DATA SHEET
OVERVIEW Riverbed TurboCap is featurerich Gigabit Ethernet packet capture and injection solution with advanced features such as simultaneous full-rate capture and injection, multi port traffic aggregation, and a configurable pass-thru mode.

Riverbed TurboCap

Feature-rich Gigabit Ethernet Packet Capture and Injection
Riverbed TurboCap is a feature-rich Gigabit Ethernet packet capture and injection solution with advanced features such as simultaneous full-rate capture and injection, multi port traffic aggregation, and a configurable pass-thru mode. Wireshark integration supports packet capture using TurboCap interfaces and off-line analysis of TurboCap capture files. A native TurboCap API and a WinPcap/libpcap API are available for writing/porting your own Gigabit Ethernet applications. TurboCap includes a PCI Express, Dual-Port or Quad-Port, Gigabit Ethernet Board, the TurboCap optimized driver, and a user-level API. TurboCap is available for Windows (XP and Vista) and Linux Fedora 10.

Key Features

Full-Speed GigE Capture Port Aggregation Pass-thru Mode Aggregating Tap Full-Speed GigE Injection Exported Interfaces TurboCap API Developers Pack Sample applications like Dump-toDisk for high-speed capture to disk
Full-rate Gigabit Ethernet Capture
Full-rate Gigabit Ethernet packet capture is most needed when your network is exhibiting poor performance. There could be many reasons for this including one in which your network is under attack. These are the times when it is important to be able capture traffic from your network without dropping any packets. TurboCap supports full-rate Gigabit capture with even the smallest packet sizes (64 bytes), which is the most challenging situation.
Aggregation of Gigabit Ethernet Traffic Sources
Capturing traffic in timestamp order from two different sources (e.g., a full-duplex link) is a common and important network analysis requirement. This is referred to as aggregation and provides a means to measure packet delays between multiple sources, such as the ingress and egress of a switch or router. TurboCap supports full-rate traffic aggregation of the traffic received on pairs of ports of the same board. This is presented to the user as a virtual port called a Board Aggregating Port (BAP).

Port A Port B

Aggregator

Aggregation Port

Port A

Port B

TurboCap also supports aggregation of ALL of the ports on ALL of the TurboCap boards installed on your system. Specifically, with a single 4-port TurboCap board in a system, you can capture from each of the individual ports, from two, 2-port aggregation ports (ports 0 and 1 and ports 2 and 3), and an aggregation port corresponding to all 4 ports.

DATA SHEET: TurboCap

Pass-thru Mode
TurboCap can emulate a network tap by being configured to inject the traffic received from one port to the other port on the same board. When the board in is in pass-thru mode, the injection is done simultaneously for pairs ports of the same board and, consequently, TurboCap can act as a Network Tap. In the figure to the right, the gray blocks along the top edge represent a full duplex link with network traffic flowing in both directions. TurboCap, in pass-thru mode, can be inserted into a full duplex link in such a way that it preserves the traffic along the full duplex link. In the figure, Port A captures the traffic going from left-to-right, injects it back into the full duplex link through Port B, and also passes the captured traffic to user-level applications.

Full Duplex Link

Port A On the other hand, Port B captures the traffic going from right-to-left, injects it back into the full duplex link through Port A, and also passes the captured traffic to user-level applications.

Application Performance

The TurboCap card and optimized driver are capable of capturing full rate Gigabit Ethernet traffic and delivering this data to an application. The overall application performance is often determined by a number of additional factors such as the applications computational tasks, disk write speed, CPU speed, and main memory size. TurboCap is integrated with WinPcap/ libpcap and, consequently, supports applications such as Wireshark, Windump/tcpdump, and Ntop. Note that when using these applications with TurboCap, the capture performance at high data rates will be determined by the specific application. For more information on Wireshark performance in various load scenarios, see http://wiki.wireshark.org/Performance.
Full-rate Gigabit Ethernet Traffic Injection
For stress testing your network, TurboCap offers full-rate simultaneous Gigabit Ethernet traffic injection. The TurboCap API is available for developing a wide range of traffic injection applications, e.g. vulnerability testing, etc. Packet sizes can range from 64 bytes to 9234 bytes (jumbo frames) and packets are transmitted in the order they are sent to the driver with minimal delay.

Timestamps

TurboCap offers a range of timestamp modes which trade timestamp accuracy for CPU utilization. You have the option of choosing the timestamp mode that best suits your needs, from highly accurate timestamps to no timestamp generation. Polling Mode. In this mode, a CPU polls for packet arrivals and timestamps the packet as soon as it is available from the board. These timestamps are very accurate (microsecond accuracy) but require a CPU to be running in a busy wait loop. Timer Mode. Timer mode uses a 1ms timer to periodically timestamp incoming packets. This puts very little load on the CPU and provides timestamps with millisecond accuracy. Off. In this case, no timestamps are generated and the timestamp fields in the packet meta-information are set to zero.
Performance and Recommended Hardware
The TurboCap capture board and optimized drivers (Windows and Linux Fedora 10) are only two of the components that determine the overall capture performance of your system. The 2-port TurboCap board requires either a 4-lane or 8-lane PCIe host interface and the 4-port TurboCap board requires an 8-lane PCIe host interface. In order to achieve maximum performance of your TurboCap system, we recommend the following minimum hardware requirements: PCIe: Either x4 or x8 PCI Express slots depending on the TurboCap board CPU: Pentium-D (dual core) processor or multiple CPUs (SMP), 2.8GHz Memory: 2GB RAM Disk: Full-rate dump-to-disk requires disk arrays that have sufficient capacity and speed to keep up with full-rate Gigabit Ethernet. Disk capacity and speed can be achieved using highly parallel disk arrays.

