IPCopper USC10G4 User manual

IPCopper.com
Product Manual
USC10G4
10G Packet Capture Appliance
with Bypass and GPS
Firmware Version 2.07

The information in this product manual has been carefully reviewed and is believed to be
accurate. This publication could include technical inaccuracies or typographical errors.
Changes are periodically made to the information herein; these changes will be incorporated
in later editions. Improvements or changes in the products described may be made at any
time. IPCopper, Inc. makes no commitment to update or to keep current the information in
this manual, or to notify any person or organization of the updates. For the most up-to-date
version of this manual, please see our website at www.ipcopper.com.
IPCopper, Inc. reserves the right to make changes to the product described in this manual at
any time and without notice.
The following paragraph does not apply to any country where such provisions are
inconsistent with local law: IPCopper, Inc. provides this publication “as is” without
warranty of any kind, either express or implied, including, but not limited to, the implied
warranties of merchantability or fitness for a particular purpose. Some states do not allow
disclaimer of express or implied warranties in certain transactions, therefore, this statement
may not apply to you.
IPCopper is a trademark of IPCopper, Inc., registered in the United States and/or other
countries. Other trademarks are the property of their respective owners and are used here for
reference purposes only.
The text of this publication, illustrations, or any part thereof, may not be reproduced or
transmitted in any form or by any means, electronic or mechanical, such as photocopying,
recording, storage in an information retrieval system, or otherwise, without the prior written
permission of IPCopper, Inc.
United States government restricted rights
This documentation is provided with restricted rights. Use, duplication or disclosure by the
government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in
Technical Data and Computer Software clause at DFARS 252.227-7013 and in applicable FAR
provisions: IPCopper, Inc., Portland, OR 97223.
Manual Revision: 1.1
Release Date: December 31, 2014
© IPCopper, Inc. 2015. All rights reserved.
ii IPCopper USC10G4 Product Manual

Table of Contents
INTRODUCTION ..........................................................................................................................5
Product Description............................................................................................................5
Security Features ................................................................................................................5
Specifications......................................................................................................................6
Checklist: In the Box ..........................................................................................................7
INSTALLATION.............................................................................................................................8
General installation ............................................................................................................8
Inline vs. SPAN Deployment................................................................................................9
Placement / Where to Deploy ...........................................................................................10
Deploying the USC10G4 at a Remote Location .................................................................10
Deployment Scenarios......................................................................................................11
UNDERSTANDING THE FRONT PANEL ......................................................................................13
SHUTDOWN SEQUENCE............................................................................................................15
Standard Shutdown Sequence..........................................................................................15
Reboot Shutdown Sequence .............................................................................................15
CAPTURE AND RECORD SPEEDS ..............................................................................................16
Peak and Minimum Sustained Speeds .............................................................................16
Factors that Affect Performance........................................................................................16
CTRL Marker and Performance ........................................................................................16
GPS TIME SYNCHRONIZATION..................................................................................................17
Antenna Placement and Specifications.............................................................................17
Stages of GPS Time Synchronization.................................................................................18
FastGPS Option.................................................................................................................19
Aborting/Disabling GPS Time Synchronization .................................................................19
ETHERNET PORT MODES.........................................................................................................21
Overview...........................................................................................................................21
Inline Mode ......................................................................................................................21
SPAN/Mirror Mode............................................................................................................21
Bypass Mode.....................................................................................................................22
Management Mode...........................................................................................................22
OTHER FEATURES AND FUNCTIONS.........................................................................................23
Retrieving Data / Retrieve Mode........................................................................................23
Continuous Loop Storage (Overwrite) ..............................................................................23
Flow Control .....................................................................................................................24
Auto-Negotiation (Port Speed)..........................................................................................24
Power Button Settings.......................................................................................................24
IPCopper USC10G4 Product Manual iii

MANAGEMENT UTILITY.............................................................................................................25
Overview...........................................................................................................................25
How the Utility Communicates with the Unit....................................................................25
Installing and Launching the Utility..................................................................................26
Selecting an IP Address for Accessing the Unit .................................................................27
Accessing IPCopper from a Remote Location ...................................................................29
Admin and User Passwords ..............................................................................................30
Changing Passwords .........................................................................................................31
Status Page .......................................................................................................................31
Changing Settings .............................................................................................................34
Downloading Data ............................................................................................................36
Tips for Retrieving Data ....................................................................................................38
TROUBLESHOOTING.................................................................................................................41
POWER SUPPLY FUSE ...............................................................................................................44
ADDITIONAL RESOURCES.........................................................................................................45
CONTACT INFORMATION...........................................................................................................45
iv IPCopper USC10G4 Product Manual

