ProfiTap ProfiShark 10G User manual

1

2
Package contents
•1 x ProfiShark 10G main unit
•1 x USB key containing drivers,
software and manual
•1 x USB 3.0 cable
•1 x Carrying pouch
For any questions, technical or otherwise,
contact our customer support
through our website:
or by email:
For the latest documentation and software,
visit our Resource Center:

3
Table of contents
4 General Information
5 ProfiShark 10G Visual Description
6 ProfiShark Manager and Driver
Installation
7 Analyzer Installation
8 ProfiShark 10G Manager:
8-Counters — Traffic statistics
9-SFP Modules — Port diagnostic
and control
10 -Filters — Hardware filters and DPI
10 -Features — Capture options and
unit information
14 -Capture — Direct capture to disk
15 -Direct Capture Setup
16 Packet Capture:
19 -Live Capture Mode
20 -Timestamping
21 Additional Information

4
General Information
The ProfiShark 10G is a portable fiber optic TAP and
troubleshooter, and provides visibility into 10G fiber optic
networks. It accepts two SFP+ modules (SR, LR, ER), and sends
the incoming traffic to a USB 3.0 output.
The ProfiShark 10G can be set to either SPAN or In-Line mode.
SPAN mode receives traffic from any connected SFP+ modules,
while In-Line mode receives and transmits traffic between both
ports.
The ProfiShark 10G captures packets of all sizes and types,
and provides real time traffic statistics, SFP+ module and fiber
information, and various traffic capture settings and options. It
also incorporates hardware filters, deep packet inspection, and
packet slicing.
Features
- 10G fiber monitoring on USB 3.0
- USB 3.0 powered, no adapter required
- Hardware aggregation
- SPAN and In-Line modes
- Capture any type of frames
- Hardware filtering, deep packet inspection
- Packet slicing
- 8 ns hardware timestamping for accurate latency testing
- Customizable real time statistics
- In-depth network port diagnostic
- Low level error and bandwidth monitoring
- Direct capture to disk
- Invisible to the network
- Lightweight and highly portable build
- Quick setup and easy to use

5
ProfiShark 1G Visual Description
1- Port A (SFP+) connected to the network
2- Port B (SFP+) connected to the network
3- Power indicator LED
4- USB 3.0 connector linked to your monitoring device
(i.e. a laptop computer)
5- Optional DC input (5V/1A)
6– 7– 8– 9– The SFP+ or network status is displayed on the
front LEDs.
SFP+ and network status:
Orange
Green
steady
Green
slow blink
Green
fast blink
A RX
or
B RX
-
SPAN mode,
link established
-
SPAN mode,
link activity
A RX+TX
and
B RX+TX
No SFP
In-line mode,
link established
No link
In-line mode,
link activity
A RX+TX
or
B RX+TX
No SFP
-
No link
-

6
ProfiShark Manager and Driver Installation
Windows
The ProfiShark Manager and ProfiShark drivers for Windows
are available for Windows 7, 8, and 10, 32/64 bits. They are
combined in the same package.
To install the ProfiShark Manager and Drivers, execute the
setup utility located in the “Windows” folder of the USB flash
drive. Please make sure any previous version of the ProfiShark
Manager has been uninstalled before starting the setup utility.
The setup utility will create a launch icon in your start menu.
The ProfiShark drivers should install when a ProfiShark unit
is connected to the computer, during or after the ProfiShark
Manager installation.
For a manual installation, the drivers can be found in the
default installation folder:
C:\Program Files (x86)\Profitap\ProfiShark Manager\Driver\PT3
If the ProfiShark unit doesn’t appear in the list of network
devices, the list may be refreshed using the following
command lines in a cmd.exe window:
- net stop npf
- net start npf
The latest software releases can be found in the Profitap
Resource Center, at:
http://www.profitap.com/resource-center/
Linux
To install the ProfiShark Manager and Drivers on Linux, follow
the instructions in the Installation.txt file located on the USB
flash drive.

7
Analyzer Installation
Any of the compatible analyzers can be used to perform the
analysis. Compatible analyzers are listed on the ProfiShark 10G
product page at: www.profitap.com/profishark-10g
Wireshark is recommended and can be downloaded at:
www.wireshark.org
To start capturing network data, launch your preferred network
analyzer and select the ProfiShark network interface. Refer to
your analyzer’s user manual to learn more about how to select
a network interface.
ProfiShark Manager
ProfiShark Manager is an application developped by Profitap,
designed for use in parallel with traffic analyzers (Wireshark,
ClearSight, …).
ProfiShark Manager adapts its interface to the connected
ProfiShark unit model. If multiple ProfiShark units are
connected, ProfiShark Manager adapts to the unit whose MAC
address is selected at the top right corner of the ProfiShark
Manager window.
The ProfiShark 10G version provides:
- configurable counters for real-time statistical network
analysis
- real-time SFP module and fiber optic status information
- SPAN mode/in-line mode option
- hardware filters and deep packet inspection
- capture options such as packet slicing (128 bytes), high
resolution timestamps (8 ns), CRC error transmission, and
CRC32 preservation
- ProfiShark unit information and firmware flashing utility
- Direct capture to disk function
ProfiShark Manager can be used simultaneously with a
software network analyzer, without the need to interrupt data
capture.

