2 x 10GBASE-SR ports / 4 x GbE ports / 48 TB / 10 Gbps peak capture speed / 5 Gbps minimum sustained capture speed at 6 million packets per second.
Continuous packet capture with bypass (failover passthrough) and GPS time synchronization.
Inline capture and dedicated SPAN/mirror port modes; retrieve data by date/time and/or IP/MAC address.
Full packet capture with timestamps: all headers and payloads, including FCS/CRC.
10-Gbps fiber network appliance with large storage captures raw network data in full for complete network monitoring and visibility, with an emphasis on performance and ease of use. Generous 48TB "lookback" capacity allows for longer data retention, useful for investigating, diagnosing and troubleshooting network incidents and issues. Integrates with IPCopper's management and analytics server.
The USC10M2 is a 48TB, 10Gbps, 6,000,000 packets per second appliance for continuous 24/7 network monitoring. Emphasizing performance and ease of use, the USC10M2 allows businesses and other organizations to reliably capture and retain volatile network data with little to no effort on both gigabit and 10G networks. With installation as simple as connecting cables and powering up and management via a straightforward, menu-driven utility, the USC10M2 handily fulfills infosec professionals' needs for high-performance, easy to use data capture and monitoring tools.
With so many applications and communications now web-based, businesses need the granular visibility that 100% packet capture provides in order to see the what, when, how and who. The USC10M2, a 10G fiber packet capture appliance with the ability to also connect via 1G copper interfaces, brings tremendous value to the task of packet data capture. With peak 10G performance and minimum sustained recording of 5 Gbps at 6 million packets per second, the USC10M2 provides detailed, comprehensive network visibility for even the busiest networks.
High-performance, full packet capture provides the basis for quality data analysis. It’s essential both for post-security incident forensics and network diagnostics. The USC10M2 gives you the full picture, capturing every packet, both header and payload, precisely timestamped in the exact order received.
Truly operational out of the box, no configuration is required to begin capturing packets — simply connect a few cables, power the unit up and you are ready to go. Installing the USC10M2 requires no changes to your network topology – your other networking equipment won’t even notice that it’s there.
Two 10GBASE-SR ports and four 1-GbE ports give you the flexibility to meet any number of installation needs. Key features include:
The USC10M2 is a dedicated, purpose-built packet-capture appliance with high performance and large storage, the first block for building a data-driven monitoring fabric for anomaly detection, network optimization and forensic investigation. For additional data management and analytics features, the USC10M2 integrates with our management and analytics server.
The USC10M2 is a versatile and flexible network appliance, allowing it to be installed practically anywhere on a network, either inline or to a SPAN port. If you have specific installation or performance requirements, please contact us and tell us what you need. For example, our appliances may be customized to include data capture filters, additional data download filters or specific power input capabilities.
*How we tested the USC10M2's speed: We conducted two tests, using a separate IPCopper unit to create a sampling of 2 billion UDP packets with 64-byte payloads. For the first test the USC10M2 was in inline mode (both receiving and sending). We observed that the packets were received by the test unit, correctly sequenced, and subsequent analysis of the captured data showed that the packets were encrypted, indexed and stored in the correct sequence. For the second test, the USC10M2 was placed in SPAN/mirror mode (receiving only). With both tests we observed zero errors and also observed that the count of good packets matched the total number of packets sent. During testing we observed that the unit was able to successfully capture, forward, encrypt, index and store over 6 million packets per second, with an observed, sustained storage rate of up to 5.925 Gbps (including timestamps and other overhead) and a useful payload of over 5 Gbps (including headers for ARP, IP and UDP).
The USC10M2 features bypass, available both on demand and as a failover passthrough in case of power loss or other malfunction. In effect, if the USC10M2 experiences a problem, it automatically removes itself from the network without any user effort required and without any damaging disruption to network operations.
Bypass gives you great flexibility. You can deploy the USC10M2 on critical links where you need 24/7 or only occasional visibility, yet be assured that if the worst happens and the appliance fails or unexpectedly loses power, the network will continue humming. At worst, the unit won’t be able to capture anything, but it won’t bring a screeching halt to network traffic.
Utilizing bypass on demand, you can place the USC10M2 at any network location you wish to monitor in the future, or only monitor intermittently, on a schedule that is convenient for you. Simply manually enable and disable bypass mode through the management utility as needed.
In the case of loss of power, bypass kicks in practically instantaneously, allowing the USC10M2 to pass network traffic even when it is OFF. In the event the unit malfunctions, a watchdog timer ensures that the inline port pairs switch over into bypass mode to prevent network interruptions. Depending on the particular packets passing through at the time, it may take one to six seconds for the switch to take effect after a malfunction – ranging from unnoticeable to little more than a hiccup.
The USC10M2 includes a very accurate GPS-powered system combined with a high accuracy clock that timestamps packets at a resolution of 1/10,000,000 of a second. Accurate time is important when examining packet capture data or reconstructing network events forensically, therefore, it is important to know exactly when a packet arrived – not simply within a minute or two.
GPS time synchronization is fully automatic. Connect the external antenna at installation and at boot up the unit will synchronize its time with broadcast GPS time. If GPS time synchronization is not desired, simply disable it for one boot cycle or permanently.
In our tests of a live IPCopper unit with this high accuracy clock, after twenty weeks (without GPS time synchronization) the clock was off by less than 1½ seconds. That is equivalent to a drift of 0.125 of a second for every 1,000,000 seconds. For the most accurate timestamps, however, the best strategy is to allow the IPCopper unit to resynchronize with GPS time at regular intervals and avoid deviations over time.
