GigaSMART Perpetual Licenses

Base GigaSMART Applications

GigaVUE-HC0 Module – The base applications include Packet Slicing, Masking, Trailer, and IP and L2GRE Tunnel Decap.

GigaVUE‑HC3 SMT-HC3-C05 Module – The base applications include Packet Slicing, Masking, Trailer, and IP and L2GRE Tunnel Decap.

GigaVUE‑HC1 Node – The base applications include Packet Slicing, Masking, and Trailer.

GigaVUE-HB1 Node – The base applications include Packet Slicing, Masking, and Trailer.

Masking lets you overwrite specific packet fields with a specified pattern so that sensitive information is protected during network analysis.

Privacy compliance is crucial for financial, insurance, and healthcare enterprises. GigaSMART masking lets you give network engineers the data they need while still keeping private data private.

As with the slicing feature, GigaSMART masking can automatically compensate for variable length headers, allowing you to specify a mask target in terms of a particular packet header.

Use GigaSMART encapsulation and decapsulation operations to send traffic arriving on one GigaSMART-enabled node over the Internet to a second GigaSMART-enabled node. There, the traffic is decapsulated and made available to local tool ports.

This feature is useful when instrumenting remote data centers – you can tunnel selected portions of the traffic from the remote GigaSMART-enabled node to tools in a central location. Traffic is encapsulated at the sending end of the tunnel and decapsulated at the receiving end.

IP fragmentation and reassembly is supported. Refer to GigaSMART Layer 2 GRE Tunnel Encapsulation/Decapsulation.

GigaSMART IP encapsulation/decapsulation is licensed differently for the GigaVUE line cards, modules, and nodes as follows:

Note:  GigaSMART operations with a tunnel component can only be assigned to GigaSMART groups consisting of a single GigaSMART engine port.

Starting in software version 5.3, support for VXLAN tunnel termination is added to GigaSMART. VXLAN encapsulated packets originating from any device, such as the Gigamon cloud solution or a customer-specific device, will be received on an IP interface associated with a network port, then the packets will be terminated at GigaSMART. The VXLAN payload (the inner packet) will be sent to tools. The reassembly of fragmented IP packets is also supported.

GigaSMART VXLAN tunnel decapsulation is licensed differently for the GigaVUE line cards, modules, and nodes as follows:

Note:  GigaSMART operations with a tunnel component can only be assigned to GigaSMART groups consisting of a single GigaSMART engine port.

Advanced Tunneling License/Tunneling License

The Advanced Tunneling License/Tunneling License enables the following GigaSMART applications:

As described above, GigaSMART L2GRE encapsulation requires Advanced Tunneling license on GigaVUE‑HC2, and GigaVUE‑HC3.

On GigaVUE-HB1 and GigaVUE‑HC1, GigaSMART L2GRE encapsulation/decapsulation requires Tunneling license.

As described above, GigaSMART Custom tunnel decapsulation requires Tunneling license on GigaVUE-HB1 and GigaVUE‑HC1.

De-duplication License

The De-duplication License enables the following GigaSMART applications:

Header Stripping License

The Header Stripping License enables the following applications:

Stripping operations let you remove headers from tagged packets or headers and trailers from tunneled (encapsulated) packets:

Adaptive Packet Filtering (APF) provides filtering on specific encapsulation protocol parameters. Additionally, it has the ability to look beyond the encapsulation protocol parameters into the original (encapsulated) data packet, to filter on source and destination IP or Layer 4 port numbers. APF offers the ability to look for content anywhere in the data packet and make intelligent filtering and forwarding decisions.

Adaptive Packet Filtering includes fragmentation awareness whereby all IP fragments associated with the filtered data packet are always forwarded allowing a complete view of the traffic stream for accurate analytics. APF also provides a powerful filtering engine that identifies content (based on patterns) across any part of the data packet, including the data packet payload.

APF filters packet-by-packet, but does not have the concept of sessions. For application session filtering (ASF) and packet buffering on application session filtering, refer to GigaSMART Application Session Filtering (ASF) and Buffer ASF.

