Wireshark-users: Re: [Wireshark-users] 10GigE capture
From: Loris Degioanni <loris.degioanni@xxxxxxxxxxxx>
Date: Thu, 13 May 2010 09:31:53 -0700
On 5/13/2010 8:30 AM, Stuart Kendrick wrote:
Has anyone built their own 10GigE probe? I'm imagining just doing the same thing
I've done for 1GigE: NICs from Intel, Cory Satten's Gulp, the fastest storage
array I can afford, and a SPAN port.

I've vaguely thought of making the primary storage SSD, to which Gulp writes,
then buying slow disk and using a cron job to copy files off SSD as fast as
possible.  But I haven't actually tried this yet.

And I'm imagining that Cace will deliver a 10GigE version of TurboCap at some point.

Actually, CACE is going to start offering a 10G solution very soon. As a matter of fact, in few weeks.

We'll offer the same three alternatives that are currently available for 1G:

- card alone
- appliance kit (card + optimized dump to disk software + remote analysis software)
- turn-key appliance

Pricing will be extremely competitive.

Have any tips for me?

- don't use SSD drives. They are not that much faster when dumping a lot of data sequentially, they have a shorter lifespan, and they are expensive. If you need more disk performance, increase the number of drives: it's much more cost effective.
- be sure to know what your bottlenecks are before designing the system
- be careful when you read the packets for analysis: unless you use tricks, it will completely destroy the write performance.

Loris Degioanni, CTO
CACE Technologies