Cubro Aggregator C48

The Aggregator C48 is a high-performance network packet broker that aggregates, filters, duplicates, and load balances network traffic to security, monitoring and management tools based on 4000 possible rules. The Aggregator C48 supports OSI Layer 2, Layer 3 and Layer 4 header modifications, including stripping, adding, and modifying VLAN tags, MAC addresses, IP addresses and Port numbers.

Applications / Solutions

Aggregation
The C48 receives traffic from a single or multiple 1/10/25/40 or 100 Gbps link(s) via the monitoring ports of an inline tapping device. The incoming traffic can be further aggregated to a single or multiple outputs to connect analysers and monitoring tools as required. In the below example, the C48 aggregates up-and downstream traffic of a 100 Gbit link to a single
output port for more economical usage of connected traffic probes/analytics systems.

By utilising the various filtering capabilities available on the C48, users are able to further reduce the traffic volume that needs to be processed, allowing for a more accurate and quicker analysis. Furthermore, incoming traffic can be VLAN-tagged per physical port for easy identification of the original physical port of a packet.

Filtering capabilities

The Aggregator C48 supports up to 4000 parallel running IPv4/IPv6 filters. These filters can be used to redirect a selected part of the incoming traffic to a low bandwidth monitoring tool.

Filtering parameters include:

Session-aware Load-balancing

Load-balancing is a vital function to distribute traffic across different monitoring tools evenly and correctly. The Cubro C48 supports Session-Aware Load balancing that allows every packet belonging to the same conversation/flow to be sent to the same physical output port within a load-balancing group. This ensures that connected packet sniffer or other monitoring tools get every packet of a given conversation. The C48 maintains the association of packets with each flow or conversation between any two network endpoints such that all traffic from a given flow will be output from a consistent monitor port within a load balanced group.

Other functions

• VLAN push for packet identification
• Active Tunnel Endpoint capability to receive and de-encapsulate GRE traffic
• Timestamping with 1ns resolution based on NTP or PTP
• Packet Truncation to forward only headers of a packet
• Filtering inside packet payload by means offset and pattern