Minimum Sustained Capture Speed
Resources
The minimum sustained capture speed is the fastest tested sustained speed at which the appliance can operate without errors on continuous basis – twenty-four hours a day, seven days a week. The minimum sustained speed differs from the peak speed, which is the highest speed at which the appliance can operate.
In general, network administrators need only worry about the minimum sustained speed when their network is over-utilized. A good rule of thumb is to keep the network’s steady usage below 40%. If higher than 40%, the network is likely to be overloaded and peak usage would overwhelm the network equipments’ buffers (resulting in dropped packets). A gigabit switch’s typical buffer is 1 MB per port or less, just enough to manage a sustained speed of 1 Gbps for 0.008 seconds.
IPCopper packet capture appliances are calibrated to achieve maximum performance in a real-world networking environment without packet loss, even if used under heavy loads with frequent usage spikes up to 1 Gbps. Most of our 1 Gbps packet capture appliances feature minimum sustained capture speeds of 400 Mbps, while at the same time simultaneously encrypting the captured packets with dual encryption and a 20 Kb key (in the case of the competition, very few manage to achieve a minimum sustained capture speed of 250 Mbps without encryption – some do not even publish their appliances’ sustained speeds). IPCopper GbE appliances are able to handle continuous usage levels of 400 Mbps and can handle spikes to higher usage longer than most other gigabit networking equipment. For example, our gigabit appliances can handle spikes to 1 Gbps utilization for about 15 seconds, 500 Mbps spikes for about 100 seconds and 450 Mbps spikes for about 200 seconds.
Network traffic is analogous to freeway on-ramps. When little traffic is present, the cars zoom onto the freeway without delay. Once congestion reaches a certain level, however, the cars must queue up on the on-ramps and wait their turn to enter the freeway. Likewise packets on a network with low utilization pass through the network quickly, while on congested networks the packets must often queue up in the buffers of the network equipment (such as a switch, computer, router, etc) and wait their turn to traverse the network.
The TCP/IP protocol incorporates methods to adjust to available bandwidth. The initial burst of a TCP/IP session, though sent at 1 Gbps, is short (8-16 packets). After that, the session gradually adjusts the speed to available bandwidth, negotiating it in such a fashion as to avoid packet loss. In effect, a TCP/IP session bursts at 1 Gbps for only a fraction of a second, and then adjusts. Only a huge volume of simultaneous network traffic would result in very high sustained utilization, but in this case, the speed of individual sessions would be well below 1 Gbps, even as low as 50-200 Mbps.
I was under the impression that if an appliance was a 1-gigabit appliance it could operate at that speed continuously. Isn’t that how it is?
That is absolutely not the case for competition or IPCopper. IPCopper packet capture appliances can capture traffic at sustained speed of 400Mbps until full and at 1 Gbps for about 15 seconds. In the case of our competitors in the field of packet capture, their appliances’ minimum sustained capture speed varies from under 100 Mbps to 250 Mbps. Many choose not to publish their minimum sustained rate at all, instead making vague assertions that their appliance is capable of a theoretical, maximum or peak speed of 1 Gbps.
Why should I care about the minimum sustained capture speed?
The minimum sustained capture speed is really only of concern if you have a network that is over-utilized. A general rule of thumb is to keep sustained network traffic at 40% or less, so that usage spikes will not overwhelm your networking equipments’ buffers (causing packet loss).
Does minimum sustained speed mean that it will slow down my network to 400 Mbps?
No. Unlike the competition, IPCopper products introduce less than 1ms (0.001 sec) of a delay with typical delay pegged at about 0.2ms (0.0002 sec).
What about other types of traffic, such as VoIP?
VoIP is actually a lot easier to manage because it flows at a fixed rate, without “bursts.” Achieving a VoIP utilization of 400 Mbps requires several thousand simultaneous SIP sessions.
