More Products
Der liebe Gott versteckt im Detail. Originating from Ota, Tokyo, the SwiftWing Series has enjoyed great success since its introduction in 2003. We have a track record of 20 years of development, a worldwide customer base, and sustained operational performance.
SwiftWing Sirius NDR is the only PCAP recorder in the industry (as of January 2022) that supports simultaneous capture of multiple media I/Fs from 10Mbps to 100Gbps Ethernet (10M/100M/1G/10G/25G/40G/100G) .
SwiftWing Sirius NDR is a Network Drive Recorder capable of saving incoming traffic directly into storage disks in PCAP format. Equipped with a large-capacity storage of up to 20.0 PB 1, it is capable of processing a stream of 200 Gbps or more for sustained periods. It boasts a supporting software that has been redesigned from the ground up to deliver targeted functionality, excellent usability, and improved reliability in runtime environments.
In the latest development of Sirius NDR, the number of capturing channel 2 has increased from 4 to 8 channels. This means that up to 8 capture operations can be executed individually, further optimizing the usages and assignment of capture ports per channel.
Each channel can be assigned to multiple physical ports mounted on the media I/F. For the maximum configuration (10G/25Gx16 ports), a full-duplex 8ch (2 physical ports assigned to each channel) capture configuration is possible.
Since each channel can be used by giving individual access rights to multiple users, each user can operate as if they were occupying an independent capture system.
Currently, the capture interface lineup offers 10 Mbps - 10 Gbps, 10 - 100 Gbps, and 10 - 200 Gbps capture rates. SwiftWing Sirius NDR is a fully configurable system with various chassis. This flexibility extends several advantages to users. If current traffic volume is low, users can save initial costs by purchasing a low-speed unit. As traffic volume increases, the chassis can be upgraded by installing faster interfaces. This approach lowers cost barriers and yields more lasting returns on customer investments.
SwiftWing Sirius NDR adopts a Web GUI interface that has proven popular with users due to its intuitiveness and ease of use. A unified screen design provides a coherent user experience across various functions such as capture settings, reference and download of acquired packets, and statistical information. Because PCAP files are split according to the specified unit of time 3, WireShark or a hypervisor 4 can access PCAP files as they are being generated immediately after capture has started.
1 as of August 2023 2 dynamic channel assignment is unique to Sirius NDR by mapping physical port to a configured channel for a capture session 3 PCAP files can also be split by file size 4 optional for all models except Portable Compact
Devices can support a total of 8 channels. In addition, up to two different media interfaces can be installed※ and used at the same time. With 100G-A2 interfaces, a maximum of 16 ports can be configured. Channels can be assigned with any physical ports from their associated media interfaces, and can perform captures and generate PCAP files individually. Therefore, a single Sirius unit can capture and analyze traffic from multiple DUTs. ※ In a dual adapter configuration, if a 10G-B1 and 100G-A2 media interface are installed, captures can be performed at a rate of 10M/100M/1G/10G/25G/40G/100G on a single chassis.
Permissions to perform key functions such as capture, capture file download, and post-filter can be assigned on a per-channel basis.Each group can manage the resources of the same chassis by physical port, allowing multiple users to use a single chassis as multiple independent capture systems.
As shown in the figure on the right, users belonging to Group A is only allowed to access physical ports 1 and 2 (channel 1), users belonging to Group B is only allowed to access physical ports 3 and 4 (channel 2). At the same time, users belonging to Group C can be configured to allow access to both Channel 1 and Channel 2. It is also possible to flexibly assign various privileges to each group.
Extended packet replay sessions can process PCAP files of up to 500 GB with recorded timestamps accurately reflected. Replay is not limited to files generated by Sirius; foreign PCAP files uploaded by the user can also be replayed. GUI controls include pause and resume functions, as well as options to replay PCAP files continuously or for a specified number of times. Ideal for 2K/4K Video over IP verification.
Multiple port replay sessions can now be supported. For all the physical ports available on the capture card, it's possible to replay traffic via tx port concurrently.
Sirius is equipped with two types of filters – pre-filters and post-filters. Pre-filters can be applied not only to parameters (e.g. IP address) found in the protocol header of each layer, but also to any value in the payload (e.g. HTTP method). Post-filters can be applied to VLAN (Outer/Inner), IP address, protocol and port number.
