Overview

Businesses require reliable mechanisms to capture and retain network data for many reasons. With the costs of network breaches and their fallout rising ever higher, knowing what is happening inside their network is critical. It’s not just a matter of network downtime, lost productivity or data loss: not knowing what data and communications are passing in, out and through their network exposes businesses to any number of security, regulatory, legal, compliance and reputational risks.

With so many applications and communications now web-based, businesses need the granular visibility that 100% packet capture provides in order to see the what, when, how and who. The USC10G4, a 10G fiber packet capture appliance, brings tremendous value to the task of packet data capture. With peak 10G performance and minimum sustained recording of 5 Gbps at 6 million packets per second, the USC10G4 provides detailed, comprehensive network visibility for even the busiest networks.

High-performance, full packet capture provides the basis for quality data analysis, forensic or otherwise. It’s essential both for post-security incident forensics and network diagnostics. The USC10G4 gives you the full picture, capturing every packet, both header and payload, timestamped in the order received.

Features and Convenience

The USC10G4 has the features you want and the convenience you need for monitoring high-speed 10G fiber networks. Truly operational out of the box, no configuration is required to begin capturing packets — simply connect a few cables, power the unit up and you are ready to go. Installing the USC10G4 requires no changes to your network topology – your other networking equipment won’t even notice that it’s there.

Two 10GBASE-SR ports and four 1-GbE ports give you the flexibility to meet any number of installation needs. Key features include:

• Live packet capture, either inline or SPAN, at up to 10 Gbps with a minimum sustained capture and record speed of 5 Gbps at 6 million packets per second is ample for even the busiest 10G fiber networks.*
• Bypass, either as an automated failover passthrough measure or on demand, gives you flexibility and peace of mind (even if it loses power, the USC10G4 passes traffic).
• Secure management utility for encrypted data retrieval, status checks and setting changes.
• GPS time synchronization with clock resolution to 1/10,000,000 of a second for highly accurate and highly precise packet timestamping.
• 24 TB dually encrypted storage with 20,000-bit key.
• Integrated security features protect data from unauthorized access, including a stealthy network profile, physical access controls and a tamperproof, steel enclosure.
• High-speed capture-to-disk with near-real-time indexing for speedier data retrieval.

The USC10G4 is a dedicated, purpose-built packet-capture appliance with high performance and large storage, the first block for building a data-driven monitoring fabric for anomaly detection, network optimization and forensic investigation.

*How we tested the USC10M2's speed: We conducted two tests, using a separate IPCopper unit to create a sampling of 2 billion UDP packets with 64-byte payloads. For the first test the USC10M2 was in inline mode (both receiving and sending). We observed that the packets were received by the test unit, correctly sequenced, and subsequent analysis of the captured data showed that the packets were encrypted, indexed and stored in the correct sequence. For the second test, the USC10M2 was placed in SPAN/mirror mode (receiving only). With both tests we observed zero errors and also observed that the count of good packets matched the total number of packets sent. During testing we observed that the unit was able to successfully capture, forward, encrypt, index and store over 6 million packets per second, with an observed, sustained storage rate of up to 5.925 Gbps (including timestamps and other overhead) and a useful payload of over 5 Gbps (including headers for ARP, IP and UDP).

Features

Automatic / Manual Bypass

The USC10G4 features bypass, available both on demand and as a failover passthrough in case of power loss or other malfunction. In effect, if the USC10G4 experiences a problem, it automatically removes itself from the network without any user effort required and without any damaging disruption to network operations.

Bypass gives you great flexibility. You can deploy the USC10G4 on critical links where you need 24/7 or only occasional visibility, yet be assured that if the worst happens and the appliance fails or someone unwittingly unplugs it from power, the network will continue humming. At worst, the unit won’t be able to capture anything, but it won’t bring a screeching halt to network traffic.

Utilizing bypass on demand, you can place the USC10G4 at any network location you wish to monitor in the future, or only monitor intermittently, on a schedule that is convenient for you. Simply manually enable and disable bypass mode as needed.

In the case of loss of power, bypass kicks in practically instantaneously, allowing the USC10G4 to pass network traffic even when it is OFF. In the event the unit malfunctions, a watchdog timer ensures that the inline port pairs switch over into bypass mode to prevent network interruptions. Depending on the particular packets passing through at the time, it may take one to six seconds for the switch to take effect after a malfunction – ranging from unnoticeable to little more than a hiccup.

