Observer GigaStor : Gen3 Capture Card : Understanding hardware acceleration
Understanding hardware acceleration
Page Contents
How to enable hardware acceleration
Hardware-accelerated mode restrictions
Features that require hardware acceleration
Created: 2016-08-26   Revised: 2016-09-20
Hardware acceleration optimizes a GigaStor active instance for its fastest possible operating speed by using the Gen3 capture card instead of the system CPU.
Hardware acceleration significantly increases the performance of an active instance than without it. By using hardware acceleration with the Gen3 capture card, the fastest capture rates and post-capture analysis can be achieved in your GigaStor hardware or probe appliance. Turning off hardware acceleration is not recommended, as packet capture performance will be greatly degraded because this work is offloaded from Gen3 capture card to the CPU instead where it competes for resources.
Do not turn off hardware acceleration unless you have a specific need to. The feature provides performance benefits only; there are only advantages to gain by using hardware acceleration. However, two situations require that you disable hardware acceleration on the active instance:
1. If you need the GigaStor active instance to filter network traffic in real time using a “deeper” set of filters than the following:
MAC/IP Address
VLAN Tag (802.1Q)
It is a best practice to use the supported broad filters listed or no filters when capturing real-time network traffic with the GigaStor active instance. As soon as the network traffic is written to the RAID array, it becomes available for data mining and more complex filters can be used. If unwanted traffic is entering your GigaStor system, it is instead recommended that the connected switches, SPAN, or aggregator switch be configured to discard those packets before they reach the Gen3 capture card.
2. If you have an eight (8) port Gen3 capture card and intend to create one virtual adapter for each physical port, then hardware acceleration must be disabled. This is because only four virtual adapters can be created while hardware acceleration is enabled. In practice, this is not a typical setup, and better use of your hardware is gained by leaving hardware acceleration enabled than separating more than four ports of traffic.
Tip! You can verify if hardware acceleration is enabled by viewing the capture card properties.
The active instance is the only probe instance that can be configured for hardware acceleration. This means you cannot configure a passive instance to use hardware acceleration—the option simply does not exist—but passive instances can always be created from your hardware-accelerated active instance. Each GigaStor appliance with a Gen3 capture card is configured to use the card for the active instance, so the best capture performance is ready out-of-the-box.
Hardware acceleration does not affect or speed-up statistics-based features like Network Trending. Statistic-based features behave exactly the same whether hardware acceleration is enabled or disabled, and this is because hardware acceleration affects packet capture modes only.
Note: When allocating memory for any probe instance with the VIAVI capture card as the chosen adapter, at least 80 MB of memory must be allocated to both the capture buffer and statistics queue buffers. Failure to do so will result in the inability to capture data. This must also be followed for any Gen3 capture card that has hardware acceleration enabled.
How to enable hardware acceleration
Created: 2016-08-24
Hardware acceleration must be turned on for certain features in Observer and the GigaStor Control Panel to become usable. Hardware acceleration is exclusive to the Gen3 capture card.
To complete these steps, your probe instance list must show the active instance of your GigaStor probe. This can be accomplished by using Windows Remote Desktop to log on to the GigaStor system—so you can see the active instance directly—or by temporarily redirecting the active instance of the GigaStor system to your Observer analyzer.
Hardware acceleration is enabled by default on the local active instance of your GigaStor system. If you find that hardware acceleration is disabled, you can re-enable hardware acceleration.
To enable hardware acceleration mode:
1. In the probe instance list, in Observer, right-click the active probe instance and click Probe or Device Properties.
2. Click the Virtual Adapters tab.
Tip! Using the Expert Probe interface instead? Find this window tab at Options > Virtual Adapters.
3. Select Enable Hardware Acceleration.
Figure 56: Hardware acceleration is enabled
Hardware acceleration enabledHardware acceleration enabled
The active instance now uses hardware acceleration provided by the Gen3 capture card.
To further verify that hardware acceleration is enabled, you can view the capture card driver properties in Windows Device Manager.