Universal-Filter Universal filter specifies the offset value and pattern length from the head or tail of the frame and can be recorded in the index. Universal filters can be in hexadecimal (pattern, pattern_hex) or ASCII (pattern, pattern_ascii) formats.
Dynamic packet alerts enable users to specify the conditions required for packets to trigger notification events. Users can also choose to receive notifications via SNMP Trap, syslog, or email. With this feature, users can be notified immediately about the occurrence of rare packets. It is also possible to configure Sirius to retain neighboring packets received within a specified window before and after each detected occurrence. The traffic data collected can be further examined to better understand the circumstances leading to rare packet occurrences. Like filters, the conditions used for packet detection are very flexible and can be applied to any value in the protocol header and payload.
Traffic alert is emitted alert when traffic is below or above a specified flow rate. Alert can send to the administrator via SNMP Trap, Remote Syslog, or e-mail. Traffic flow rate units can be selected from bits per second (bps) and packets per second (PPS). When the network deviates from the steady state, it can be detected and alerted immediately.
The dashboard displays information such as system information, port link status, presence/absence of packet traffic, SNMP trap reception/transmission, etc. When the system is idle, a summary of the most recent capture will also be available. When a capture is started, the summary switches to show real-time statistical information about the running capture. Default options, such as capture settings, can also be easily toggled through the web GUI.
PCAP files are generated immediately upon the initialisation of capture. The status of the capture session, as well as other statistical information, are also displayed in real time. Traffic can be further analyzed using post-filters, built-in Wireshark, or other hypervisor applications without stopping capture. The following items are displayed on the real-time monitor:
Traffic analysis analyzes and graphically displays the traffic volume by application and IPv4 address pair traffic volume.
By using this, the status of captured traffic can be analyzed by application and IPv4 address pair. It is very useful for understanding the overview of traffic and identifying the cause of bursts.
Data on network throughput is collected and recorded every 500 microseconds. It is possible to set a threshold for throughput and subsequently dispatch alerts (via SNMP Trap, syslog, event log, or email) when the threshold is exceeded. Overwrite protection can also be toggled for PCAP files with recorded microbursts.
Sirius NDR saves captured packets into PCAP files of a certain capacity or time unit specified at the start of capture.
No file Split Captured data will be saved in 1 file.
Split by file size File will be split according to the specified size during capture. 32 MB, 64 MB, 128 MB, 256 MB, 512 MB, 1 GB, 1.5 GB, 2 GB, 4 GB
Split by time File will be split according to the time interval specified during capture. 1 sec, 5 sec, 10 sec, 15 sec, 30 sec, 1 min, 5 min, 10 min, 15 min, 30 min, 1 hr
File rotation automatically deletes the oldest file in a capture session when the total size of all capture files reaches the specified storage limit.
Files may be rotated based on percentage disk usage or by total number of capture files. File rotation allows capture sessions to run continuously for extended periods of time without interruption.
Captured packets can be sliced and saved. The size of each slice can be configured by specifying the number of bytes required from beginning of the MAC header of each ethernet frame. Any data beyond the specified range is discarded. This saves storage space by removing unnecessary portions of the payload.
Application Range 64 - 10,000 Bytes
It is possible to set a filter by specifying an offset value from the ethernet header. This feature allows filtering on special protocols and user payloads.
Type of Dynamic offset ①Specify the offset value from the Layer2 header ②Specify the offset value from the Layer3 header ③Specify the offset value from the Layer4 header ④Specify the offset value from the Layer4 payload
Packets received by Sirius can be used immediately by any PCAP application. A hypervisor option is available to expand the use of Sirius as an operating platform upon which users’ preferred applications can be installed. Also, since Wireshark is pre-installed on the operating system, it is possible to analyze packets immediately without forwarding received traffic to an external device.
Sirius features a newly designed RESTful API which enables third party devices to connect and access capture files stored in SIRIUS NDR via web services. Secure access is also available via HTTPS. The new API is more compatible with external devices and is an effective interface for building web-based measurement and monitoring services such as:
Sirius can be coupled with a DPI analysis probe (SwiftWing Traemon) to perform real-time traffic analysis (max 10G) for IP pairs, protocol distribution, TCP/HTTP delay time, etc. Sirius is able to utilize the results for further post-filtering, and relevant packets can be extracted easily with a single click of a button. For more information about SwiftWing Traemon <<Click here>>
Sirius NDR offers a full-choice system that be optimized for the customer’s operational needs. The current product lineup includes three types of media interfaces (multi-rate compatible) which can be installed in any combination on any chassis (Portable Compact / Portable M / Portable L / Rack Mount).