GPS Time Synchronization & Nano-Second Timestamping

The USC10G4 includes a very accurate GPS-powered system combined with a high accuracy clock that timestamps packets at a resolution of 1/10,000,000 of a second. Accurate time is important when examining packet capture data or reconstructing network events forensically, therefore, it is important to know exactly when a packet arrived – not simply within a minute or two.

GPS time synchronization is fully automatic. Connect the external antenna at installation and at boot up the unit will synchronize its time with broadcast GPS time. If GPS time synchronization is not desired, simply disable it for one boot cycle or permanently.

In our tests of a live IPCopper unit with this high accuracy clock, after twenty weeks (without GPS time synchronization) the clock was off by less than 1½ seconds. That is equivalent to a drift of 0.125 of a second for every 1,000,000 seconds. For the most accurate timestamps, however, the best strategy is to allow the IPCopper unit to resynchronize with GPS time at regular intervals and avoid deviations over time.

Continuous-Loop Storage

The USC10G4 features 24 TB of continuous-loop data storage. After the unit reaches its 24 TB capacity, it overwrites the oldest captured data with the newest. At any given time, the unit will contain the most recent 24 TB of captured network activity.

Data Indexing and Data Retrieval Filters

The USC10G4 indexes the packet data as it captures it, enabling speedier data retrieval and filtered data retrieval. When retrieving packet capture data from the unit, you may choose to filter the data downloaded by date and time, by IP address and by MAC address. You may also choose to include packet checksum data and packets with invalid checksums. For additional data management and analytics features, the USC10G4 integrates with our management and analytics server.

Security

While others talk about security, we deliver it.

We thought through the security of our products every step of the way, starting with securing the firmware. Along with your USC10G4 you will receive an encrypted key. The first time you power on the unit, the unit will decrypt the key and boot up; at this point you can safely remove the key and as long as the unit remains powered on, the presence of the key is not necessary for operations.

If someone were to get their hands on your key, it would be of no use to them because the key itself is encrypted. Looking at the encrypted contents of the USB key would not tell them anything. If they were to steal the unit without the key, it would also be no use to them because everything on the unit is encrypted.

For many systems, management is the weak point. Not so with IPCopper. We made management effortless, yet secure. How? With your unit you will receive a Windows-based utility (or, if you prefer, you can order a Linux version of the management utility to integrate into your native Linux environment). Just launch the utility, proceed through the menu of choices, answer a few questions and the management utility will establish a dually encrypted secure link to the USC10G4 in a stealthy, yet reliable fashion to download data, check status or change settings.

Even more, you have the option to enable password protection for the admin and user. In the off chance someone unauthorized gets their hands on your utility, it would be worthless to them without knowing the passwords.

At one point, a very determined “bad guy” may decide to smash the unit and remove the hard drives. While this is possible, in the case of IPCopper it is not likely: the USC10G4’s enclosure is 9mm bullet resistant all stainless steel. Getting through the enclosure to the insides would take a lot of hammering (and some noisy power tools). If physical theft is of concern to you, however, we can provide a custom enclosure that you can literally chain and padlock to the floor to hinder physical removal of the unit.

Did we go overboard on security? Some may think so, but at the end of the day, each IPCopper unit is designed to collect and protect your data – your secrets – for the long term.

• Sealed, tamperproof, 9mm bullet resistant, stainless steel enclosure.
• Dual data encryption with removable 20,000-bit key.
• Unit keeps a log of data downloads, setting changes and status checks.
• Management communications are encrypted and disguised.
• Stealthy network profile.
• Control management access via front panel buttom.

Secure OS

We built our secure operating system from the ground up, with a focus on data security, speed and accuracy of capture. The proprietary multi-core software powering the USC10G4 runs in parallel directly on the IPCopper hardware.

As a purpose-built data capture engine, the USC10G4’s operating system does not contain any of the extraneous, unwanted functions that lurk in other systems. The weakness in using other operating systems as platforms for packet capture (and other dedicated tasks), is the necessity of eliminating the many unwanted functions in the underlying operating system so that they are not accessible to hackers, without destabilizing the system. This is a formidable task. In the case of IPCopper's OS, we have a purpose-built system, with the purpose of secure, dedicated performance.

With Packet Capture, Speed and Accuracy Go Hand in Hand

The USC10G4 captures packets exactly as they arrive, in their entirety. Just as important are the speed of processing and accuracy of timestamping. Accurate timestamping is fundamental to accurate packet capture, and accurate timestamping is one of the things that sets IPCopper apart. The USC10G4 can capture, relay, encrypt and record a minimum of 6,000,000 packets per second, making it very difficult to overwhelm. While others may operate on a scale of milliseconds, IPCopper OS operates on a nano scale.

