Capture Architecture

Overview

FMADIO Capture systems operate in a unique “capture everything” ask questions later mode of operation. The general flow of data is shown in the diagram below

In the above diagram we have

Capture Ports

These are the physical capture interfaces where the cables are plugged in.

FMADIO FPGA

Using FMADIO internally developed capture FPGA card, converts the physical capture ports data into PCAP like internal format.

This FPGA merges all capture interfaces into a single data stream going to the storage Capture Storage FIFO

Capture Storage FIFO

This is the primary capture storage location, its capacity ranges from 1TB to 1PB+ with the storage capacity on physical SSD drives.

It should be noted the capture storage is effectively a very large (e.g. 1PB) FIFO. Think of it as a capture cache where system software can process the captured data without fear of dropping data.

PCAP Analyze

This is packet analysis software running on the capture system ingesting and processing the data from the storage array

PCAP Push

Process running on the capture system to filter, split, compress and egress data off the system in native PCAP format.

PCAP Download

Typically adhoc troubleshooting functionality to extract PCAPs when needed.

There are many more ways to process the incoming data, the above PCAP* are some common example usage.

Capture Storage FIFO

It should be clear the Capture Storage is not a regular linux file system, but a highly optimized and custom file system developed by FMADIO. We have spent significant development time building a highly performant and optimized IO architecture to maximize the capture rate possible.

When a packet first arrived and written to the storage, its written in the first available slot (t + 0) as shown below

Then additional packets are written sequentially into the storage as shown below, for example at (t + 4)

When the capture nears the end of the storage,  at packet (t + 1000) it writes it at the end of the storage array, as shown below.

For the next packet (t + 1001), the system overwrites the oldest written packet on the storage system. In this case Packet (t+0) is overwritten by packet (t+1001) as shown below.

Then the system continues overwriting the oldset packet on the system, with the newest data.

This continues forever as the capture system continues to capture and process incoming data.