SwiftWing SIRIUS NDR
![](https://www.comworth.net/wp-content/uploads/2020/07/sw-sirius-lcs-v33-ic.png)
SwiftWing SIRIUS NDR
SwiftWing Network Monitoring & Capturing Network Capture & Data StorageSirius Network Drive Recorder 10M ~ 100Gbps All Range Ethernet Network Drive Recorder
![](/wp-content/uploads/2020/06/Made-in-Ota-Tokyo.png)
Der liebe Gott versteckt im Detail.
Originating from Ota, Tokyo, the SwiftWing Series has enjoyed great success since its introduction in 2003. We have a track record of 20 years of development, a worldwide customer base, and sustained operational performance.
SwiftWing Sirius NDR is the only PCAP recorder in the industry (as of January 2022) that supports simultaneous capture of multiple media I/Fs from 10Mbps to 100Gbps Ethernet (10M/100M/1G/10G/25G/40G/50G*/100G) (*50G coming soon).
![](https://www.comworth.com.sg/wp-content/uploads/2017/08/SwiftWing-Stacking-02-300x200.png)
![](/wp-content/uploads/2022/07/PortableCompact-1-300x191.png)
SwiftWing Sirius NDR is a Network Drive Recorder capable of saving incoming traffic directly into storage disks in PCAP format. Equipped with a large-capacity storage of up to 20.0 PB 1, it is capable of processing a stream of 200 Gbps or more for sustained periods. It boasts a supporting software that has been redesigned from the ground up to deliver targeted functionality, excellent usability, and improved reliability in runtime environments.
Currently, the capture interface lineup offers 10 Mbps - 10 Gbps, 10 - 100 Gbps, and 10 - 200 Gbps capture rates. SwiftWing Sirius NDR is a fully configurable system with various chassis. This flexibility extends several advantages to users. If current traffic volume is low, users can save initial costs by purchasing a low-speed unit. As traffic volume increases, the chassis can be upgraded by installing faster interfaces. This approach lowers cost barriers and yields more lasting returns on customer investments.
SwiftWing Sirius NDR adopts a Web GUI interface that has proven popular with users due to its intuitiveness and ease of use. A unified screen design provides a coherent user experience across various functions such as capture settings, reference and download of acquired packets, and statistical information. Because PCAP files are split according to the specified unit of time 2, WireShark or a hypervisor 3 can access PCAP files as they are being generated immediately after capture has started.
1 as of April 2021
2 PCAP files can also be split by file size
3 optional for all models except Portable Compact
Multi-channel / Multi-port Capabilities with Dual Media Interfaces
Devices can support a total of 4 channels. In addition, up to two different media interfaces can be installed※ and used at the same time. With 100G-A2 interfaces, a maximum of 16 ports can be configured.
Channels can be assigned with any physical ports from their associated media interfaces, and can perform captures and generate PCAP files individually. Therefore, a single Sirius unit can capture and analyze traffic from multiple DUTs.
※ In a dual adapter configuration, if a 10G-B1 and 100G-A2 media interface are installed, captures can be performed at a rate of 10M/100M/1G/10G/25G/40G/100G on a single chassis.
Capture Variration
Sirius NDR saves captured packets into PCAP files of a certain capacity or time unit specified at the start of capture.
No file Split
Captured data will be saved in 1 file.
Split by file size
File will be split according to the specified size during capture.
32 MB, 64 MB, 128 MB, 256 MB, 512 MB, 1 GB, 1.5 GB, 2 GB, 4 GB
Split by time
File will be split according to the time interval specified during capture.
1 sec, 5 sec, 10 sec, 15 sec, 30 sec, 1 min, 5 min, 10 min, 15 min, 30 min, 1 hr
PCAP to Disk
PCAP files are generated immediately upon the initialisation of capture. The status of the capture session, as well as other statistical information, are also displayed in real time. Traffic can be further analyzed using post-filters, built-in Wireshark, or other hypervisor applications without stopping capture.
The following items are displayed on the real-time monitor:
- Various error packet counters
- Distribution of received packets by length
- L2 packet type
- L3 capsule packet type (IPv4, IPv6, VLAN, user defined)
- L4 packet type (TCP, UDP, SCTP, user defined)
- Number of packets received by each media interface
Packet Decoding
- Fully decode packets in capture files and view them via the Web GUI
- Manage which packets should be decoded by adjusting the time range on the GUI
- Does not impact capture performance
- Convert selected packets to separate PCAP files with a single click of a button
Filter Functions that are Flexible and Easy to Use
Sirius is equipped with two types of filters – pre-filters and post-filters. Pre-filters can be applied not only to parameters (e.g. IP address) found in the protocol header of each layer, but also to any value in the payload (e.g. HTTP method). Post-filters can be applied to VLAN (Outer/Inner), IP address, protocol and port number.