The USC10M2 features 48 TB of continuous-loop data storage. After the unit reaches its 48 TB capacity, it "rolls over" and overwrites the oldest captured data with the newest. At any given time, the unit will contain the most recent 48 TB of captured network activity.
The USC10M2 indexes the packet data as it captures it, enabling speedier data retrieval and filtered data retrieval. When retrieving packet capture data from the unit, you may choose to filter the data downloaded by date and time, by IP address and by MAC address. You may also choose to include packet checksum data and packets with invalid checksums. For additional data management and analytics features, the USC10M2 integrates with our management and analytics server.
The USC10M2 is a versatile, high-performance network appliance and it may be customized to better suit your installation needs. For example, our appliances may be customized to include data capture filters, additional data download filters or specific power input capabilities, among other features. If you have specific installation or performance requirements, please contact us and tell us what you need.
We thought through the security of our products every step of the way, starting with securing the firmware. Along with your USC10M2 you will receive an encrypted key. The first time you power on the unit, the unit will decrypt the key and boot up; at this point you can safely remove the key and as long as the unit remains powered on, the presence of the key is not necessary for operations.
If someone were to get their hands on your key, it would be of no use to them because the key itself is encrypted. Looking at the encrypted contents of the USB key would not tell them anything. If they were to steal the unit without the key, it would also be no use to them because everything on the unit is encrypted.
For many systems, management is the weak point. Not so with IPCopper. We made management effortless, yet secure. How? With your unit you will receive a Windows-based utility (or, if you prefer, you can order a Linux version of the management utility to integrate into your native Linux environment). Just launch the utility, proceed through the menu of choices, answer a few questions and the management utility will establish a dually encrypted secure link to the USC10M2 in a stealthy, yet reliable fashion to download data, check status or change settings.
Even more, you have the option to enable password protection for the admin and user. In the off chance someone unauthorized gets their hands on your utility, it would be worthless to them without knowing the passwords.
At one point, a very determined “bad guy” may decide to smash the unit and remove the hard drives. While this is possible, in the case of IPCopper it is not likely: the USC10M2’s enclosure is 9mm bullet resistant all stainless steel. Getting through the enclosure to the insides would take a lot of hammering (and some noisy power tools). If physical theft is of concern to you, however, we can provide a custom enclosure that you can literally chain and padlock to the floor to hinder physical removal of the unit.
Did we go overboard on security? Some may think so, but at the end of the day, each IPCopper unit is designed to collect and protect your data – your secrets – for the long term.
We built our secure operating system from the ground up, with a focus on data security, speed and accuracy of capture. The proprietary multi-core software powering the USC10M2 runs in parallel directly on the IPCopper hardware.
As a purpose-built data capture engine, the USC10M2’s operating system does not contain any of the extraneous, unwanted functions that lurk in other systems. The weakness in using other operating systems as platforms for packet capture (and other dedicated tasks), is the necessity of eliminating the many unwanted functions in the underlying operating system so that they are not accessible to hackers, without destabilizing the system. This is a formidable task. In the case of IPCopper's OS, we have a purpose-built system, with the purpose of secure, dedicated performance.
The USC10M2 captures packets exactly as they arrive, in their entirety. Just as important are the speed of processing and accuracy of timestamping. Accurate timestamping is fundamental to accurate packet capture, and accurate timestamping is one of the things that sets IPCopper apart. The USC10M2 can capture, relay, encrypt and record a minimum of 6,000,000 packets per second, making it very difficult to overwhelm. While others may operate on a scale of milliseconds, IPCopper OS operates on a nano scale.
The unnecessary overhead generated in other systems results in lost accuracy, skewed timestamping, diminished performance, vulnerabilities, increased heat generation and, ultimately, lost packets. IPCopper’s operating system, on the other hand, is akin to a well-tuned orchestra running in parallel on eight cores. Many tasks take place simultaneously, yet are synchronized in a highly precise fashion to deliver optimal performance and accuracy in a compact, secure and power-efficient package.
Each USC10M2 comes with a secure menu-driven management utility for data retrieval, status checks and settings changes via a straightforward menu-driven, "question and answer" format. The management utility securely establishes communications with the IPCopper unit, using an encrypted connection disguised to appear as innocuous web or network traffic.
Please see the videos below for more information on using the management utility to communicate with the USC10M2 (the videos display the USC10G4 interface, however, the USC10M2 has an identical appearance and operation).
The standard USC10M2 management utility is Windows based, however, you may choose to order a Linux version of the management utility to integrate into your native Linux environment. For more information on utility customizations for Linux environments, please contact us.
For additional data management and data analytics capabilities, the USC10M2 integrates with our management and analytics server.
(though videos display the USC10G4 interface, the USC10M2 has an identical appearance and operation)
IPCopper packet capture appliances may be deployed in a variety of locations around a network. Where you place your unit depends on the type of network traffic you intend to capture.
It is highly recommended that you connect the unit to power via a UPS (uninterruptible power supply) and/or surge protector for protection against power spikes and other fluctuations in the electrical grid.
For more detailed information on installing and booting up the IPCopper USC10M2, please see the USC10M2 product manual.
Error light is illuminated.
Nothing happens when attempting to power up the unit.
For more troubleshooting, please see the USC10M2 product manual.
One year from date of purchase. For more information, see our warranty page or the warranty details on your order form.
3/11/15 — 6 Ways The Sony Hack Changes Everything