Redirecting a probe instance
Revised: 2016-08-26
Your local Observer may already have local probe instances defined, but you can add numerous remote probes, including GigaStor, too. You must first redirect the remote probe to your local Observer.
A probe may have multiple probe instances, which are useful if you need multiple users using the same probe simultaneously or if you have specific needs for each probe instance (for instance, packet capture, trending, and so on). When you connect to a probe, ensure you select the probe instance you need and not one being used by someone else.
Video 3: Active and passive probe instances
Note: Probe redirection can either be password protected or disabled, depending on the target probe.
To redirect a probe instance, complete the following steps:
2. Do one of the following:
If you see a remote probe instance you want to redirect, skip directly to step 6.
If your list is empty or missing the remote probe instance you want to redirect, proceed to step 3.
3. Click New.
The Edit Remote Probe Entry dialog appears.
4. Type the IP address, or DNS address, of the remote probe.
If you type a DNS name, it resolves to its IP address.
5. If necessary for probe access, type a user name and password, and click OK.
Figure 57: Credentials may be needed
6. Select the remote probe instance from the list, and click Redirect Selected Probe Instance(s).
Allow time for the remote probe to redirect. How long this operation can take is limited by a timeout countdown.
The probe instances of the remote probe are shown.
7. Select a probe instance from the list, and click Redirect Selected Instance.
8. Select the Redirect to this Observer, and click the Redirect button.
Figure 58: Redirecting Probe Instance
9. Close the Probe Instance Redirection window.
If the operation succeeds, the remote probe instance is now redirected to the local Observer. Now you can use the remote probe instance just as you would if it was running on your local machine.
Hardware-accelerated mode restrictions
Created: 2015-06-09   Revised: 2016-08-26
The Gen3 capture card has a very short list of restrictions while running in hardware-accelerated mode. These restrictions are designed to keep your hardware operating at peak performance when hardware acceleration is enabled.
While a Gen3 capture card runs in hardware-accelerated mode, it cannot:
Connect itself to multiple probe instances without the aid of virtual adapters.
Use overly complex filters that would affect hardware-accelerated performance (rare occurrence). An error message will alert you if the filter is too complex for hardware acceleration, but the filter can be rewritten or tweaked to be accepted.
Use software-based pre-filters. They are mutually exclusive; only one may be used.
Affect statistics-based information, such as Network Trending.
There are two types of filtering that occurs in GigaStor: hardware filtering on the capture card and software filtering in Observer. Hardware filtering only affects which packets are captured on the capture card and saved to the RAID; it does not work with any statistics-based filtering that may occur in the Observer software, such as for Network Trending, Bandwidth Utilization with Filter, and so on. Any packets excluded by the hardware filter are never saved to disk and searchable by the software. In general, you want your hardware filter to allow as many packets through as possible. This ensures the largest number of packets are available for troubleshooting. In some cases, it is desirable to use hardware filtering because you know you do not need certain types of traffic captured and saved by GigaStor. Hardware filtering is only available when using hardware acceleration; it also disables the use of software-based pre-filters. Software filtering has two of its own possibilities when using hardware filtering: 1) sifting through packets after they were written to the RAID by the capture card and 2) controlling what is available for network trending when collecting statistics.
Hardware filtering
Filters packets before they are saved to the RAID. This disables the ability to use software pre-filters in Observer, which rely on the CPUs rather than the capture card to do the processing.
Software post-filtering of packets
Filters packets saved to disk by the capture card, which may or may not have a hardware filter applied. See Observer Filters.
Software filtering of network trending
Filters statistics-based trending data, which is entirely unrelated to packet capture. See Choosing your network trending types.
These are the filtering types usable on a hardware-accelerated virtual adapter:
MAC/IP Address
VLAN Tag (802.1Q)
Features that require hardware acceleration
Created: 2016-09-06
Some functions or features of your hardware appliance require that hardware acceleration is turned on.
These cannot operate if hardware acceleration is turned off:
Real-time packet deduplication
Physical ports reused in multiple virtual adapters
Hardware filters
Disk read and write speeds that match advertised values