Datacenter networks are transitioning to modern 10G/40G,

25G/100G, and 40G/100G designs to meet the demands of

cloud computing, data analytics, and 4G/5G LTE mobile services.

The corresponding traffic monitoring networks also need to

transition to next-generation designs. The exponential growth

in data center size, bandwidth, and traffic and the demand

for monitoring a greater portion of network traffic together

test the limits of traditional monitoring/visibility designs. The

traditional box-by-box approach based on proprietary network

packet brokers (NPBs) has proven to be cost-prohibitive and too

operationally complex for organization-wide monitoring.

With DMF scale-out architecture, simplified operations, and

open switch economics, DMF is rapidly becoming an attractive

alternative to legacy NPBs. Two popular use cases have

emerged:

•

Pervasive security and visibility: monitor or secure every

link.

•

Multi-site Monitoring: monitor or secure remote DCs/POPs/

branches/sites/environments.

DMF supports topology agnostic, highly scalable fabrics.

Depending on the customers’ requirements, a range of

topologies is supported—from a single-switch fabric to a scale-

out, multi-switch/ multi-layer fabric. A typical multi-layer DMF

fabric design has a layer of switches labeled as filter switches

and a layer of switches labeled as delivery switches. Most switch

interfaces in the filter-switch layer are wired to passive optical

taps or switch/router/ firewall SPAN ports in the production

network; they are configured as filter interfaces in the DMF

controller software user interface. Switch interfaces in the

delivery-switch layer are wired to tools and are configured as

delivery interfaces. Filter interfaces (where packets come into

the fabric) and delivery interfaces (where packets go out of the

fabric to tools) represent the primary functions of DMF.

Monitor every location: Enterprises can extend DMF across L3

WAN to enable monitoring of remote DCs/POPs, colo facilities,

campus/branch locations, and retail environments. This allows

centralized monitoring tools and staff in a few data centers,

dramatically reducing CapEx and Opex while empowering

operations teams to monitor networks across the entire

organization. By simply deploying a commodity Ethernet switch

at each monitored location, the entire DMF (including remote

location switches) is operated and managed centrally via the

DMF controller with high availability.

Datasheet

arista.com

arista.com

arista.com

arista.com

4

Feature

Description / Benefit

Advanced Filtering & Deeper

Packet Matching Capabilities

• L2/L3/L4 header filtering on ingress and packet replication (as required) in the fabric

for multiple egress tools.

• Deeper Packet Matching (DPM) with masking (up to 128 bytes in packet). Supports

matching on inner header fields for encapsulated packets (e.g MPLS, VXLAN, GRE)

and/or protocols (e.g. GTP, SCTP).

• IPv4 and IPv6 based filtering.

• IPv4, IPv6, MAC Address masking, TCP Flags, DSCP matching.

• Support filtering on inner VLAN of a Q-in-Q packet

• Support PTP timestamping the packets

Specialized Packet Functions

• Packet De-duplication—Enhances tool efficiency, by dropping duplicate packets.

• Packet Slicing—Improves security and tool throughput by stripping off the payload.

• TCP Session Slicing - Improves tool throughput by forwarding only a few packets at

the beginning of the TCP session.

• Packet Masking—Improves security by hiding user/confidential information such as

Credit card, SSN, passwords, medical or financial data to comply with SOX, HIPAA, and

PCI regulations.

• Regex Pattern matching—Improves filtering of traffic based on regex patterns

anywhere within the packet.

• Header stripping for VXLAN, Cisco Fabric Path, LISP, GENEVE, PPPoE, ERSPAN, and

MPLS packets. A generic user-defined header stripping function is also supported.