Pre-Filter | Post-Filter | |
---|---|---|
![]() |
![]() |
![]() |
Universal-Filter
Universal filter specifies the offset value and pattern length from the head or tail of the frame and can be recorded in the index.
Universal filters can be in hexadecimal (pattern, pattern_hex) or ASCII (pattern, pattern_ascii) formats.
Traffic analysis
Traffic analysis analyzes and graphically displays the traffic volume by application and IPv4 address pair traffic volume.
By using this, the status of captured traffic can be analyzed by application and IPv4 address pair. It is very useful for understanding the overview of traffic and identifying the cause of bursts.
Microburst Analysis and Notification
Data on network throughput is collected and recorded every 500 microseconds. It is possible to set a threshold for throughput and subsequently dispatch alerts (via SNMP Trap, syslog, event log, or email) when the threshold is exceeded. Overwrite protection can also be toggled for PCAP files with recorded microbursts.
- Can be performed on running captures
- Generates 2000 records of throughput statistics per second
- Store up to 7 days of statistical data
- Export saved statistics in CSV format
- Various options to set thresholds (traffic rate, number of occurrences, detection window) to trigger alerts (SNMP trap/ Event log) and flag associated PCAP files for overwrite protection
Web GUI for Intuitive and Simple Operation
The dashboard displays information such as system information, port link status, presence/absence of packet traffic, SNMP trap reception/transmission, etc. When the system is idle, a summary of the most recent capture will also be available. When a capture is started, the summary switches to show real-time statistical information about the running capture.
Default options, such as capture settings, can also be easily toggled through the web GUI.
Dynamic Packet Alerts
Dynamic packet alerts enable users to specify the conditions required for packets to trigger notification events. Users can also choose to receive notifications via SNMP Trap, syslog, or email.
With this feature, users can be notified immediately about the occurrence of rare packets. It is also possible to configure Sirius to retain neighboring packets received within a specified window before and after each detected occurrence. The traffic data collected can be further examined to better understand the circumstances leading to rare packet occurrences.
Like filters, the conditions used for packet detection are very flexible and can be applied to any value in the protocol header and payload.
Dynamic Offset
![](https://www.comworth.com.sg/wp-content/uploads/2020/07/sirius_pro03.png)
It is possible to set a filter by specifying an offset value from the ethernet header. This feature allows filtering on special protocols and user payloads.
Examples
① Offset 54 bytes from the beginning of Ethernet header (After 54 bytes)
② Offset from Ethernet header to IPv6 header (After IPv6 Header)
Methods for specifying filter condition
- Hex input
- Bit mask input
Packet Slicing
![](https://www.comworth.com.sg/wp-content/uploads/2020/07/sirius_pro04.png)
Captured packets can be sliced and saved. The size of each slice can be configured by specifying the number of bytes required from beginning of the MAC header of each ethernet frame. Any data beyond the specified range is discarded. This saves storage space by removing unnecessary portions of the payload.
Application Range
64 - 10,000 Bytes
File Rotation
![](https://www.comworth.com.sg/wp-content/uploads/2020/07/sirius_pro07.png)
File rotation automatically deletes the oldest file in a capture session when the total size of all capture files reaches the specified storage limit.
Files may be rotated based on percentage disk usage or by total number of capture files. File rotation allows capture sessions to run continuously for extended periods of time without interruption.
Channel-to-channel exclusive control function
Permissions to perform key functions such as capture, capture file download, and post-filter can be assigned on a per-channel basis.Each group can manage the resources of the same chassis by physical port, allowing multiple users to use a single chassis as multiple independent capture systems.
As shown in the figure on the right, users belonging to Group A is only allowed to access physical ports 1 and 2 (channel 1), users belonging to Group B is only allowed to access physical ports 3 and 4 (channel 2). At the same time, users belonging to Group C can be configured to allow access to both Channel 1 and Channel 2.
It is also possible to flexibly assign various privileges to each group.
Low/High Traffic alert
Traffic alert is emitted alert when traffic is below or above a specified flow rate. Alert can send to the administrator via SNMP Trap, Remote Syslog, or e-mail. Traffic flow rate units can be selected from bits per second (bps) and packets per second (PPS). When the network deviates from the steady state, it can be detected and alerted immediately.
Long-term Packet Replay
Extended packet replay sessions can process PCAP files of up to 500 GB with recorded timestamps accurately reflected. Replay is not limited to files generated by Sirius; foreign PCAP files uploaded by the user can also be replayed.