8
ProfiShark 10G Manager
Counters — Traffic statistics
The Counters tab contains configurable counters for statistical
network traffic analysis and diagnostic.

9
SFP Modules — Port diagnostic and control
The SFP Modules tab provides real-time information about the
connected SFP modules and optical fiber.
The Ports Control section allows the switching between SPAN
mode and in-line mode. In SPAN mode, traffic is only received,
on either or both ports. In in-line mode, traffic is transmitted
between both ports. A loopback option is also available.

10
Filters — Hardware filters and DPI
The Filters tab gives access to the ProfiShark’s hardware filters
and deep packet inspection feature. When enabled, only the
packets matching the filters and DPI will appear in Live Capture
and Direct Capture.
Features — Capture options and unit information
The Features tab regroups information about the driver and
firmware version, port status, the firmware update utility, and a
way to enable or disable certain ProfiShark 10G features.

11
ProfiShark 10G Connected:
Lists the model of ProfiShark and its state: Connected,
Disconnected, or Upgrading Firmware.
Driver Version:
The version of driver software currently communicating with
the ProfiShark.
SW Version:
The version of ProfiShark Manager currently running.
HW Firmware Version:
The version of ProfiShark firmware currently loaded into the
ProfiShark device.
MAC Address:
A unique identifer burned into the ProfiShark device.
SFP+ Transceiver:
Declares the status of the (2) SFP+ ports, reporting whether a
transceiver is Present or Not Present.
Software Dropped Packets:
This counter increments when ProfiShark Manager realizes
that it is dropping frames due to insufficient resources,
typically CPU or disk write performance on the hosting PC.
Hardware Dropped Packets:
This counter increments when ProfiShark Manager realizes
that the ProfiShark device is dropping frames. Hardware
filtering and packet slicing can be used to prevent this.
Link Up Duration:
The time which has elapsed since the ProfiShark device saw
the Link signal go up.
Link Down Duration:
The time which has elapsed since the ProfiShark device saw
the Link signal go down.
NOTE Only one of Link Up Duration or Link Down Duration will
report a value.

12
To update the ProfiShark 10G firmware, press the Browse
button, select the appropriate firmware file and press the Flash
Firmware button.
The corresponding firmware update will begin. The ProfiShark
Manager cannot be used while the update is in progress. The
update process can take a few minutes to complete. Unplug
and replug the ProfiShark device to use the new firmware.
Do not disconnect the USB port or shut your computer down
during the update process.
The latest firmware can be downloaded from the Resource
Center at:
www.profitap.com

13
The following features can be turned on and off:
Enable timestamps in live capture:
If checked, a Unix formatted timestamp is adjoined at the
end of the packet data, after the FCS. This timestamp can be
interpreted by the Profitap Wireshark dissector in live capture
mode.
Unix timestamp format: the 64-bit timestamp is organized in
two 32-bit words, representing the seconds since 01/01/1970,
and the fraction of second.
Transmit CRC Errors:
If checked, the ProfiShark will not filter out network packets
with CRC errors like a normal NIC would.
Keep CRC32:
Keep the CRC32 information (32-bit Frame Check Sequence)
located at the end of the packets. FCS can be interpreted in
Wireshark (Edit -> Preferences -> Protocols -> Ethernet ->
Assume packets have FCS).
Disable Port A:
If checked, the frames which input on port A are not captured.
Disable Port B:
If checked, the frames which input on port B are not captured.
Packet Slicing:
If checked, the first 128 bytes of each frame are captured.
NOTE If the “Packet Slicing” feature is enabled, the hardware
automatically disables the “Keep CRC32” feature. No padding
is added to frames smaller than 128 bytes.
NOTE If both “Transmit CRC Errors” and “Keep CRC32” are
enabled, all erroneous packets will be treated as correct ones.

14
Capture — Direct capture to disk
ProfiShark 10G provides the option to capture traffic without
the need for third-party capture software. This mode of capture
is performed on a driver level, prior to all network stacks and
frame processing. With the support of direct capture, small
packet capture can be performed at wire speed.
The capture file is saved in PCAP Next Generation format
(.pcapng).
The packet timestamps are hardware generated with 8
nanosecond accuracy. The direct capture feature is compatible
with the different hardware features: “Packet Slicing”,
“Transmit CRC errors”, “Keep CRC32”, “Disable Port” (see
“Features” chapter).

