatible (for example, NetScout, CUBRO, ProfiTap)
- Gigamon
SYNESIS can use the timestamp provided by the NPB instead of the timestamp received from the internal acquisition adapter (NIC) of the main unit at the time of parsing. By analyzing packets captured and timestamped at the NPB installation points, you can more accurately measure network latency, quality of service (QoS), jitter, and end-to-end network performance.
●User Benefit
In today’s networks, many companies deploy NPBs for network monitoring. By using the timestamps of NPBs located at every point on the network, you can accurately measure latency, jitter, and end-to-end network performance between local points, helping to identify bottlenecks in communication.