Overview

The USC10M2 is a 48TB, 10Gbps, 6,000,000 packets per second appliance for continuous 24/7 network monitoring. Emphasizing performance and ease of use, the USC10M2 allows businesses and other organizations to reliably capture and retain volatile network data with little to no effort on both gigabit and 10G networks. With installation as simple as connecting cables and powering up and management via a straightforward, menu-driven utility, the USC10M2 handily fulfills infosec professionals' needs for high-performance, easy to use data capture and monitoring tools.

With so many applications and communications now web-based, businesses need the granular visibility that 100% packet capture provides in order to see the what, when, how and who. The USC10M2, a 10G fiber packet capture appliance with the ability to also connect via 1G copper interfaces, brings tremendous value to the task of packet data capture. With peak 10G performance and minimum sustained recording of 5 Gbps at 6 million packets per second, the USC10M2 provides detailed, comprehensive network visibility for even the busiest networks.

High-performance, full packet capture provides the basis for quality data analysis. It’s essential both for post-security incident forensics and network diagnostics. The USC10M2 gives you the full picture, capturing every packet, both header and payload, precisely timestamped in the exact order received.

Features and Convenience

Truly operational out of the box, no configuration is required to begin capturing packets — simply connect a few cables, power the unit up and you are ready to go. Installing the USC10M2 requires no changes to your network topology – your other networking equipment won’t even notice that it’s there.

Two 10GBASE-SR ports and four 1-GbE ports give you the flexibility to meet any number of installation needs. Key features include:

• Real-time, continuous packet capture, either inline or SPAN, at up to 10 Gbps with a minimum sustained capture and record speed of 5 Gbps at 6 million packets per second.*
• Bypass, either as an automated failover passthrough measure or on demand, provides flexibility and peace of mind (even if it loses power, the USC10M2 passes traffic, meaning no damaging disruptions to the network should the appliance unexpectedly lose power).
• Secure, menu-driven management utility for encrypted data retrieval, status checks and setting changes.
• GPS-powered time synchronization with a clock resolution to the 1/10,000,000 of a second for highly accurate and highly precise packet timestamping.
• 48 TB dually encrypted storage with 20,000-bit key.
• Integrated security features protect data from unauthorized access, including a stealthy network profile, physical access controls and a high-strength, tamperproof steel enclosure.
• High-speed capture-to-disk with near-real-time indexing for speedier data retrieval.

The USC10M2 is a dedicated, purpose-built packet-capture appliance with high performance and large storage, the first block for building a data-driven monitoring fabric for anomaly detection, network optimization and forensic investigation. For additional data management and analytics features, the USC10M2 integrates with our management and analytics server.

Integrating the USC10M2 into your network

The USC10M2 is a versatile and flexible network appliance, allowing it to be installed practically anywhere on a network, either inline or to a SPAN port. If you have specific installation or performance requirements, please contact us and tell us what you need. For example, our appliances may be customized to include data capture filters, additional data download filters or specific power input capabilities.

*How we tested the USC10M2's speed: We conducted two tests, using a separate IPCopper unit to create a sampling of 2 billion UDP packets with 64-byte payloads. For the first test the USC10M2 was in inline mode (both receiving and sending). We observed that the packets were received by the test unit, correctly sequenced, and subsequent analysis of the captured data showed that the packets were encrypted, indexed and stored in the correct sequence. For the second test, the USC10M2 was placed in SPAN/mirror mode (receiving only). With both tests we observed zero errors and also observed that the count of good packets matched the total number of packets sent. During testing we observed that the unit was able to successfully capture, forward, encrypt, index and store over 6 million packets per second, with an observed, sustained storage rate of up to 5.925 Gbps (including timestamps and other overhead) and a useful payload of over 5 Gbps (including headers for ARP, IP and UDP).

Features

Automatic / Manual Bypass

The USC10M2 features bypass, available both on demand and as a failover passthrough in case of power loss or other malfunction. In effect, if the USC10M2 experiences a problem, it automatically removes itself from the network without any user effort required and without any damaging disruption to network operations.

Bypass gives you great flexibility. You can deploy the USC10M2 on critical links where you need 24/7 or only occasional visibility, yet be assured that if the worst happens and the appliance fails or unexpectedly loses power, the network will continue humming. At worst, the unit won’t be able to capture anything, but it won’t bring a screeching halt to network traffic.

Utilizing bypass on demand, you can place the USC10M2 at any network location you wish to monitor in the future, or only monitor intermittently, on a schedule that is convenient for you. Simply manually enable and disable bypass mode through the management utility as needed.

In the case of loss of power, bypass kicks in practically instantaneously, allowing the USC10M2 to pass network traffic even when it is OFF. In the event the unit malfunctions, a watchdog timer ensures that the inline port pairs switch over into bypass mode to prevent network interruptions. Depending on the particular packets passing through at the time, it may take one to six seconds for the switch to take effect after a malfunction – ranging from unnoticeable to little more than a hiccup.

