Troubleshooting 10 Gbps with Packet Capture & Replay

Affordable tools are now available for full line-rate packet capture and replay at 10 Gbps. This opens up new possibilities for troubleshooting 10 Gbps networks.

From network to application performance

With IP networks now being used as a converged services platform, the demands on network administrators are moving beyond simple network performance monitoring to application performance monitoring. IP networks continue to support traditional data services such as file transfer, email and Internet access, but must now also support real-time services such as voice and video. With the move to cloud computing, applications are no longer even resident on the network administrator’s network, but still need to be supported for each user.

To ensure optimal application performance, the network administrator requires monitoring tools that can recognize applications, measure application response times and determine how much bandwidth is being used by each application on a per user basis.

Thankfully, these solutions exist today, even for 10 Gbps networks. High performance network appliances provide the ability to capture 10 Gbps data in real-time with zero packet loss and use the captured data to provide a comprehensive view of network and application performance.

But what happens when something goes wrong? How can these solutions be used to troubelshoot the 10 Gbps network?

10 Gbps Packet Capture & Replay

The Network and Application Performance Monitoring solutions mentioned above can provide a real-time view on what is happening in the network on a per user and per application basis. But, for troubleshooting purposes, there is a need to retrospectively review this data to discover the root cause of problems in the network. This requires the ability to store captured packet data for later examination. It also requires the ability to replay this data in “real-time” – in other words, in exactly the same way as it was captured complete with timing, inter-frame gaps etc. Only with this information can a thorough analysis be performed.

To enable such a solution, there are a number of requirements that need to be met:

All packet data needs to be captured in real-time with zero packet loss Each packet needs to be time-stamped to be useful for later forensic analysis A full-throughput capture-to-disk solution is required that can store all packet data in real-time It must be possible to replay all packet data as it was recorded with the same inter-frame gaps in order to fully re-create the conditions at the time of the network event.

At 10 Gbps, this is challenging, but solutions exist that address this. For example, at 10 Gbps, up to 15 million packets per second need to be captured per port, analyzed and stored to disk. That is a packet every 67ns. Needless to say, this requires high performance network probes or appliances to achieve.

There are large, proprietary hardware solutions available that meet these requirements, but these can be expensive. It is also possible to find more affordable packet capture and replay solutions that address the needs above based on standard PC server hardware using intelligent real-time network adapters designed for high-speed packet capture and replay.

From availability to reliability

By adopting a Network & Application Performance Monitoring solution with the capability to capture, store and replay packet data in real-time at 10 Gbps, network administrators have a powerful tool for not only troubleshooting network performance issues, but also application and service degradations, which are essential for converged services networks and cloud computing.