Overview: IPCopper USC8032 Network Monitor

The USC8032 is a true management center for your network, bringing together the capture, control and monitoring capabilities afforded by high-speed packet processing and data capture combined with dynamic triggers, automation and alerts. Monitoring, at both the general and the granular level, natively integrates with sophisticated packet filtering and firewalling, while packet capture provides the in-depth data needed to investigate and develop effective, comprehensive and case-specific network management processes reflecting the realities of your live network environment.

• Up to 10,000 rules allow you to model sophisticated data scenarios to automate and control the packet filtering and capture behavior for both the general network and for specific devices and applications.
• XML / Javascript interface for the real-time graphical monitoring and visualization of live data streams and packet data.
• Packet capture plus the ability to formulate multiple rule sets allows you to test draft rule sets on real historical data before applying them to live network data.
• Monitor select network activity using a structure of virtual data “buckets” with rules to sort and pull out specific packets from the datastream.
• Generate automatic alerts and behavior changes via dynamic triggers for signature matches, rule matches, BPS ranges and PPS ranges for dynamic scenario-based monitoring with time of day and day of week scheduling, chain actions and switches.
• Rule sets capable of dynamically self-modifying their behavior.
• Granular automation and control allows network admins to monitor, supervise and enable/restrict access on a per-application or per-device basis.
• Full payload, signature-based monitoring at up to 5Gbps sustained; simultaneously monitoring up to 10,000 signatures/keywords
• Real-time packet-based network intelligence.
• Out of the box the USC8032 delivers 8 Gbps sustained capture with bursts up to 10 Gbps and up to 10,000,000 packets per second (see benchmarks for details).

Sophisticated, multi-faceted network management and monitoring with automation. The USC8032 is a flexible and sophisticated tool malleable enough to fit into your actual on-site workflow and support how you manage your network, allowing you to model the nuances of your network environment and identify the direct technical aspects of how your network works. With the USC8032 you can refine the monitoring and firewalling behavior, distilling them down to parameters based on your real network environment – not some abstract theoretical model. Further, the USC8032’s XML / Javacript interface enables network visualization and graphical monitoring and lets you put what you need to monitor the most front and center.

The USC8032 provides for simultaneous general and granular monitoring, management and control, with individualized monitoring and separate triggers, rules and alerts available for each data scenario created in addition to network-wide monitoring. Its automation capabilities let you create in-depth application-specific scenarios with triggers, date and time ranges, absolute time scheduling, signature keywords and many other parameters and lift much of the routine burden of monitoring from human shoulders.

Pinpoint and solve network performance and security issues. The USC8032 is a purpose-built network monitor with packet capture for network traffic analysis, troubleshooting and investigation, as well as real-time rule- and keyword-based monitoring with dynamic firewalling. Use the USC8032 for deep network and application visibility, network performance analytics, vital network intelligence and its ability to automatically detect and react when network problems arise. Comprehensive packet capture data helps network administrators investigate and resolve application, security and performance problems.

Gain visibility into 10G network activity. Designed and built with the versatility to handle diverse performance monitoring and other analytical tasks for multigigabit environments, the USC8032 integrates PCAP, firewall and data processing engines and takes monitoring and analysis to a whole new level. Triggers and keywords plus classic search and sort parameters (such as network ranges, protocol, VLAN and more) allow users to easily craft individual rules and rule sets to drill down through the data and quickly find what they are looking for. With the USC8032, network admins can build a real-time multi-dimensional view into the actual data with the ability to pull the specific packets.

Scalable deployment. Suitable for deployment in data centers, on enterprise networks, at the WAN edge, in the network core, at remote sites and in front of business-critical equipment, the USC8032 may be deployed singly or in multi-unit clusters to meet capacity and processing needs. Should you require specific data processing functions, connectivity or storage for your deployment, the USC8032 may be customized.

With high-performance monitoring and packet capture, the USC8032 extends your visibility into the deeper workings of the network to provide a comprehensive picture of network performance, traffic patterns and behavior, all the way down to the individual applications and equipment, while enabling the collection and review of individual packets.

Features

With its natively integrated functions, the USC8032 enables you to monitor, manage, visualize and record your network traffic, then further analyze it and shape it with up to 10,000 rules and dynamic actions, plus signature/keyword search. It provides the practicality of full packet capture with the convenience of real-time packet processing and reporting, allowing you to see what was and is happening on your network at any time.

Real-Time Network Monitoring

Every network is different with a different mix of applications and traffic. The USC8032 gives you the flexibility to monitor what you wish, as you wish.

• Use rules and keywords to comprehensively monitor network traffic for performance, security and other issues in real time.
• Trigger automatic email alerts based on keyword instances, packet per second parameters, bits per second parameters or rules to detect abnormal bandwidth usage, unusual protocols or traffic from atypical sources.
• Optionally use real-time data in XML for custom dashboards; create your own custom complex real-time visualization of the data.
• Build flow-based, packet-based and payload-based network intelligence.

