SPAN-aggregation and packet brokers. Protocol Stripping

Why you may need protocol stripping function?

As you know there are 7 OSI model levels. Each one adds some particular volume header to the packet. 

Packet brokers throughput math realism

This post was inspired by the IXIA seminar. As long as such events usually contain some advertising information it is necessary to search an information myself to have a material for analysis.

According to my hands-on experience with some SPAN-aggregation solutions I can observe several mismatches.

Let me analyze a piece of information according to particular IXIA product. This information is also actual for another vendors using the same math.

1. Throughput. 

Let's try IXIA xStream 10. According to the datasheet one can see that the hardware throughput is 480 Gbps

but there are only 24 10G-interfaces in it.

IDS/IPS implementation. Phase 2. Throughput metering

Usually traffic intrusion detection in the corporate network is provided without an ability to affect the productive services. This mode is named IDS (Intrusion Detection System). IDS also may be integrated with the active network equipment for an ability to block the attacker host or network (IDS shun). Another way is the sensor usage in the active protection mode called inline IPS (Intrusion Prevention System) or with an ability to terminate the TCP-sessions by the way of RST-packet sending to the source and destination host of the malicious session. Let's make some analysis of the IDS and IPS modes according to the network integration requirements.