2 x 10GBASE-SR ports / 4 x GbE ports / 48 TB / 10 Gbps peak capture speed / 8 Gbps minimum sustained capture speed / 6 million packets per second.
Redundant power inputs: standard AC, 12V SLA battery & general purpose 12V DC.
Continuous packet capture with bypass (failover passthrough) and GPS time synchronization.
Inline capture and dedicated SPAN/mirror port modes; retrieve data by date/time and/or IP/MAC address.
Full packet capture with timestamps: all headers and payloads, including FCS/CRC.
10-Gbps fiber network appliance with redundant power capabilities captures raw network data for full network monitoring and visibility. 48TB storage for longer data retention, useful for investigating, diagnosing and troubleshooting network incidents and issues. Integrates with IPCopper's management and analytics server.
The USC10M3 brings practical and affordable power redundancy to 10G packet capture. The USC10M3 features 48TB storage, 8Gbps sustained / 10Gbps peak capture speeds, 6,000,000 packets per second packet rate plus redundant power hookups: standard AC, 12V SLA battery and 12V general DC for continuous. Power redundancy enables 24/7 network monitoring, even in the event of power outages, while GPS time synchronization delivers highly accurate timestamping and automatic / manual bypass increases deployment options without adding points of failure to the network.
The USC10M3's dedicated 100% packet capture provides busy IT teams with the accurate and timestamped information they need for cybersecurity, network monitoring and other data-driven tasks, without introducing latency, reordering packets or otherwise altering the data. The appliances further provides versatility with its pair of 10GBASE-SR fiber ports and four 1GbE copper ports, allowing the interfacing of both 10G fiber and 1G copper networks. With installation as simple as connecting cables and powering up and management via a straightforward, menu-driven utility, the USC10M3 handily fulfills infosec professionals' needs for high-performance, easy to use data capture and monitoring tools with large storage.
High-performance, full packet capture provides the basis for quality data analysis, whether for cybersecurity, network auditing and other purposes. It’s essential both for post-security incident forensics and network diagnostics. The USC10M3 gives you the full picture, capturing every packet, both header and payload, precisely timestamped in the exact order received, with the additional benefits of bypass and power redundancy.
Truly operational out of the box, no configuration is required to begin capturing packets — simply connect a few cables, power the unit up and you are ready to go. Installing the USC10M3 requires no changes to your network topology. Two 10GBASE-SR ports and four 1-GbE ports give you the flexibility to meet any number of installation needs. Key features include:
The USC10M3 is a dedicated, purpose-built packet-capture appliance with high performance and large storage, the first block for building a data-driven monitoring fabric for anomaly detection, network optimization and forensic investigation. For additional data management and analytics features, the USC10M3 integrates with our management and analytics server.
The USC10M3 is a versatile and flexible network appliance, allowing it to be installed practically anywhere on a network, either inline or to a SPAN port. If you have specific installation or performance requirements, please contact us and tell us what you need. For example, our appliances may be customized to include data capture filters, additional data download filters or specific power input capabilities.
*How we tested the USC10M3's speed: We conducted two tests, using a separate IPCopper unit to create a sampling of 2 billion UDP packets with 64-byte payloads. For the first test the unit was in inline mode (both receiving and sending). We observed that the packets were received by the test unit, correctly sequenced, and subsequent analysis of the captured data showed that the packets were encrypted, indexed and stored in the correct sequence. For the second test, the unit was placed in SPAN/mirror mode (receiving only). With both tests we observed zero errors and also observed that the count of good packets matched the total number of packets sent.
The USC10M3's redundant power capabilities allow the connection of up to three power inputs, standard AC, 12V SLA (sealed lead-acid) battery, and general purpose 12V DC, which reduces costs and simplifies maintenance by removing the need for separate, bulky UPS power backups. The USC10M3's power redundancy options reduce the overall installation footprint, while at the same time increasing the the operational time period in the event of a power outage.
