IPCopper USC4060 User manual

IPCopper USC4060
Packet Capture Appliance
Product Manual
For firmware versions 2.03 and later

Table of Contents
OVERVIEW .........................................................................................................1
INSTALLATION....................................................................................................2
POWERING THE UNIT ON AND OFF...................................................................4
UNDERSTANDING THE FRONT PANEL ...............................................................6
MANAGING THE OVERWRITE FEATURE .............................................................7
RETRIEVING DATA..............................................................................................8
TROUBLESHOOTING........................................................................................10
WATCHDOG TIMER ..........................................................................................12
INDEX ..............................................................................................................13
SPECIFICATIONS ..............................................................................................14
ADDITIONAL RESOURCES................................................................................14
The following paragraph does not apply to any country where such provisions are inconsistent with
local law: IPCopper, Inc. provides this publication “as is” without warranty of any kind, either express or
implied, including, but not limited to, the implied warranties of merchantability or fitness for a particular
purpose. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore,
this statement may not apply to you.
This publication could include technical inaccuracies or typographical errors. Changes are periodically made to
the information herein; these changes will be incorporated in later editions. Improvements or changes in the
products described may be made at any time.
IPCopper is a trademark of IPCopper, Inc., registered in the United States and/or other countries. Other
trademarks are the property of their respective owners and are used here for reference purposes only.
© IPCopper, Inc. 2013. All rights reserved.
The text of this publication, illustrations, or any part thereof, may not be reproduced or transmitted in any form
or by any means, electronic or mechanical, such as photocopying, recording, storage in an information retrieval
system, or otherwise, without the prior written permission of IPCopper, Inc.
United States government restricted rights
This documentation is provided with restricted rights. Use, duplication or disclosure by the government is
subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data and Computer
Software clause at DFARS 252.227-7013 and in applicable FAR provisions: IPCopper, Inc., Portland, OR 97205.

What’s in the Box
1 IPCopper unit
1 Cat-5e patch cable
1 power cord
1 black USB stick, which is your external key
1 white USB stick, contains the product manual and
IPCD4060 utility

Product Manual IPCopper USC4060 Page 1
Overview
The IPCopper USC4060 is a continuous full packet capture appliance
with 4 TB recording capacity, 1 Gbps peak capture speed and 400 Mbps
minimum sustained capture speed for recording Ethernet / IP traffic. Some of
its key features include:
• Electronic invisibility: The USC4060 uses neither an IP address nor
MAC address. This stealthiness increases the security of the appliance,
while at the same time making installation as easy as connecting a
few cables.
• Continuous recording: WARNING! The USC4060 contains a built-
in functionality that overwrites the oldest data with the
newest. When the USC4060 reaches its 4 TB capacity, it starts over
from the beginning, over-writing the oldest recorded data with the
newest. In this fashion, the USC4060 provides continuous
uninterrupted recording, containing a snapshot of the most recent 4
TB of activity at any given time. The oldest data, once overwritten, is
irrecoverable. For more information on the USC4060’s overwrite
feature, please see page 7.
• No configuration: The appliance is truly plug-and-play. Once
connected and powered up, the unit begins recording all Ethernet / IP
activity that passes through it automatically, with no user intervention.
Additionally, installing the unit on your network will not affect traffic
flow, speed or topology.
• Compact footprint: Weighing less than 5.5lbs and measuring 3” x 9” x
9.25”, the USC4060 is portable and fits tight spaces.
This product manual is for USC4060 units running firmware versions
2.03 and later. If you need the USC4060 product manual for earlier versions
of the firmware, please contact IPCopper support at [e-mail].

Installation
1. Location / Placement
The USC4060 may record the activity of an entire internet connection,
a single computer, a group of computers or other networked equipment. The
placement of the packet capture appliance determines which network traffic
would be recorded.
• To record all traffic that passes through the internet connection, place
the packet capture appliance between the internet source (generally a
modem) and all other equipment.
• To record only the internet or ethernet traffic to and from one
computer or other device, place the packet capture appliance between
that specific piece of equipment and the rest of the network.
• To record only the internet or ethernet traffic to and from a specific
group of computers or other networked equipment, place the packet
capture appliance between the group of computers/devices and the
rest of the network.
2. Connect Ethernet Cables
The USC4060’s two Ethernet ports are located on the front panel of
the unit. The USC4060 may be used as either pass-through (a.k.a. inline) or
on a SPAN/mirror port. By default, the USC4060 is in inline mode. To switch
from inline mode to SPAN mode, please consult the separate instructions that
came in the box for the IPCD4060 utility (use the parameters “-mode inline”
or “-mode span”).
• For PASS-THROUGH/INLINE: Connect one Ethernet cable to one of the
ports on the front of the USC4060. Connect the second Ethernet cable
to the other port. The order in which the ports are connected does not
matter.
• For SPAN/MIRROR: Connect an Ethernet cable from the switch or
router’s SPAN or “mirror” port to the right-hand port (closest to the
Page 2 Product ManualIPCopper USC4060

edge of the front panel). In SPAN mode this port may only receive
traffic, while the left-hand port is the management port* (for status
checks and data retrieval only – no data received on this port would
be recorded).
Each Ethernet port has two lights, one green and one yellow. The
green light, when shining, indicates that the link is up. The yellow light
indicates that the port is operating at gigabit speed.
3. Insert the External Key
Before connecting the USC4060 to power, insert the external key into
the USB slot. The unit will not boot up unless the key is present when the unit
is powered on or re-booted. Please see the next section for information on
powering the appliance on and off.
IMPORTANT! YOU MUST INSERT THE EXTERNAL USB KEY BEFORE
CONNECTING THE US4060 TO AC POWER.
*When the USC4060 is in SPAN mode, you may assign a static IP address
to the management port. This assignation does not create a security
vulnerability as the unit will only respond to communications from its
particular, mated IPCD4060 utility. The appliance allows for any
combination of port numbers, making it easy to configure your firewall
and map ports to the unit’s management port. For instructions on how
to use the command-line utility to configure a static IP address for the
management port, please refer to the utility’s separate instructions
(included in the box with your unit).
Product Manual IPCopper USC4060 Page 3

