CSPi’s Myricom Sniffer10G technology powers the Myricom ARC Series of network adapters for packet capture, empowering advanced network monitoring and security applications at scale without unnecessary costs.
Sniffer 10G is optimized for network monitoring and security applications and is designed for organizations looking to implement pure packet capture. It gives users the choice of advanced capabilities as well as the efficiency that comes with leaving the vast majority of server cycles available for other operations. It can even support open-source packet-capture application tools.
Get the Most Out of Your Many-Core Processor
With flexible partitioning capability, Sniffer10G can involve all CPU cores in analyzing packets. Application developers can partition the packet flow across up to 32 rings using pre-built rules, or they can implement user-defined rules with the Sniffer10G API, balancing flows across multiple cores.
Support for Open Source Software
Sniffer10G is also enabled with support for open source packet capture application tools, including the standard Linux utility (tcpdump), network protocal analyzer (Wireshark), network intrusion detection systems and security network monitoring (BRO IDS, Snort, Suricata, Splunk, etc.), and the PF-RING™ packet capture network socket.
Sniffer10G’s ARC Series adapter hardware enables a set of advanced timing features, including timing synchronization, PPS and 10 MHz daisy chaining, and support for Arista Networks DANZ timestamping.
Benefits for pcap Users
By simply changing the linking library, users of libpcap and WinPcap can leverage Sniffer10G, gaining big benefits for packet-capture applications. To simplify the implementations, Sniffer10G-capable libpcap and WinPcap libraries are included with the Sniffer10G software distribution.
Three Advantages for Pure Packet Capture
Sniffer10G delivers on the three requirements for pure packet capture:
Research has proven Sniffer 10G’s zero-loss performance across a range of Ethernet packet sizes. It bypasses the kernel and sends packets directly into user space, leveraging a “ring” that can expand to any size. You define the ring size to match your application.
Highly accurate timestamping:
Myricom ARC Series of network adapters support packet capture and timestamping at up to the maximum possible rate of 14.8 million packets per second on each 10 GbE line.
Essential packet capture functions:
Sniffer10G supports time-based merge, filtering, and load balancing. These functions can all be implemented with flexible application control using the Sniffer10G API, or one of the industry-standard libraries (libpcap, WinPcap, or PF_RING).
CSPi’s Myricom DBL technology powers the ARC Series of network adapters, driving down system-level Tick-To-Trade latency and enabling advanced financial trading capabilities. It is a tightly-integrated combination of FPGA firmware and software libraries.
System-level Tick-To-Trade latency
To win against your competition, and make money, you need to squeeze down the time between receiving a market tick favorable to your algorithm and sending out the TRADE order. DBL drives down Tick-To-Trade latency at multiple points in the trading process, allowing your application to avoid slippage and deliver higher fill rates.
Optimize the way you receive market data
First, DBL minimizes Receive Latency by exploiting the parallel processing capabilities of powerful FPGAs to direct subsets of a multi-cast market feed to specified CPU cores, totally bypassing the OS kernel.
At initialization, your application uses our DBL software library for a quick and easy set-up of the selectors, targeting data from a specific address and port to an assigned ring.
Every packet does not need to move into the user space data rings, just the packets your application uses.
Accelerate your application layer
DBL software accelerates trading algorithms with Kernel Bypass Stacks, which move UDP packets directly into user space. Doing that eliminates the cost of CPU context switches and also enables deployment of special-purpose network stacks in user space, which are faster than the general purpose stacks inside the kernel. The DBL has 3 interface options for these faster network stacks:
- Transparent Sockets accelerate stack performance without code changes. Standard socket calls access the low latency DBL stack without recompiling.
- The DBL API accesses a set of Myricom-optimized sockets. It requires a software recompile, with renamed socket calls, but delivers even lower latency.
- Raw Mode allows customers to implement their own custom stacks, using either raw sockets or a proprietary API.
Precise Hardware Timestamps Comply with Looming Regulations
With DBL firmware, Myricom ARC Series network adapters are able to track latency in real-time with less effort and more accuracy than expensive packet capture devices, using precise hardware timestamps on both ingress and egress packets. This unique capability allows your application to calculate latency without needing to tag TCP/IP orders with UDP sequence numbers, for simplified trading performance verification. You can achieve regulatory compliance by using DBL to create audit trails of trades with both transmit and receive timestamps. An additional timekeeping option is to use ARC Series adapters with Sniffer10G firmware and software in an adjunct system dedicated to recording trade data.