Lossless Packet Capture & Log Manager, With Deterministic Performance
Packet Continuum provides a performance guarantee of sustained lossless capture rate, for a set of real-time packet analytics (Log Manager) functions, and a specified number of Packet Continuum cluster nodes. This means a deterministic guarantee to capture every packet under real world conditions, not just a “best effort” attempt.
- Lossless packet capture from 1Gbps, to 40Gbps, to 100+Gbps telco interfaces
- Time stamping of 150 nanoseconds
- Real-time indexing, for efficient query and retrieval of retrospective PCAP data or IPFIX records
- Real-time IDS alerting generates event logs for HTTP, Files, DNS, email, user agents, TLS/SSL – all cross-correlated with PCAP & IPFIX flow records
- Log Manager advanced packet analytics options include real-time event logging & cross-correlation:
- Logs for HTTP, Files, DNS, Email, User Agents, TLS/SSL
- Active Triggers (BPF signature)
- 100 Snort rules (emerging-DNS, emerging-ftp, and files)
- System events
- Log Manager search actions:
- All logs are time-correlated with PCAPs and IPFIX data
- Text string search of logs
- IPFIX flow record logging and search
- Scalable architecture to meet your speed and/or analytics requirements
- Federate multiple cluster-based capture systems, for global visibility and PCAP retrieval
Scalable, Lightweight, MapReduce Cluster Architecture
The Packet Continuum cluster-based architecture can scale up smoothly to accommodate any combination of desired goals for capture speed, IDS alerting and Log Manager functions, and extended forensic capture timeline.
- Scalable to multiple “Cluster Nodes”, which add compute power to increase sustained capture rates, packet analytics thruput, and (of course) extend the storage timeline
- Capture Nodes push packet processing operations to distributed Cluster Nodes, for PCAP storage, compression, indexing, and Log Manager functions
- “Federated” Search operates in parallel within the cluster, resulting in incredibly fast streaming search results, even over very large capture timelines
- Every starter appliance is “Cluster-ready”, for smooth scale up to very high performance
- Dynamic node management, including redundancy and hot-swap / expand
Extended Forensic Timeline and Storage Features
Packet Continuum offers many features to lower the cost of maintaining very long timelines, on a massive scale.
- Real-time Data Compression: In-line packet compression is transparent to the user. All packets are compressed as they are captured, and all extracted PCAP les are decompressed. Overall storage amplification up to 10x (depending on percentage of traffic with SSL encrypted or compressed packet payloads)
- Cluster architecture leverages CPU power over many servers for super-fast query response, while enabling low-cost local-attached storage on a massive scale. Forensic timelines smoothly scale over days, weeks & months.
- Massive queries over large timelines respond quickly, even as the timeline increases
- Federated search across multiple Packet Continuum appliances at diverse geographic locations, without any “concentrators” required
Intuitive and effective web gui
- Innovative dynamic Sankey Session Relationship Diagram shows top-talkers and SRC/DST IP/port pairs
- “One-Click” searches directly from Sankey, Time Graph or Critical Alerts log. Auto-populates the query request, making it easy to drill down quickly to find the PCAP files you need
- Comprehensive Log Manager screen, with tabs for each log type, allowing instant search and correlation with PCAP and IPFIX flow records
- Easy remote access to manage and control multiple devices, including hot-accessible Cluster Node changes
- Control multiple clusters in a global-dispersed “Federation” of capture systems
Find Critical Information Fast
- Fast, Streamed Query Results: Every query has the option to return PCAP files, IPFIX records, and/or any log files. Especially valuable for PCAP queries, all results are streamed in “chunks”, allowing partial results to be analyzed while the remaining query is completed, the first of which appear almost immediately after the query initiates
- Historical “look-back” queries based on standard Berkeley Packet Filter (BPF) within a time period.
- Active Trigger “look-forward” alerts, BPF-based and user-defined, will generate alerts whenever the target condition occurs. Dozens can be active simultaneously
- Pre-capture filters, also BPF-based, can be changed on-the-fly during capture operations
- All historical logs are searchable by text string
- Real-time indexing: Every packet gets a timestamp and correlation index, for very fast query retrieval, where every log & alert event is cross-correlated to PCAPs and IPIX flow records
Open Data Access
- Open file formats and data viewers: standard PCAP-NG file and IPFIX record extractions are viewable in Wireshark or TShark. All log files and alerts are viewable as CSV or text files in any compatible application such as MSFT Office.
- Remote Access file extractions via the Web GUI
- PCAP playback feature for 3rd party tools
- Open REST/API for creating customized workflows for automated Incident Response, Policy-Driven data retention, or interface to legacy analytic tools.
Streaming Playback Feature
- PCAPs that have been searched/filtered/extracted with the Packet Continuum UI may be regenerated out a 1G copper RJ45 interface to an external device
- Compatible with ANY 3rd party capture/analysis tool – just like a span/mirror port.
- Great for recording, additional packet/signature analysis, or back-testing new firewall policies against real historical traffic.
Multiple Platforms and Custom Configurations
The Packet Continuum software layer provides common features (like a Web GUI, REST/API, and real-time packet analytics functions) on a variety of platforms, ranging from cost-efficient rackmount systems to unique high-throughput portables. Many of these powerful functions are standard on all systems, and many can be turned on or off, depending on the user application, to tune the solution for an optimal price/performance outcome.