Page 4 Product ManualIPCopper USC4060
POWERING THE UNIT ON AND OFF
To protect the packet capture appliance from power surges and other
electrical fluctuations, we suggest that you connect the unit to power using a
surge protector or UPS (uninterruptible power supply). Power surges may
damage the USC4060 and/or cause it to malfunction.
Powering up the USC4060
IMPORTANT! YOU MUST INSERT THE EXTERNAL USB KEY BEFORE
CONNECTING THE US4060 TO AC POWER.
The USC4060 powers on when connected to power (i.e., when the
power cable is connected). This allows the unit to power on automatically once
power is restored after an electrical outage. When powering on the USC4060,
please use the following sequence:
1. Insert the external key fully into its slot.
2. Connect the power cable to both the back of the unit and the AC
power source.
DO NOT PRESS THE POWER BUTTON WHILE THE UNIT IS BOOTING UP. The
unit will boot up automatically once connected to AC power. It could take up to
a minute and a half for the USC4060 to boot up. For the first 15 seconds, the
unit checks its internal systems and the lights on the front panel may blink in
a random pattern or shine steady. After that, the unit will turn off all lights on
the front panel except the power light for about 15-20 seconds. Once the unit
becomes fully operational the green REC light will turn on and shine steady
and the Ethernet port lights will illuminate.
If the packet capture appliance does not appear to boot up properly,
check the following:
• Make sure the external USB key is fully inserted into the USB port.
• Connect the packet capture appliance to power via a surge protector
or UPS (uninteruptible power supply).

Product Manual IPCopper USC4060 Page 5
If the red “Error” LED illuminates, press the reset button to reboot
the appliance after first checking that the power and Ethernet cables are fully
connected and the external USB key is fully inserted into the USB port. If the
red error light persists, please turn to the Troubleshooting section for further
suggestions.
Powering down the USC4060
To power down the appliance, press the power/shutdown button, then
wait for the unit to begin blinking the power/shutdown button’s blue light.
Once the blue light is blinking, unplug the power cable.
Pressing the power/shutdown button initiates the following sequence:
1. The REC light begins to blink.
2. The unit ceases passing traffic and flushes all internal caches to
disk, to ensure that all data is saved prior to shutdown.
3. When all data in the cache has been saved, the blue
power/shutdown button light will begin blinking, indicating that it
is safe to unplug the unit from the power source.
Once in shutdown mode, you must unplug the unit from the AC
power source before booting it up again.
IMPORTANT: DO NOT PRESS THE POWER BUTTON WHILE THE UNIT IS
BOOTING UP OR IF THE EXTERNAL USB KEY IS NOT INSERTED IN ITS SLOT
ON THE FRONT PANEL. Instead, wait until the unit is operational before
pressing the power button (indicated by the steady illumination of the REC
light). If you press the power button while the unit is booting up or the
external key is not present, the unit will enter a non-operational state and may
flash all lights every few seconds. To exit this state, insert the external USB key
(if not already in place) and press the power button. The unit will resume
booting up. DO NOT LEAVE THE APPLIANCE IN THIS STATE WITH ALL THE
LIGHTS FLASHING TO AVOID POSSIBLE DAMAGE TO THE UNIT. ANY DAMAGE
RESULTING FROM LEAVING THE APPLIANCE IN THIS STATE IS NOT COVERED
BY THE WARRANTY.

Page 6 Product ManualIPCopper USC4060
Understanding the Front Panel
The front panel of the USC4060 has several LED lights and a small
number of buttons, for use in determining the status of your device and
preparing it to retrieve data. The diagram below outlines what each of these
lights and buttons are, and what they are for.
INDICATOR LIGHTS
• REC: indicates unit is operational and ready to record
• RET: lights up when toggled into retrieve mode; indicates
that unit is in retrieve mode
• COM: lights up when communicating during data retrieval
• FULL: shines red after the initial 4 TB capacity has been
reached and the unit is in overwrite mode
• ERR: indicates an error (see Troubleshooting section)
• HDD: indicates that hard drive is engaged
KEY
POWER/SHUTDOWN BUTTON
RETRIEVE BUTTON
RESET BUTTON
press to reboot
ETHERNET PORTS
• GREEN: indicates link is up
• YELLOW: indicates port is operating at gigabit speed

Product Manual IPCopper USC4060 Page 7
Managing the Overwrite Feature
The USC4060 features continuous loop storage and, after the unit
reaches capacity, overwrites the oldest captured data with the newest. When
this occurs, the overwritten data become irrecoverable. To avoid losing
important data, it is advisable to take precautionary steps, such as
downloading data from the unit on a regular basis.
Initially the USC4060’s “FULL” light will be off, indicating that the
appliances has not yet begun overwriting any data. Once the unit reaches its 4
TB capacity, the red “FULL” light will illuminate and remain illuminated as a
reminder that the oldest data is being overwritten.
If you require a packet capture model that does not have this
overwrite feature and permanently records the captured data, we have
forensic-class models available, such as the USC1030 and USC2030.
Alternatively, you may use the USC4060 in conjunction with one of our
forensic-class models, with placement so that the forensic model captures the
data streams you wish to record permanently and the USC4060 captures other
data streams that you wish to record temporarily.