GPS Time Synchronization & Nano-Second Timestamping

The USC10M2 includes a very accurate GPS-powered system combined with a high accuracy clock that timestamps packets at a resolution of 1/10,000,000 of a second. Accurate time is important when examining packet capture data or reconstructing network events forensically, therefore, it is important to know exactly when a packet arrived – not simply within a minute or two.

GPS time synchronization is fully automatic. Connect the external antenna at installation and at boot up the unit will synchronize its time with broadcast GPS time. If GPS time synchronization is not desired, simply disable it for one boot cycle or permanently.

In our tests of a live IPCopper unit with this high accuracy clock, after twenty weeks (without GPS time synchronization) the clock was off by less than 1½ seconds. That is equivalent to a drift of 0.125 of a second for every 1,000,000 seconds. For the most accurate timestamps, however, the best strategy is to allow the IPCopper unit to resynchronize with GPS time at regular intervals and avoid deviations over time.

Continuous-Loop Storage

The USC10M2 features 48 TB of continuous-loop data storage. After the unit reaches its 48 TB capacity, it "rolls over" and overwrites the oldest captured data with the newest. At any given time, the unit will contain the most recent 48 TB of captured network activity.

Data Indexing and Data Retrieval Filters

The USC10M2 indexes the packet data as it captures it, enabling speedier data retrieval and filtered data retrieval. When retrieving packet capture data from the unit, you may choose to filter the data downloaded by date and time, by IP address and by MAC address. You may also choose to include packet checksum data and packets with invalid checksums. For additional data management and analytics features, the USC10M2 integrates with our management and analytics server.

Options and Customization

The USC10M2 is a versatile, high-performance network appliance and it may be customized to better suit your installation needs. For example, our appliances may be customized to include data capture filters, additional data download filters or specific power input capabilities, among other features. If you have specific installation or performance requirements, please contact us and tell us what you need.

Security

While others talk about security, we deliver it.

We thought through the security of our products every step of the way, starting with securing the firmware. Along with your USC10M2 you will receive an encrypted key. The first time you power on the unit, the unit will decrypt the key and boot up; at this point you can safely remove the key and as long as the unit remains powered on, the presence of the key is not necessary for operations.

If someone were to get their hands on your key, it would be of no use to them because the key itself is encrypted. Looking at the encrypted contents of the USB key would not tell them anything. If they were to steal the unit without the key, it would also be no use to them because everything on the unit is encrypted.

For many systems, management is the weak point. Not so with IPCopper. We made management effortless, yet secure. How? With your unit you will receive a Windows-based utility (or, if you prefer, you can order a Linux version of the management utility to integrate into your native Linux environment). Just launch the utility, proceed through the menu of choices, answer a few questions and the management utility will establish a dually encrypted secure link to the USC10M2 in a stealthy, yet reliable fashion to download data, check status or change settings.

Even more, you have the option to enable password protection for the admin and user. In the off chance someone unauthorized gets their hands on your utility, it would be worthless to them without knowing the passwords.

At one point, a very determined “bad guy” may decide to smash the unit and remove the hard drives. While this is possible, in the case of IPCopper it is not likely: the USC10M2’s enclosure is 9mm bullet resistant all stainless steel. Getting through the enclosure to the insides would take a lot of hammering (and some noisy power tools). If physical theft is of concern to you, however, we can provide a custom enclosure that you can literally chain and padlock to the floor to hinder physical removal of the unit.

Did we go overboard on security? Some may think so, but at the end of the day, each IPCopper unit is designed to collect and protect your data – your secrets – for the long term.

• Sealed, tamperproof, 9mm bullet resistant, stainless steel enclosure.
• Dual data encryption with removable 20,000-bit key.
• Unit keeps a log of data downloads, setting changes, status checks and other events.
• Management communications are encrypted and disguised.
• Stealthy network profile.
• Control management access via front panel buttom.

Secure OS

We built our secure operating system from the ground up, with a focus on data security, speed and accuracy of capture. The proprietary multi-core software powering the USC10M2 runs in parallel directly on the IPCopper hardware.

As a purpose-built data capture engine, the USC10M2’s operating system does not contain any of the extraneous, unwanted functions that lurk in other systems. The weakness in using other operating systems as platforms for packet capture (and other dedicated tasks), is the necessity of eliminating the many unwanted functions in the underlying operating system so that they are not accessible to hackers, without destabilizing the system. This is a formidable task. In the case of IPCopper's OS, we have a purpose-built system, with the purpose of secure, dedicated performance.

With Packet Capture, Speed and Accuracy Go Hand in Hand

The USC10M2 captures packets exactly as they arrive, in their entirety. Just as important are the speed of processing and accuracy of timestamping. Accurate timestamping is fundamental to accurate packet capture, and accurate timestamping is one of the things that sets IPCopper apart. The USC10M2 can capture, relay, encrypt and record a minimum of 6,000,000 packets per second, making it very difficult to overwhelm. While others may operate on a scale of milliseconds, IPCopper OS operates on a nano scale.