Application Session Filtering (ASF) provides additional filtering on top of Adaptive Packet Filtering (APF). With APF, you can filter on any data patterns within a packet. With ASF, you apply the pattern matching and then send all the packet flows associated with the matched packet to one or more monitoring tools.

Use ASF to create a flow session and send the packets associated with the flow session to one or more tools. A flow session consists of one or more fields that you select to define the session. Either the packets for the whole session can be captured or only the packets following a pattern match.

ASF captures packets of a session after an APF rule match. When the APF match occurs in the middle of a session, packets in the session prior to the match are not captured. With some tools needing all the packets of a flow session in order to perform data analysis, GigaSMART uses buffering to ensure that all packets belonging to a flow session are captured and forwarded to the tools. This is referred to as Application Session Filtering with buffering, or buffer ASF.

Note:  ASF and buffer ASF also require the Adaptive Packet Filtering (APF) license.

Note:  Stateful load balancing for the ASF application is included with the Application Session Filtering (ASF) license.

GigaSMART Advanced Flow Slicing allows you to slice traffic on multiple network protocols, each with different offset. In Enhanced slicing, you can configure multiple protocols within a profile with rules for slicing of a packet which in turn reduces the number of GigaSMART Operations (GSOP) and the maps to be configured. In this feature, the slicing of packets occurs after the packet count has reached a configured value thereby preventing the slicing of control information and other important data of the networking protocols.

Once the license expires, the packets are sent to the tool port without performing packet slicing and advanced slicing, and the configuration of a new map or editing an existing map is not allowed.

During the grace period, the packets are sliced based on the existing profile.

GigaSMART Enhanced Load Balancing supports evenly distributed traffic among multiple tool ports based on one or more user defined fields. When a tool port fails, the traffic is redistributed just for that tool port to other member tool ports. When the failed tool port recovers, the traffic that was redistributed is restored to the recovered tool port. Traffic across other member tool ports remain undisturbed during this process.

Once the license expires, the packets are dropped, and the configuration of a new map or editing an existing map is not allowed.

During the grace period, the packets are load balanced based on the existing profile.

The GPRS Tunneling Protocol (GTP) carries mobile data across service provider networks. GTP includes both the control plane (GTP-c) and a user-data plane (GTP-u) network traffic. Visibility into a subscriber’s session requires the ability to understand the stateful nature of GTP (v1 and/or v2).

To gain an accurate view into the subscriber’s session, GTP tunnels are used to correlate subscriber-specific control plane and user-data plane traffic.

With GTP correlation, you can gain access to the subscriber’s data in these GTP tunnels by reliably correlating and passing all of the identified subscriber’s control and data plane traffic to the analytics/monitoring tools and billing subsystems.

Using GTP correlation, you can filter, replicate, and forward specific subscriber sessions to specific tools by correlating the subscriber IDs that are exchanged as part of the control sessions to the corresponding tunnel IDs (TEID) that are part of the user-data plane traffic.

GTP correlation supports a maximum of 5 million GTP subscriber sessions for GigaVUE‑HC2 nodes, whereas, it supports 12 million GTP subscriber sessions for GigaVUE‑HC3 nodes.

Note:  Tiered License model for 250k/500k/Max Subscribers applies only to GigaVUE‑HC2. GigaVUE‑HC3 has Max license only.

Note:  Stateful load balancing for the GTP application is included with the GTP Filtering & Correlation license.

Note:  The Adaptive Packet Filtering (APF) license is included with GTP for filtering inside GTP headers.

Stateful load balancing distributes GigaSMART processed traffic to multiple tool ports or tunnel endpoints based on GigaSMART application-specific flow sessions.With stateful load balancing, packets belonging to the same flow session maintained by GigaSMART applications are forwarded to the same tool port or tunnel endpoint within a port group.

Use the GigaSMART Operations (GSOP) page to configure load balancing. Specify one stateful application within a group of GigaSMART operations and specify a load balancing metric.

GTP, Application Session Filtering (ASF), and tunnel are the currently supported stateful applications.