Introduction
PRODUCT DESCRIPTION
The IPCopper USC10G4 is a standalone full packet capture appliance with 2 x
10GBASE-SR fiber optic ports, 4 x GbE ports and 24 TB storage.
Key features include:
• True bypass: In case of power loss or malfunction the USC10G4’s
ports switch into bypass mode to minimize network disruption.
Bypass may also be manually engaged and disengaged through the
management utility.
• GPS time synchronization: At bootup, the USC10G4 synchronizes to
the broadcast GPS time for high-accuracy timestamping and indexing.
• Continuous-loop storage: WARNING! The USC10G4 contains a built-in
functionality that overwrites the oldest data with the newest. When
the USC10G4 reaches its 24 TB capacity, it starts over from the
beginning, overwriting the oldest recorded data with the newest. The
oldest data, once overwritten, is irrecoverable. The data stored on the
unit will always be the most recently captured 24 TB of network
activity.
SECURITY FEATURES
!Electronic invisibility: For its packet capture operations the USC10G4
uses neither an IP address nor a MAC address. This stealthiness
increases the security of the appliance, while at the same time making
installation as easy as connecting a few cables.
!Removable key: Unit will not boot up without the key.
!20,000-bit dual encryption.
!Sealed all-metal, high-strength, tamperproof stainless steel enclosure.
!Encrypted access via management utility.
!Physical access control: Enable/disable retrieve mode via front panel
button.
IPCopper USC10G4 Product Manual 5

SPECIFICATIONS
6 IPCopper USC10G4 Product Manual
Interface
2 x 10GBASE-SR
4 x 1-GbE
Capacity
#24 TB
#continuous-loop storage
Bypass
Automatic and manual
#Automatically engages with loss of power
#For more information see page 22
Capture & Record Speeds
#Peak: 10 Gbps
#Minimum Sustained: Gbps @ 6
million packets / second
5
#For more information see page 16
Data Output Format
PCAP
Encryption
#Dual
#20,000-bit key
GPS Time Synchronization
Available
#Via removable, external antenna
#Manual enable/disable
#For more information see page 17
Power Supply
90 ~ 264 VAC, 47 Hz ~ 63 Hz
Environmental
Storage temperature: -20 °C to +70 °C
Operating temperature: 0 °C to +30 °C*
Dimensions
#19 in x 3.5 in x 14 in
#34 lbs
Other
#
#Jumbo frames supported up to 9 KB
Flow control supported
* The USC10G4 may operate at slightly higher temperatures, however, care must be taken to ensure that there is
at least one foot of unobstructed air space in front of the vents, to avoid the possible backflow of exhausted air
into the unit. If placed in a cabinet, the cabinet must be ventilated.

IN THE BOX
1 - USC10G4 packet capture appliance
1 - GPS antenna
1 - Power cord
1 - USB stick, white (contains management utility)
1 - USB stick, black (contains key)*
* IMPORTANT! DO NOT INSERT THE BLACK USB KEY INTO A COMPUTER
OR ANY DEVICE OTHER THAN THE USC10G4 WITH WHICH IT CAME.
DOING SO MAY DAMAGE THE KEY AND RENDER IT NONFUNCTIONAL.
IPCopper USC10G4 Product Manual 7

Installation
GENERAL INSTALLATION
1. Connect the fiber and/or USB cables.
?If using inline, traffic feeding into port 1 will exit out port 2 and vice
versa. Likewise, traffic feeding into port 3 will exit out port 4, traffic
feeding into port 5 will exit out port 6 and vice versa.
?If using a SPAN/mirror port, connect to any port (of appropriate speed /
type) for information on using the management
utility to switch ports into dedicated SPAN mode.
?Alignment is important when inserting the fiber connectors into the
fiber ports. Depending on the cable, the duplex retention bracket could
skew the positioning of the optics if care is not taken to align the
connectors properly when attaching the fiber cables.
2. Firmly insert the black USB key.
?Use the black USB key that came in the box with the unit. This key will
only work with the unit with which it came and cannot be used with
any other IPCopper device. Do not insert this black USB key into any
other equipment as this may cause it to malfunction.
3. Connect the power cable and flip the back power switch ON.
>Once the power switch in back is flipped to the ON position, the unit
will power on and begin booting up automatically. The first stage of the
boot up process is self diagnostics, which takes about 5-20 seconds.
>
>During bootup, the USC10G4 receives signals from at least three GPS
satellites and synchronizes its clock to the broadcast GPS time. During
this synchronization process, the green GPS light blinks with increasing
frequency as time synchronization progresses. Depending on the
reception strength, it may take up to half an hour for the unit to
synchronize (for more information see page 18)
. Please see page 34
During bootup, the red KEY light will illuminate and the COM light will
blink, indicating that the unit is communicating with the key. After the
unit establishes that it is the correct key, the green KEY light will
illuminate and the unit will proceed to the next stage. This process
takes about 5-30 seconds.
.
8 IPCopper USC10G4 Product Manual