When using traditional UPSes the electrical current is taken through several AC/DC conversions, with power loss and heat generation a result of each conversion. With the USC10M3 you can instead connect compact 12V SLA batteries, which are both affordable and widely available, to provide up to hours of hold time in the event of a power outage (compared to the mere minutes-long hold time achieved by most UPSes on comparable equipment).
In the event of a prolonged power outage, a second DC input allows you to swap batteries without interrupting the USC10M3's operations.
The USC10M3 features bypass, available both on demand and as a failover passthrough in case of power loss or other malfunction. In effect, if the USC10M3 experiences a problem, it automatically removes itself from the network without any user effort required and without any damaging disruption to network operations.
Bypass gives you great flexibility. You can deploy the USC10M3 on critical links where you need 24/7 or only occasional visibility, yet be assured that you are not adding an additional possible point of failure. If the appliance fails or unexpectedly loses power, bypass automatically engages and the network will continue humming. At worst, the unit won’t be able to capture anything, but it won’t bring a screeching halt to network traffic.
Utilizing bypass on demand, you can place the USC10M3 at any network location you wish to monitor in the future, or only monitor intermittently, on a schedule that is convenient for you. Simply manually enable and disable bypass mode through the management utility as needed.
In the case of loss of power, bypass kicks in practically instantaneously, allowing the USC10M3 to pass network traffic even when it is OFF. In the event the unit malfunctions, a watchdog timer ensures that the inline port pairs switch over into bypass mode to prevent network interruptions. Depending on the particular packets passing through at the time, it may take one to six seconds for the switch to take effect after a malfunction – ranging from unnoticeable to little more than a hiccup.
The USC10M3 incorporates a very accurate GPS-powered time synchronization system combined with a high accuracy, low-drift clock that timestamps packets at a resolution of 1/10,000,000 of a second. Accurate time is important when examining packet capture data or reconstructing network events forensically, therefore, it is important to know exactly when a packet arrived – not simply within a minute or two.
GPS time synchronization is fully automatic. Connect the external antenna at installation and at boot up the unit will synchronize its time with broadcast GPS time. If GPS time synchronization is not desired, simply disable it for one boot cycle or permanently.
In our tests of a live IPCopper unit with this high accuracy clock, after twenty weeks (without GPS time synchronization) the clock was off by less than 1½ seconds. That is equivalent to a drift of 0.125 of a second for every 1,000,000 seconds. For the most accurate timestamps, however, the best strategy is to allow the IPCopper unit to resynchronize with GPS time at regular intervals and avoid deviations over time.
The USC10M3 features 48 TB of continuous-loop data storage. After the unit reaches its 48 TB capacity, it "rolls over" and overwrites the oldest captured data with the newest. At any given time, the unit will contain the most recent 48 TB of captured network activity.
The USC10M3 indexes the packet data as it captures it, enabling speedier data retrieval and filtered data retrieval. When retrieving packet capture data from the unit, you may choose to filter the data downloaded by date and time, by IP address and by MAC address. You may also choose to include packet checksum data and packets with invalid checksums. For additional data management and analytics features, the USC10M3 integrates with our management and analytics server.
The USC10M3 is a versatile, high-performance network appliance and it may be customized to better suit your installation needs. For example, our appliances may be customized to include data capture filters, additional data download filters or specific power input capabilities, among other features. If you have specific installation or performance requirements, please contact us and tell us what you need.
We thought through the security of our products every step of the way, starting with securing the firmware. Along with your USC10M3 you will receive an encrypted key. The first time you power on the unit, the unit will decrypt the key and boot up; at this point you can safely remove the key and as long as the unit remains powered on, the presence of the key is not necessary for operations.
If someone were to get their hands on your key, it would be of no use to them because the key itself is encrypted. Looking at the encrypted contents of the USB key would not tell them anything. If they were to steal the unit without the key, it would also be no use to them because everything on the unit is encrypted.