Packet Capture

The USC8032’s full packet capture capabilities allow you to investigate incidents based on the real data. With a record of the actual packets that traversed the network you can see precisely what happened with no guesswork or extrapolation.

• Continuous and triggered packet capture.
• Filtered and unfiltered capture.
• Headers and payloads or just headers.
• GPS-synchronized timestamps to the 1/10,000,000 sec.
• Gather packet-based network intelligence.
• Sophisticated keyword and rule-based searches help you find what you need without combing through billions of packets by hand.

Firewall

In the USC8032 you have an intelligent, dynamic firewall that can automatically react as you direct.

• Build sophisticated scenarios with up to 10,000 rules and keywords to monitor, alert, block or allow traffic.
• Schedule alternate scenarios by date and time, such as for business hours vs after hours.
• Model scenarios to dynamically trigger alternate rule sets based on traffic volume, source, keyword instances and other parameters.

Keyword Signature Detection

• Search for character strings through the entire packet payload.
• Monitor for instances of red-flag keywords in real time.
• Block or record packets with keywords matches.
• Find documents, emails and other data that were sent through the network.

System & User Management

• Two-tiered user types with variable privileges.
• System logs user actions.
• Password protected web-based user interface.
• Ability to lock individual files, rule sets and other elements.
• System self-monitors temperature and sys load.
• Self-calibrating clock.

GPS Time Synchronization

• System continuously tracks GPS signal to maintain timestamping accuracy.
• Clock resolution: 1/10,000,000 sec.

Options and Customization

The USC8032 is a versatile, high-performance network appliance with a lot of processing power and it may be customized. Standard units may be built with either two 10GBASE-SR or 10GBASE-LR ports (please specify at time of ordering). If you have specific installation or performance requirements, please contact us and tell us what you need.

Benchmarks

Minimal rules MAX PCAP rate
4 rules engaged (one MAC, one IP and two frame-size rules) 4 buckets - one rule per bucket Every packet is placed in two buckets 4 billion packets over 9 1/2 minutes 8.8 Gbps and 7,000,000+ pps throughput All buckets set to allow forwading 96% utilization on core engine All packets captured and recorded with no packet loss
10,000 IP rules with MAC and Frame Size
10,000 rules (IP address) and individual buckets for each rule 10,004 buckets - one rule per bucket 4 rules (MAC rule, Frame Size <100 bytes, Frame Size > 100 bytes, IP Address match all) 4,000,000,000 packets over about ten minutes Every packet is placed in two buckets 8.65 Gbps and 6.5 million pps throughput 97.75% utilization on core engine All buckets set to allow forwading All packets captured and recorded with no packet loss
10,000 Signatures, MAC, Frame Size and IP
10,000 unique keyword/signature rules (each keyword was 16 characters long) 10,004 buckets - one rule per bucket 4 rules (MAC rule, Frame Size <100 bytes, Frame Size > 100 bytes, IP Address match all) 500,000,000 packets over about ten minutes Every packet is placed in two buckets 3.6 Gbps and 800,000 pps throughput 99% utilization on core engine All buckets set to allow forwading All packets captured and recorded with no packet loss

How Tos / Scenarios

With its speed and versatility, the IPCopper USC8032 lends itself to a variety of network management and monitoring tasks, from the critical to the mundane. The below possible scenarios and applications provide a glimpse into the USC8032’s capabilities and how it can help you. Please note that using the USC8032 for one purpose in no way precludes adding a second, third (or even more) simultaneously – the USC8032 is a high-performance, high-speed multi-tasker.

Monitoring & Securing Legacy Apps

General Network & Performance Monitoring

Network Security Monitoring

Web Filtering

Web Logging of Servers, Applications and other Network Devices

Smart Firewall with Retention of Blocked Packets

Pricing

IPCopper USC8032 Network Monitor

$35,000

48TB storage, 2 x 10GBASE-SR/LR (specify SR or LR at time of order), 4 x RJ-45 Includes: Limited software/firmware license (no subscription required). Free software / firmware updates for first 12 months. Free technical support via email for first 12 months. One-time assistance with general assessment and initial configuration (if requested at time of sale).* If bug fixes are available, they are provided at no charge until the product reaches end-of-life (current expected end-of-life of this product is 2025).

Other options

Training is available.

Ongoing customization and configuration support are available through monthly and yearly service plans for assistance with configuration and integrating the USC8032 into the customer's network environment. We also provide turnkey configuration of the USC8032 as a service.*

Customization of the USC8032's XML / Javascript interface is also available.

Yearly software / firmware update subscriptions are also available for after the expiration of the initial 12-month period.*

Technical support is also available through monthly and yearly service plans.

Questions? Please feel free to contact us.

*