EXA40 Series

EXA40 Series

The EXA40 Sessionmaster is a multifunctional network appliance. It combines a Layer 4 network packet broker with one or two high performance multi core CPU‘s (see drawing).

The EXA40 understands network protocols, not only by the port number but can also decode protocols similar to a Probe. This feature is vital to do keyword and regular expression search and to produce useful results. The Sessionmaster EXA40 Series focuses on the mobile core network, metropolitan area network (MAN), and Internet data center (IDC) big data monitoring.

Advanced Network Packet Broker Sessionmaster EXA40

Download product datasheet download

Advanced Network Packet Broker Sessionmaster EXA40 Design

This design allows for maximum flexibility and security.

The Asic layer is a non blocking network packet broker which is used to do basic layer 4 filtering and steering the traffic to one of the Session Fabric CPU’s.

On the Session Fabric the higher layer software is running applications like:

  • GTP load balancing
    On TEID
    On inner IP address
  • IMSI filtering
    Specific IMSI
    IMSI range (black and whitelist)
  • Regex search
  • Keyword search
  • GTP tunnel remover
  • Meta data enrichment
  • SIP, RTP correlation
    Filter on phone# and correlate RTP traffic
    On inner IP address
  • MAC IN MAC tunnel remover
  • GTP-U Correlation, Tagging, and Packet Filtering

Success story:SMS intercept application, by redirect SS7 MAP traffic transported on a Sigtran link

Advanced Network Packet Broker Sessionmaster EXA40 Success Story

In this application the EXA40 works inline in a sigtran link. The challenge is to extract on packet level on this stream which holds the TEXT messages content. To do this an advanced regex filter is used. The matched packets are removed from the live link and forwarded to a server application. After processing the packets, they are sent back to the EXA40. The EXA40 reinserts the packets in the live link. The challenge is the complex regex filter and the near real time speed. Each transaction must be done under 20 ms to avoid corrupting the link. And this is possible with Cubro’s EXA40.

! Note: The power footprint is important on 24/7 running devices