Note:  GTP correlation combines with GigaSMART Load Balancing to load balance GTP traffic to a set of tool ports . To know more, refer to GigaSMART GTP Correlation

Starting in software version 4.5, GTP can be scaled as follows:

SIP/RTP Correlation License

The SIP/RTP Correlation License enables the following GigaSMART application:

When a packet containing SIP, RTP, or RTCP traffic is received, the SIP/RTP correlation engine looks up the session in the session table for load balancing ports and sampling maps or whitelist map. All SIP/RTP traffic with port or load balancing port group is forwarded based on the session table. The correlation engine load balancing keeps track of both the SIP session and the associated multiple RTP channels.

Note: Refer GigaSMART SIP/RTP Correlation for more details.

FlowVUE allows for the active sampling of a subscriber’s device (also known as a “User Endpoint IP” or UE IP) across IP networks or GTP-u tunnels. The integrity of subscriber flows is preserved by forwarding all flows associated with the sampled UE IP to all probes and analysis tools. Intelligent sampling executed by FlowVUE is deployed for understanding usage patterns. Operators can also gain visibility in to the subscribers QoE by forwarding all GTP control sessions to the monitoring tools.

By combining FlowVUE with other GigaSMART functions such as APF, network traffic can be further reduced by filtering on specific Layer-4 application ports that the operator is interested in monitoring. Overall, this helps service providers address rising tool costs by enabling them to preserve or increase tool utility and offset ARPU reduction by monetizing Big Data with tools seen in Customer Experience Management offerings.

Note:  The FlowVUE license also enables GTP whitelisting and GTP flow sampling.

NetFlow Generation is a simple and effective way to increase visibility into traffic types and usage patterns across systems. Data can be used to build relationships and usage patterns between nodes on the network (traditionally, routers and switches collected IP traffic statistics and exported them as NetFlow Generation Records).

The advanced capabilities of GigaSMART® technology can be leveraged to summarize and generate unsampled NetFlow Generation statistics from incoming traffic streams. Offloading NetFlow Generation to an out-of-band solution like the Gigamon Visibility Platform completely eliminates the risk of expending expensive production network resources in generating these analytics. Combined with the flexibility offered by Gigamon’s patented Flow Mapping® technology, operators can pick and choose from the incoming flows to generate NetFlow Generation statistics, without losing critical information.

NetFlow Generation supports NetFlow version 5, 9, IPFIX.

The port used to export NetFlow records is configured as an IP interface.

When NetFlow collects SSL metadata, it makes use of the GigaSMART SSL application, however, only the NetFlow Generation license is needed for NetFlow to collect SSL metadata.

NetFlow supports second level maps that are used for configuring filtering rules enabled through Adaptive Packet Filtering (APF). After the APF rules are applied, second level maps send traffic to NetFlow and then to IP interface with tool ports.

Note:  NetFlow with second level maps requires the Adaptive Packet Filtering license.

Note:  GigaSMART operations with a NetFlow component can be assigned to multiple GigaSMART groups or GigaSMART groups consisting of multiple GigaSMART engine ports.

Secure Sockets Layer (SSL) Decryption is a cryptographic protocol that adds security to TCP/IP communications such as Web browsing and email. The protocol allows the transmission of secure data between a server and client who both have the keys to decode the transmission and the certificates to verify trust between them. Passive SSL decryption delivers decrypted traffic to out-of-band tools that can then detect threats entering the network.

On GigaVUE H Series nodes, GigaSMART line cards or modules perform the decryption of SSL traffic. Using GigaSMART for decryption provides a single decryption point, enabling decrypted data to be sent to tools for inspection. Using GigaSMART removes the decryption function from tools and offers improved performance.

Before SSL traffic is decrypted, the de-duplication GigaSMART operation can be performed. Decrypted traffic from the GigaSMART line card or module can be filtered, aggregated, and replicated and then sent to one or more monitoring tools for analysis.

Use Passive SSL decryption on the GigaSMART line card or module with passive or offline traffic. Tap the traffic to and from a server and pass it to the GigaVUE H Series node with the GigaSMART line card or module.

For secure storage of private keys, Entrust nShield Hardware Security Module (HSM) is integrated with Passive SSL decryption. Refer to Entrust nShield HSM for SSL Decryption for Out-of-Band Tools.