15
Direct Capture Setup
Output Capture File:
Specify the name and location of the capture file. Name
extension will be added to the specified name
(_#####_YYYYMMDDHHMMSS).
Maximum Capture File Size (MB):
The capture will stop when the file reaches the specified size
in MB.
Loop:
If selected, the capture does not stop. The files are erased
to keep the specified amount of capture files. A round-robin
capture can be done, with one or multiple files.
Number of files to use:
Specify the amount of capture files to be created.
Start Capture:
When capture isn’t running, starts the capture with the
specified parameters.
Stop Capture:
When capture is running, stops the capture and releases the
capture file.
Written to File:
Indicates the amount of data written in the Output Capture File.
Current Cache Usage:
Indicates the RAM cache’s current usage.
Dropped:
Indicates the amount of data dropped during the capture.
NOTE The amount of dropped data depends on the data
storage throughput and the amount of RAM cache. Disk arrays
or SSDs can drastically improve capture performance.

16
Packet Capture
ProfiShark 10G has the ability to capture:
- Any type of frames (VLAN, VXLAN, MPLS, Pause frames, etc.)
- Any encapsulated frames
- CRC errors frames
- Short frames (< 64 bytes)
- Jumbo frames (> 1518 bytes)
- Any frames between 10 bytes and 10 Kbytes
Once the drivers have been properly installed, a new
connection is added in the Network Connection panel.
ProfiShark 10G acts as a 20 Gbit/s unidirectional NIC,
regardless of the network connection speed. Frame
aggregation is done in the ProfiShark hardware and respects
the original frame order. As opposed to FIFO (First In, First
Out), the ProfiShark 10G employs an FCFS (First Come, First
Served) mechanism.
A reboot of the computer may be required to refresh the
Winpcap/Wireshark device list. ProfiShark 10G has been tested
with all major capture/analyzer software.

17

18
Protocol Analyzer
(e.g. Wireshark)
ProfiShark Hardware, 8ns Timestamp
Direct Capture Format Computation
ProfiShark NIC
Capture Driver
ProfiShark Direct
Capture Driver
Network Driver
(NDIS)
Capture Driver
(e.g. Winpcap)
HDD/SSD
Live Capture vs Direct Capture
Two mode of capture are available: Live Capture mode, and
Direct Capture mode.
In Live Capture mode, the capture is performed like on any
other network card. The frames are routed to the NDIS driver.
In Direct Capture mode, the frame stream is dumped to the
disk. The capture file format is computed in the ProfiShark
hardware.

19
Live Capture Mode
ProfiShark 10G transmits network frames to the capture
software without altering them. It is transparent for packet
size, packet type, or protocols. All tags and encapsulation are
preserved (e.g. VLAN, MPLS, GRE).
The “Software Dropped Packets” counter in the Features tab
indicates the number of packets dropped by the driver in Live
Capture mode. It is not representative of the packets dropped
in Direct Capture (see “Direct Capture Mode” chapter). These
drop events are caused by high CPU usage.
The “Hardware Dropped Packets” counter indicates the amount
of captured packets that were dropped due to a high demand
for USB bandwidth. Hardware filters and packet slicing can
greatly reduce the amount of traffic to be captured, and thus
prevent hardware packet drops.
NOTE Capture of small packet at high speed is extremely
challenging for processors and can cause software drops. For
that reason, another capture mode is available (see “Direct
Capture Mode” chapter).

20
Timestamping
The hardware timestamping feature can be used in both Live
Capture and Direct Capture mode. The ProfiShark dissector for
Wireshark must be installed in order to interpret ProfiShark
timestamps. The dissector files can be found on the provided
USB flash drive, or in the Resource Center at: profitap.com
The dissector is compatible with Wireshark (x86 and x64)
1.12.x, 2.0.x, and 2.2.x.
Linux: Copy the file (profishark.so) to ‘/usr/local/lib/wireshark/
plugins/[wireshark_version]/’, from x86 or x64 depending on
the Linux version.
Windows:
Copy the file (profishark.dll) in the ‘plugins/[wireshark_
version]/’ subfolder of your Wireshark installation folder, from
x86 or x64 depending on the Windows version
The dissector can be enabled or disabled in the Wireshark
preferences (Edit -> Preferences -> Protocols -> ProfiShark ->
Decode timestamps for ProfiShark 10G).
The timestamp option must be enabled in the ProfiShark
Manager’s Features tab (see “Features” chapter).
If “Decode timestamps for ProfiShark 10G” is enabled,
Wireshark assumes that every packet contains the ProfiShark
timestamp.
If timestamps aren’t displayed in nanosecond resolution in
Wireshark, select ‘Nanoseconds’ in ‘View -> Time Display
Format’.