TurboCap 2

GigE Line-Rate Capture Wireshark Integration Full-Rate Traffic Injection Open API for Development Port Aggregation Number of Ports Host Interface yes yes yes yes pairwise and ALL ports from all the boards 2 ports PCIe 4-lane

TurboCap 4

yes yes yes yes pairwise and ALL ports from all the boards 4 ports PCIe 8-lane

About Riverbed

Riverbed Technology is the IT performance company. The Riverbed family of wide area network (WAN) optimization solutions liberates businesses from common IT constraints by increasing application performance, enabling consolidation, and providing enterprise-wide network and application visibility all while eliminating the need to increase bandwidth, storage or servers. Thousands of companies with distributed operations use Riverbed to make their IT infrastructure faster, less expensive and more responsive. Additional information about Riverbed (NASDAQ: RVBD) is available at www.riverbed.com.
2005, 2006, 2007, 2008, 2009
Riverbed Technology 199 Fremont Street San Francisco, CA 94105 Tel: +Fax: +www.riverbed.com Riverbed Technology Pte. Ltd. 391A Orchard Road #22-06/10 Ngee Ann City Tower A Singapore 238873 Tel: +65 6508-7400
Riverbed Technology Ltd. Farley Hall, London Road Binfield Bracknell Berks RG42 4EU Tel: +44 (0) Riverbed Technology K.K. Shiba-Koen Plaza Building 9F 3-6-9, Shiba, Minato-ku Tokyo, Japan 105-0014 Tel: +5419 1990
2010 Riverbed Technology, Inc. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology, Inc. All other trademarks used herein belong to their respective owners.

TC020311

Public Relations Contact Janice Spampinato CACE Technologies th Street, Suite 103 Davis, CA 95616 530.758.2790 x111 mail to: janice.spampinato@cacetech.com FOR IMMEDIATE RELEASE
CACE Technologies Releases TurboCap
Inexpensive, Full Line-Rate GbE Capture & Injection Solution for Windows Platforms Davis, California, June 26, 2008 CACE Technologies, Inc., developer of tools to enhance the Wireshark user experience, today announced that they have released TurboCap, a feature-rich, full line-rate, Gigabit Ethernet solution for Windows-based platforms. First previewed at the inaugural SHARKFEST 08 conference in April of this year, TurboCap has been a much-anticipated release from the company. Based on a dual-port Gigabit Ethernet board, TurboCap comes with an optimized Windows driver that supports full-rate GbE capture and injection. The TurboCap Software Distribution includes the TurboCap Windows Driver, Manuals, and a Developers Package. The Developers Package is for users who are interested in developing their own applications based on the TurboCap API and includes a large number of sample applications. One very important application is the Dump-to-Disk Application which has been optimized for high-speed capture to disk. Gianluca Varenni, TurboCap and WinPcap Product Manager states, TurboCap is unique, given its feature set and price point. The products ability to support simultaneous full-rate Gigabit capture on both ports with precise timestamps and per-packet meta information, to support fullrate aggregation of the traffic received on both ports of the same board, and to, in many instances, replace a hardware aggregating tap, makes it a very interesting and affordable alternative to many Gigabit capture and tap options on the market. About TurboCap Full-Speed Gigabit Ethernet Capture. TurboCap supports simultaneous full-rate Gigabit capture on both ports with precise timestamps and per-packet meta information. The TurboCap Windows driver supports multiple TurboCap boards. Board (Port) Aggregation. TurboCap supports full-rate traffic aggregation of the traffic received on both ports of the same board.
Pass-thru Mode. TurboCap supports a full-rate pass-thru mode in which packets received on each port are injected out the other port of the same board, similar to a hardware tap. When TurboCap is in pass-thru mode, incoming traffic on each port is available for capture. Aggregating Tap. The combination of Board Aggregation and Pass-thru Mode provides functionality equivalent to a hardware aggregating tap. Full-Speed Gigabit Ethernet Injection. TurboCap supports simultaneous full-rate Gigabit packet injection on both ports. Packets are transmitted in the order in which they are sent to the driver and with minimal delay. WinPcap Compatible. TurboCap is integrated with WinPcap and supports open-source applications such as Wireshark, Windump, and Ntop. Exported Interfaces. TurboCap exports capture interfaces for each port of every board and, for each board, a Board Aggregation Port (BAP) that aggregates the traffic on both ports. In the case of multiple boards on the same system, TurboCap exports a Global Aggregation Port (TcAP) consisting of the aggregated traffic from all ports on all boards.
Turbocap Pricing and Availability TurboCap is $895.00 USD and is available now directly through CACE Technologies catalog page at www.cacetech.com/products/catalog/ or through our international reseller partners. Please contact us for a partner in your part of the world. About CACE Technologies, Inc. CACE Technologies is an innovative group of product designers and engineers specialized in networking solutions that enhance the Wireshark user experience. Experts in Windows and Linux device driver and network monitoring tools development, CACE's core engineering team includes the creators of Wireshark and WinPcap, premier open-source tools for packet capture and protocol analysis. For information on our tools and services, visit www.cacetech.com. ### Trademarks property of their respective holders