We can provide the optimum system according to customers’ requests (media interface, storage performance/capacity, operational environment, required functions, etc). If capture traffic volume is low, users may opt to purchase a unit more suitable for current demands. The capture performance of the device can be upgraded by installing high-speed interfaces (such as a 100 Gbps interface) to match future increases in traffic volume.
This chassis can be purchased in 1U/2U/4U/4U+JBOD models. Models can be fitted with any media interface (some restrictions apply). Storage write speeds (PCAP to Disk) range from 20 Gbps (1U) to 200 Gbps (Type 5L). Storage capacity can be configured from 8 TB (1U) to a maximum of 18.0 PB (Type 11LX). RAID5/50/60 are typically adopted for disk redundancy, though a hot spare configuration with even higher fault tolerance is possible upon request.
The Sirius Portable M and Portable L are ruggedized models that are excellent for field use. The Portable M has a storage write speed of up to 55 Gbps, while the Portable L performs up to 110 Gbps. Both models allow a storage capacity of 15 to 960 TB in RAID50 configuration. A complimentary carrying case with 4 wheels is also included for convenient transportation.
The Portable Compact is an entry model of the Sirius NDR series that offers significantly improved 25Gbps and 50Gbps continuous capture performance with enhanced storage reliability by utilizing RAID 5. The built-in power supply is available the unit to be used as a complete stand-alone solution by connecting the included monitor, keyboard, and mouse. A carrying case* is provided to hold a complete set of equipment, making it ideal for business travel and on-site use. (optional for 4 wheel hard case)
10 Mbps - 100 Gbps Ethernet (10M/100M/1G/10G/25G/40G/100G) media interface lineup.
Most of our media interfaces support multi-rate capture. A single chassis is capable of capturing at all of the above media speeds when a 10G-A2 or 10G-B1 media interface is installed with a 100G-A2/100G-A3 interface in dual adapter configuration (not supported by Portable Compact/1U chassis).
Specifications: SFP/SFP+ x 2 10Base-T 100Base-TX 1000BASE-SX/-LX/-T 10Gbase-SR/-LR/-T
Specifications: QSFP+/SFP28 x 2 10Gbase-SR/-LR/-T(※) 25Gbase-SR/-LR/-CR(※) 40Gbase-SR4/-LR4/-CR4 100Gbase-SR4/-LR4/-PSM4/-CLR4/-CR4/-ER4 (※)10/25GBase-SR/-LR can be configured with 8 ports when using a breakout cable
Specifications: QSFP+/SFP28 x 2
10Gbase-SR/-LR/-T(※) 25Gbase-SR/-LR/-CR(※) 40Gbase-SR4/-LR4/-CR4 100Gbase-SR4/-LR4/-PSM4/-CLR4/-CR4/-ER4
(※)10/25GBase-SR/-LR can be configured with 8 ports when using a breakout cable
Specifications: QSFP+/SFP28 x 4 10Gbase-SR/-LR/-T(※) 25Gbase-SR/-LR/-CR(※) 40Gbase-SR4/-LR4/-CR4 100Gbase-SR4/-LR4/-PSM4/-CLR4/-CR4/-ER4 (※)10/25GBase-SR/-LR can be configured with 16 ports (400Ghi) when using a breakout cable