The unnecessary overhead generated in other systems results in lost accuracy, skewed timestamping, diminished performance, vulnerabilities, increased heat generation and, ultimately, lost packets. IPCopper’s operating system, on the other hand, is akin to a well-tuned orchestra running in parallel on eight cores. Many tasks take place simultaneously, yet are synchronized in a highly precise fashion to deliver optimal performance and accuracy in a compact, secure and power-efficient package.

Management

Each USC10M2 comes with a secure menu-driven management utility for data retrieval, status checks and settings changes via a straightforward menu-driven, "question and answer" format. The management utility securely establishes communications with the IPCopper unit, using an encrypted connection disguised to appear as innocuous web or network traffic.

Please see the videos below for more information on using the management utility to communicate with the USC10M2 (the videos display the USC10G4 interface, however, the USC10M2 has an identical appearance and operation).

Changing Settings

Downloading Data

The standard USC10M2 management utility is Windows based, however, you may choose to order a Linux version of the management utility to integrate into your native Linux environment. For more information on utility customizations for Linux environments, please contact us.

For additional data management and data analytics capabilities, the USC10M2 integrates with our management and analytics server.

Support & Documentation

Manuals and Documentation

• USC10M2 Product Manual
• USC10M2 Datasheet

Videos

(though videos display the USC10G4 interface, the USC10M2 has an identical appearance and operation)

Changing Settings via the USC10G4 management utility

Downloading Data via the USC10G4 management utility

USC10G4 Sustained Speed Test

Suggestions for Deployment

IPCopper packet capture appliances may be deployed in a variety of locations around a network. Where you place your unit depends on the type of network traffic you intend to capture.

• A common location is at the perimeter of the network, where the internet connection(s) come in from outside. Placement may occur on either side of the firewall. If placed before the firewall (i.e., between the firewall and the public internet), the IPCopper appliance will capture all traffic directed into the network, including activity that the firewall would filter out, as well as all traffic leaving it. If placed after the firewall (i.e., between the firewall and the rest of the network), the appliance would capture all inbound internet traffic allowed through the firewall and all outbound traffic from the LAN.
• IPCopper packet capture appliances may also be placed between a network asset and the rest of the network. In this fashion, the IPCopper appliance would capture all internet/network traffic between the network asset and the rest of the network.
• For monitoring a workgroup, you could place the IPCopper packet capture appliance between the router to which the workgroup is connected and the rest of the network, however, with the router in between the appliance and the member computers of the workgroup, the MAC addresses of the individual computers would obscured. To capture the MAC addresses, place the appliance with the router on one side and a switch connecting to the individual workgroup members on the other.
• For comprehensive monitoring that would enable panaoramic forensic analysis, place IPCopper packet capture appliances at several locations around the network: at the perimeter, in front of network assets and in front of workgroups.
• See also Inline vs. SPAN/mirror deployment
• See also management utilities for Linux environments

General Installation Instructions

1. Connect the fiber or Ethernet cables.
2. Insert the external key (Note: you must use the key that came in box with unit — the key is mated to the unit it comes with and is not interchangeable with other IPCopper keys).
3. Connect the power cable and flip the power switch on. The appliance will boot up automatically. During boot up, the unit will synchronize its time to GPS time, indicated by the flashing green GPS light (the closer it is to completing synchronization, the more rapidly the LED blinks). To forego GPS time synchronization at boot up, press the RET button while the green GPS light is blinking. When the green REC light illuminates steadily, the unit is fully operational.

It is highly recommended that you connect the unit to power via a UPS (uninterruptible power supply) and/or surge protector for protection against power spikes and other fluctuations in the electrical grid.

For more detailed information on installing and booting up the IPCopper USC10M2, please see the USC10M2 product manual.

Troubleshooting

Error light is illuminated.

• Re-boot the unit by pressing the reboot button.
• Turn off the unit, change the power cable and/or connect to a different power outlet then re-boot.
• Change the fiber or Ethernet cables and re-boot the unit.
• Disconnect all cables (except power) and re-boot the unit.
• If the error light persists after re-booting the unit three or four times, changing power and other cables and changing the power outlet used, please contact technical support for further assistance.

Nothing happens when attempting to power up the unit.

• Verify that the power cable is securely connected both to the back of the unit and the power source.
• Connect to a different electrical outlet.
• Use a different surge protector or UPS (uninterruptible power supply).
• Use a different power cable.
• If the unit's nonresponsiveness persists after trying the above, please contact technical support for further assistance.

For more troubleshooting, please see the USC10M2 product manual.

Warranty

One year from date of purchase. For more information, see our warranty page or the warranty details on your order form.