---
title: "Capture Architecture"
slug: "fmadio-os-capture-architecture"
updated: 2025-06-10T21:03:52Z
published: 2025-06-10T21:03:52Z
canonical: "docs.fmad.io/fmadio-os-capture-architecture"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fmad.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Capture Architecture

## Overview

FMADIO Capture systems operate in a unique “capture everything” ask questions later mode of operation.

The general flow of data is shown in the diagram below:

![](https://cdn.document360.io/b9aab0c4-36d0-4616-9673-30b661455571/Images/Documentation/Capture Architecture.drawio (8).png?sv=2026-02-06&spr=https&st=2026-11-13T19%3A10%3A31Z&se=2026-11-13T20%3A10%3A31Z&sr=c&sp=r&sig=iCM4snAW6mGA%2Bafq899RmPRCybpGlLIV2U5pz3%2FRyvE%3D)

### Capture Ports

These are the physical capture interfaces where the cables are plugged in.

### FMADIO FPGA

Using FMADIO internally developed capture FPGA card, converts the physical capture ports data into PCAP like internal format.

This FPGA merges all capture interfaces into a single data stream going to the storage Capture Storage FIFO.

### Pre-capture Ingress Filter

Onboard the FPGA has a 16 simple pre-capture filter rules. These can be configured in an ACL with IP host, port, VLAN, MPLS tags to filter out unwanted traffic.

This can also configure packet slicing, both all packets or conditionally based on a filter to reduce packet size to 64B, 128B, 192B to capture headers only.

### Capture Storage FIFO

This is the primary capture storage location, its capacity ranges from 1TB to 1PB+ with the storage capacity on physical SSD drives.

It should be noted the capture storage is effectively a very large (e.g. 1PB) FIFO. Think of it as a capture cache where system software can process the captured data without fear of dropping data.

### PCAP Data

There is a range of ways to egress PCAP data off the system, below are some examples.

#### PCAP Analyze

This is packet analysis software running on the capture system ingesting and processing the data from the storage array.

#### PCAP Push

Process running on the capture system to filter, split, compress and egress data off the system in native PCAP format.

#### PCAP Download

Typically ad-hoc troubleshooting functionality to extract PCAPs when needed.

There are many more ways to process the incoming data, the above PCAP* are some common example usage.

---

## Capture Storage FIFO

The FMADIO Capture Storage is not a regular linux file system, but a highly optimized and custom file system developed by FMADIO. We have spent significant development time building a highly performant and optimized IO architecture to maximize sustained capture rates.

When a packet first arrived and written to the storage, its written in the first available slot (t + 0) as shown below.

![](https://cdn.document360.io/b9aab0c4-36d0-4616-9673-30b661455571/Images/Documentation/Capture Architecture.drawio (4).png?sv=2026-02-06&spr=https&st=2026-11-13T19%3A10%3A31Z&se=2026-11-13T20%3A10%3A31Z&sr=c&sp=r&sig=iCM4snAW6mGA%2Bafq899RmPRCybpGlLIV2U5pz3%2FRyvE%3D)

Then additional packets are written sequentially into the storage as shown below, for example at (t + 4).

![](https://cdn.document360.io/b9aab0c4-36d0-4616-9673-30b661455571/Images/Documentation/Capture Architecture.drawio (2).png?sv=2026-02-06&spr=https&st=2026-11-13T19%3A10%3A31Z&se=2026-11-13T20%3A10%3A31Z&sr=c&sp=r&sig=iCM4snAW6mGA%2Bafq899RmPRCybpGlLIV2U5pz3%2FRyvE%3D)

When the capture nears the end of the storage, at packet (t + 1000) it writes it at the end of the storage array, as shown below.

![](https://cdn.document360.io/b9aab0c4-36d0-4616-9673-30b661455571/Images/Documentation/Capture Architecture.drawio (3).png?sv=2026-02-06&spr=https&st=2026-11-13T19%3A10%3A31Z&se=2026-11-13T20%3A10%3A31Z&sr=c&sp=r&sig=iCM4snAW6mGA%2Bafq899RmPRCybpGlLIV2U5pz3%2FRyvE%3D)

For the next packet (t + 1001), the system overwrites the oldest written packet on the storage system. In this case Packet (t+0) is overwritten by packet (t+1001) as shown below.

![](https://cdn.document360.io/b9aab0c4-36d0-4616-9673-30b661455571/Images/Documentation/Capture Architecture.drawio (5).png?sv=2026-02-06&spr=https&st=2026-11-13T19%3A10%3A31Z&se=2026-11-13T20%3A10%3A31Z&sr=c&sp=r&sig=iCM4snAW6mGA%2Bafq899RmPRCybpGlLIV2U5pz3%2FRyvE%3D)

Then the system continues overwriting the oldset packet on the system, with the newest data.

![](https://cdn.document360.io/b9aab0c4-36d0-4616-9673-30b661455571/Images/Documentation/Capture Architecture.drawio (6).png?sv=2026-02-06&spr=https&st=2026-11-13T19%3A10%3A31Z&se=2026-11-13T20%3A10%3A31Z&sr=c&sp=r&sig=iCM4snAW6mGA%2Bafq899RmPRCybpGlLIV2U5pz3%2FRyvE%3D)

This continues forever as the capture system continues to capture and process incoming data.