>To skip GPS time synchronization, press the RET button one time while
the GPS light is blinking. GPS time synchronization may also be
disabled through the management utility ( .
If the error light illuminates, see the troubleshooting section
INLINE VS. SPAN DEPLOYMENT
There are two methods for capturing data, either inline on the wire or via a
router or switch’s SPAN / mirror port. Since the USC10G4 has multiple ports, a
combination of inline and SPAN modes may also be employed. For more
information on the USC10G4’s port modes, please s
Setting up the USC10G4 inline on the wire is simple, involving the connection
of either two or four or six cables (for capturing traffic on one, two or three
routes). When used inline, port 1 corresponds to port 2, port 3 to port 4 and
port 5 to port 6. The biggest advantage of inline mode is the higher accuracy of
recording: no intervening equipment stands between the USC10G4 and the
raw traffic and the unit is able to capture and timestamp the data exactly as it
traverses the wire. Another benefit is that it allows the unit to act as a buffer for
other networking equipment, should traffic spike.
SPAN mode allows the recording of up to six networks or network routes on
one USC10G4. The drawback of using SPAN mode is that it relies on the
performance of the equipment mirroring the traffic (oftentimes a switch or a
router with a SPAN port) and therefore introduces uncertainty as to the
accuracy of the captured activity. The intervening equipment may re-order or
drop packets; when using SPAN/mirror ports, it is quite possible to have a
packet traverse the switch or router, but not be mirrored and pass out through
the SPAN port. Having intervening equipment between the packet capture
appliance and the source of the network traffic also introduces a delay in the
packets reaching the unit, resulting in inaccurate timestamping.
Lastly, you may also have a situation where the router or switch is attempting
see page 19)
Once the unit is operational and recording, the green REC illuminates. At this
point the key has been loaded into the unit’s temporary memory and you may
choose to remove the key or leave it in place. If you choose to remove the key,
it is advisable that the unit be connected to a UPS; if the unit loses power, it
will not be able to boot up again until the key is re-inserted.
on page 41.
ee page 21.
IPCopper USC10G4 Product Manual 9

10 IPCopper USC10G4 Product Manual
to feed data in excess of 10 Gbps through its SPAN/mirror port, since the traffic
sent out through the SPAN/mirror port is an aggregate of all the traffic received
and sent by the router/switch in both directions. Under peak loads, the
switch/router may drop packets intended for the SPAN/mirror port should the
traffic volume overwhelm the switch/router’s buffer.
PLACEMENT / WHERE TO DEPLOY
The USC10G4’s six ports and user-selectable port modes provide flexibility and
versatility when it comes to deployment. The unit may be used to monitor
from one to six separate networks or network segments. The USC10G4 may be
placed anywhere on a network, either at the perimeter, the core or points in
between; it requires no additional equipment to connect when used in inline
mode, since it acts as its own network tap.
The USC10G4 captures all of the traffic that passes through it. Please note,
however, that if a DHCP/NAT server (which is frequently built into consumer
firewalls and routers) stands between the unit and the rest of the network or a
portion of the network, the DHCP/NAT server device will mask the MAC
addresses and local IP addresses of the equipment on the other side of it. If
the MAC addresses and local IP addresses are needed, it would be necessary to
deploy an additional packet capture appliance on the other side of the
DHCP/NAT server device (for example, the DHCP/NAT server device connects to
the packet capture appliance, which in turn connects to a switch; the other
networked equipment/end-users would connect to the switch).
Depending on the size of your network and the type and granularity of the
monitoring/recording required, if possible we recommend deploying multiple
packet capture appliances throughout, precisely to capture the additional
information that DHCP/NAT devices mask, as well as internal communications
between computers and other devices on the network that would never make it
out through the internet connection.
DEPLOYING THE USC10G4 AT A REMOTE LOCATION
If you intend to deploy the USC10G4 at a separate location and will be
accessing it remotely, you may need to open UDP and TCP/IP ports on the
firewall at the USC10G4’s location (and possibly on any routers in between the