For many systems, management is the weak point. Not so with IPCopper. We made management effortless, yet secure. How? With your unit you will receive a Windows-based utility (or, if you prefer, you can order a Linux version of the management utility to integrate into your native Linux environment). Just launch the utility, proceed through the menu of choices, answer a few questions and the management utility will establish a dually encrypted secure link to the USC10M3 in a stealthy, yet reliable fashion to download data, check status or change settings.
Even more, you have the option to enable password protection for the admin and user. In the off chance someone unauthorized gets their hands on your utility, it would be worthless to them without knowing the passwords.
At one point, a very determined “bad guy” may decide to smash the unit and remove the hard drives. While this is possible, in the case of IPCopper it is not likely: the USC10M3’s enclosure is constructed of heavy-gauge metal. Getting through the enclosure to the insides would take a lot of hammering (and some noisy power tools). If physical theft is of concern to you, however, we can provide a custom enclosure that you can literally chain and padlock to the floor to hinder physical removal of the unit.
Did we go overboard on security? Some may think so, but at the end of the day, each IPCopper unit is designed to collect and protect your data – your secrets – for the long term.
We built our secure operating system from the ground up, with a focus on data security, speed and accuracy of capture. The proprietary multi-core software powering the USC10M3 runs in parallel directly on the IPCopper hardware.
As a purpose-built data capture engine, the USC10M3’s operating system does not contain any of the extraneous, unwanted functions that lurk in other systems. The weakness in using other operating systems as platforms for packet capture (and other dedicated tasks), is the necessity of eliminating the many unwanted functions in the underlying operating system so that they are not accessible to hackers, without destabilizing the system. This is a formidable task. In the case of IPCopper's OS, we have a purpose-built system, with the purpose of secure, dedicated performance.
The USC10M3 captures packets exactly as they arrive, in their entirety. Just as important are the speed of processing and accuracy of timestamping. Accurate timestamping is fundamental to accurate packet capture, and accurate timestamping is one of the things that sets IPCopper apart. The USC10M3 can capture, relay, encrypt and record a minimum of 6,000,000 packets per second, making it very difficult to overwhelm. While others may operate on a scale of milliseconds, IPCopper OS operates on a nano scale.
The unnecessary overhead generated in other systems results in lost accuracy, skewed timestamping, diminished performance, vulnerabilities, increased heat generation and, ultimately, lost packets. IPCopper’s operating system, on the other hand, is akin to a well-tuned orchestra running in parallel on eight cores. Many tasks take place simultaneously, yet are synchronized in a highly precise fashion to deliver optimal performance and accuracy in a compact, secure and power-efficient package.
Each USC10M3 comes with a secure menu-driven management utility for data retrieval, status checks and settings changes via a straightforward menu-driven, "question and answer" format. The management utility securely establishes communications with the IPCopper unit, using an encrypted connection disguised to appear as innocuous web or network traffic.
Please see the videos below for more information on using the management utility to communicate with the USC10M3 (the videos display the USC10G4 interface, however, the USC10M3 utility has an identical appearance and operation).
The standard USC10M3 management utility is Windows based, however, you may choose to order a Linux version of the management utility to integrate into your native Linux environment. For more information on utility customizations for Linux environments, please contact us.
For additional data management and data analytics capabilities, the USC10M3 integrates with our management and analytics server.
(though videos display the USC10G4 interface, the USC10M3 has an identical appearance and operation)
IPCopper packet capture appliances may be deployed in a variety of locations around a network. Where you place your unit depends on the type of network traffic you intend to capture.
It is highly recommended that you connect the unit to power via a UPS (uninterruptible power supply) and/or surge protector for protection against power spikes and other fluctuations in the electrical grid.
For more detailed information on installing and booting up the IPCopper USC10M3, please see the USC10M3 product manual.
Error light is illuminated.
Nothing happens when attempting to power up the unit.
One year from date of purchase. For more information, see our warranty page or the warranty details on your order form.
3/11/15 — 6 Ways The Sony Hack Changes Everything