Specifications: SFP/SFP+ x 2
10Base-T 100Base-TX 1000BASE-SX/-LX/-T 10Gbase-SR/-LR/-T
Specifications: QSFP+/SFP28 x 2 10Gbase-SR/-LR/-T(※) 25Gbase-SR/-LR/-CR 40Gbase-SR4/-LR4/-CR4 100Gbase-SR4/-LR4/-PSM4/-CLR4/-CR4/-ER4 (※)10/25GBase-SR/-LR can be configured with 8 ports when using a breakout cable
Specifications: QSFP+/SFP28 x 4 10Gbase-SR/-LR/-T(※) 25Gbase-SR/-LR/-CR 40Gbase-SR4/-LR4/-CR4 100Gbase-SR4/-LR4/-PSM4/-CLR4/-CR4/-ER4 (※)10/25GBase-SR/-LR can be configured with 16 ports when using a breakout cable
10Gbase-SR/-LR/-T(※) 25Gbase-SR/-LR/-CR(※) 40Gbase-SR4/-LR4/-CR4 100Gbase-SR4/-LR4/-PSM4/-CLR4/-CR4/-ER4 (※)10/25GBase-SR/-LR can be configured with 8 ports(200Gi) when using a breakout cable
Model: 100G-A2 x2 (400Gi)
Specifications:QSFP28/QSFP+ x 4
10Gbase-SR/-LR/-T(※) 25Gbase-SR/-LR/-CR(※) 40Gbase-SR4/-LR4/-CR4 100Gbase-SR4/-LR4/-PSM4/-CLR4/-CR4/-ER4 (※)10/25GBase-SR/-LR can be configured with 8 ports(200Gi)/16ports(400Gi) when using a breakout cable
Specifications:SFP/SFP+ x 2
Specifications: QSFP+/SFP28 x 2 10Gbase-SR/-LR/-T(※) 25Gbase-SR/-LR/-CR 40Gbase-SR4/-LR4/-CR4 100Gbase-SR4/-LR4/-PSM4/-CLR4/-CR4/-ER4 (※)10/25GBase-SR/-LR can be configured with 8 ports(200Gi) when using a breakout cable
(max 2160 TB)
(max 3240 TB)
(max 4320 TB)
100V -240V
main unit Voltage: 200V - 220V Wattage: ~800W Redundant
daughter unit Voltage: 200V - 240V Wattage: ~1600W Redundant
Dimensions (W:H:D / mm)254 x 66 x 226Weight (kg)3 (Separately: AC power supply approx 1 kg)
Specifications: SFP/SFP+ x 2 or 4 10Base-T 100Base-TX 1000BASE-SX/-LX/-T 10Gbase-SR/-LR/-T
Model:100G-A2 x1(200Gi)
Specifications:QSFP+/SFP28 x 2
Specifications: QSFP+/SFP28 x 2 10Gbase-SR/-LR/-T(※) 25Gbase-SR/-LR/-CR(※) 40Gbase-SR4/-LR4/-CR4 100Gbase-SR4/-LR4/-PSM4/-CLR4/-CR4/-ER4
*With carrying knob attached
carrying case with wheels, USB mouse, mobile display, mini USB keyboard
Specifications: SFP/SFP+ x 4
(※)10/25GBase-SR/-LR can be configured with 8 ports(200Gi) when using a breakout cable
Specifications: QSFP+/SFP28 x 2 or 4 10Gbase-SR/-LR/-T(※) 25Gbase-SR/-LR/-CR(※) 40Gbase-SR4/-LR4/-CR4 100Gbase-SR4/-LR4/-PSM4/-CLR4/-CR4/-ER4 (※)10/25GBase-SR/-LR can be configured with 16 ports when using a breakout cable
carrying case with wheels, USB mouse
Specifications: QSFP28/QSFP+ x 2 10Gbase-SR/-LR/-T(※) 25Gbase-SR/-LR/-CR(※) 40Gbase-SR4/-LR4/-CR4 100Gbase-SR4/-LR4/-PSM4/-CLR4/-CR4/-ER4 (※)10/25GBase-SR/-LR can be configured with 8 ports when using a breakout cable
Specifications: SFP/SFP+ x 4 10Base-T 100Base-TX 1000BASE-SX/-LX/-T 10Gbase-SR/-LR/-T
Specifications: QSFP28/QSFP+ x 2 or 4 10Gbase-SR/-LR/-T(※) 25Gbase-SR/-LR/-CR 40Gbase-SR4/-LR4/-CR4 100Gbase-SR4/-LR4/-PSM4/-CLR4/-CR4/-ER4 (※)10/25GBase-SR/-LR can be configured with 8 ports (200Ghi) or 16 ports (400Ghi) when using a breakout cable
(max 960 TB)
Portable Compact / Portable M / Portable L is available in a carrying case with 4 wheels.