The unnecessary overhead generated in other systems results in lost accuracy, skewed timestamping, diminished performance, vulnerabilities, increased heat generation and, ultimately, lost packets. IPCopper’s operating system, on the other hand, is akin to a well-tuned orchestra running in parallel on eight cores. Many tasks take place simultaneously, yet are synchronized in a highly precise fashion to deliver optimal performance and accuracy in a compact, secure and power-efficient package.

Management

Each USC10G4 comes with a secure menu-driven management utility for data retrieval, status checks and settings changes via a straightforward menu-driven, "question and answer" format. The management utility securely establishes communications with the IPCopper unit, using an encrypted connection disguised to appear as innocuous web or network traffic.

Please see the videos below for more information on using the management utility to communicate with the USC10G4.

Changing Settings

Downloading Data

The standard USC10G4 management utility is Windows based, however, you may choose to order a Linux version of the management utility to integrate into your native Linux environment. For more information on utility customizations for Linux environments, please contact us.

For additional data management and data analytics capabilities, the USC10G4 integrates with our management and analytics server.

Support & Documentation

Manuals and Documentation

• USC10G4 Product Manual
• USC10G4 Datasheet

Videos

Changing Settings via the USC10G4 management utility

Downloading Data via the USC10G4 management utility

USC10G4 Sustained Speed Test

Suggestions for Deployment

IPCopper packet capture appliances may be deployed in a variety of locations around a network. Where you place your unit depends on the type of network traffic you intend to capture.

• A common location is at the perimeter of the network, where the internet connection(s) come in from outside. Placement may occur on either side of the firewall. If placed before the firewall (i.e., between the firewall and the public internet), the IPCopper appliance will capture all traffic directed into the network, including activity that the firewall would filter out, as well as all traffic leaving it. If placed after the firewall (i.e., between the firewall and the rest of the network), the appliance would capture all inbound internet traffic allowed through the firewall and all outbound traffic from the LAN.
• IPCopper packet capture appliances may also be placed between a network asset and the rest of the network. In this fashion, the IPCopper appliance would capture all internet/network traffic between the network asset and the rest of the network.
• For monitoring a workgroup, you could place the IPCopper packet capture appliance between the router to which the workgroup is connected and the rest of the network, however, with the router in between the appliance and the member computers of the workgroup, the MAC addresses of the individual computers would obscured. To capture the MAC addresses, place the appliance with the router on one side and a switch connecting to the individual workgroup members on the other.
• For comprehensive monitoring that would enable panaoramic forensic analysis, place IPCopper packet capture appliances at several locations around the network: at the perimeter, in front of network assets and in front of workgroups.
• See also Inline vs. SPAN/mirror deployment
• See also management utilities for Linux environments

General Installation Instructions

1. Connect the fiber or Ethernet cables.
2. Insert the external key (Note: you must use the key that came in box with unit — the key is mated to the unit it comes with and is not interchangeable with other IPCopper keys).
3. Connect the power cable and flip the power switch on. The appliance will boot up automatically. During boot up, the unit will synchronize its time to GPS time, indicated by the flashing green GPS light (the closer it is to completing synchronization, the more rapidly the LED blinks). To forego GPS time synchronization at boot up, press the RET button while the green GPS light is blinking. When the green REC light illuminates steadily, the unit is fully operational.

It is highly recommended that you connect the unit to power via a UPS (uninterruptible power supply) and/or surge protector for protection against power spikes and other fluctuations in the electrical grid.

For more detailed information on installing and booting up the IPCopper USC10G4, please see the USC10G4 product manual.

Troubleshooting

Error light is illuminated.

• Re-boot the unit by pressing the reboot button.
• Turn off the unit, change the power cable and/or connect to a different power outlet then re-boot.
• Change the fiber or Ethernet cables and re-boot the unit.
• Disconnect all cables (except power) and re-boot the unit.
• If the error light persists after re-booting the unit three or four times, changing power and other cables and changing the power outlet used, please contact technical support for further assistance.

Nothing happens when attempting to power up the unit.

• Verify that the power cable is securely connected both to the back of the unit and the power source.
• Connect to a different electrical outlet.
• Use a different surge protector or UPS (uninterruptible power supply).
• Use a different power cable.
• If the unit's nonresponsiveness persists after trying the above, please contact technical support for further assistance.

For more troubleshooting, please see the USC10G4 product manual.

Warranty

One year from date of purchase. For more information, see our warranty page or the warranty details on your order form.