HammerHead Packet Capture and Replay

Real World Network Traffic Testing at up to 20 Gbps

Designed for Network Operations Center (NOC) and Security Operations Center (SOC) environments, HammerHead is a high-speed, continuous recording solution that provides full packet capture of traffic for retrospective network analysis and replay. HammerHead Network Recorder combines flow-based session analytics with stream-to-disk recording at up to 20 Gbps, delivering an easily-searchable, back-in-time view of network trends and events.

Packet Capture

Even on the busiest networks, HammerHead captures 100% of the traffic, timestamping every packet with nanosecond resolution, and extracting flow identification parameters. As traffic is streamed to disk, HammerHead generates a flow and time-based index that allows rapid search and retrieval of targeted traffic from many terabytes of capture records. HammerHead’s browser-based drill-down interface allows remote analysis of selected packets without the need to export entire PCAP files. Alternatively, traffic can be retrieved in industry-standard PCAP format for analysis by external tools such as Wireshark ™.

Hammerhead UI

Packet Replay

With hhreplay, an accelerated, multi-threaded tool similar to tcpre- play, HammerHead provides high-fidelity, wire-speed, transmit capabilities. It can generate Ethernet traffic with standard or custom protocols, and replay with preserved nanosecond (or microsecond) packet timing and inter-frame gaps. Traffic can be replayed across multiple interfaces (“stereo” mode) using hhcapture-encoded PCAP files. HammerHead also allows the insertion of network impair- ments such as invalid frames or packet loss with custom crafted PCAP files.

The 2.x release of HammerHead supports dynamic replacement of source and destination MAC addresses and on-the-fly CIDR-based IP address translation. This facilitates traffic capture in one network location or configuration, and replay into a different configuration such as a test or compliance lab. Release 2.x also provides new replay controls such as fast-forward and speed-scaling.

Analyze & Manage

Because HammerHead records traffic in PCAP format, retrospective traffic analysis is simple with PCAP-aware applications such as Wire- shark and other standard Linux tools. For example, custom PCAP processing utilities can be implemented with scripting languages such as Perl or Python, and trending reports can be generated with gnuplot or matplotlib. SSH tools ensure secure system manage- ment and the downloading, uploading, or deletion of PCAP files.

The HammerHead 2.0 workbench deliv- ers simple 10 Gbps capture and replay capabilities, yet is versatile enough to meet demanding requirements of network engineers, who desire the control of the Linux command line and the scripting flexibility to build and deploy custom network monitoring, test, and measure- ment solutions. Unlike conventional “test and measurement” platforms incorporat- ing an overwhelming number of fixed, seldom-used features, the HammerHead workbench is designed with a pragmatic, less-is-more philosophy. The result is a cost-effective, high-performance platform that can easily be adapted to implement sophisticated solutions at full line rate.