GUI controls include pause and resume functions, as well as options to replay PCAP files continuously or for a specified number of times.
Ideal for 2K/4K Video over IP verification.
RESTful API
Sirius features a newly designed RESTful API which enables third party devices to connect and access capture files stored in SIRIUS NDR via web services. Secure access is also available via HTTPS.
The new API is more compatible with external devices and is an effective interface for building web-based measurement and monitoring services such as:
- Capture control
- Retrieving channel statistics
- Controlling post filters
- Directory and file search
- File transfer
- File extraction (time, file size)
- Retrieving system configuration settings
Highly Compatible with External Applications
Packets received by Sirius can be used immediately by any PCAP application. A hypervisor option is available to expand the use of Sirius as an operating platform upon which users’ preferred applications can be installed.
Also, since Wireshark is pre-installed on the operating system, it is possible to analyze packets immediately without forwarding received traffic to an external device.
Integration with SwiftWing Traemon (Real-time Network Analysis Probe)
Sirius can be coupled with a DPI analysis probe (SwiftWing Traemon) to perform real-time traffic analysis (max 10G) for IP pairs, protocol distribution, TCP/HTTP delay time, etc. Sirius is able to utilize the results for further post-filtering, and relevant packets can be extracted easily with a single click of a button.
For more information about SwiftWing Traemon <<Click here>>
Other major features
- Post-filter history and memo functions
- Store multi-user capture sessions
- Capture-on-startup
- Packet detection and notification
- Network flow sampling
- Various monitoring and notification functions (SNMP, Syslog/Eventlog, etc)
- Remote update
- Factory reset
- Power Supply Status Monitoring (Rackmount only)
- Radius user authentication
- PTP/NTP client function and external PPS input/output
- Real-time packet decoding
- Universal Filter Profile
- GTP-U inner packet post filter
- Deduplication
- Traffic Utilization Alert
- Error frame alert
- Packet slicing for PCAP file output
- Multiport/multicard replay (coming soon)
- PCAPNG format support (coming soon)
Sirius NDR offers a full-choice system that be optimized for the customer’s operational needs. The current product lineup includes three types of media interfaces (multi-rate compatible) which can be installed in any combination on any chassis (Portable Compact / Portable M / Portable L / Rack Mount).
We can provide the optimum system according to customers’ requests (media interface, storage performance/capacity, operational environment, required functions, etc). If capture traffic volume is low, users may opt to purchase a unit more suitable for current demands. The capture performance of the device can be upgraded by installing high-speed interfaces (such as a 100 Gbps interface) to match future increases in traffic volume.
19 Inch Rack Mount
![](/wp-content/uploads/2017/12/SIRIUS-4u-std-300x200.png)
This chassis can be purchased in 1U/2U/4U/4U+JBOD models. Models can be fitted with any media interface (some restrictions apply). Storage write speeds (PCAP to Disk) range from 20 Gbps (1U) to 200 Gbps (Type 5L). Storage capacity can be configured from 8 TB (1U) to a maximum of 18.0 PB (Type 11LX). RAID5/50/60 are typically adopted for disk redundancy, though a hot spare configuration with even higher fault tolerance is possible upon request.
Sirius Portable M / Portable L
The Sirius Portable M and Portable L are ruggedized models that are excellent for field use. The Portable M has a storage write speed of up to 55 Gbps, while the Portable L performs up to 110 Gbps. Both models allow a storage capacity of 15 to 960 TB in RAID50 configuration. A complimentary carrying case with 4 wheels is also included for convenient transportation.
Sirius Portable Compact
![](http://172.24.121.77/wp-content/uploads/2018/01/DSC06483-1.png)
The Portable Compact is an entry model of the Sirius NDR series that offers significantly improved 25Gbps and 50Gbps continuous capture performance with enhanced storage reliability by utilizing RAID 5.
The built-in power supply is available the unit to be used as a complete stand-alone solution by connecting the included monitor, keyboard, and mouse.
A carrying case* is provided to hold a complete set of equipment, making it ideal for business travel and on-site use. (optional for 4 wheel hard case)
10 Mbps - 100 Gbps Ethernet (10M/100M/1G/10G/25G/40G/50G*/100G) media interface lineup.
Most of our media interfaces support multi-rate capture. A single chassis is capable of capturing at all of the above media speeds when a 10G-A2 or 10G-B1 media interface is installed with a 100G-A2/100G-A3 interface in dual adapter configuration (not supported by Portable Compact/1U chassis).
(*50G coming soon)
10G-A2 Multirate Media Interface | ||
---|---|---|
Supported Media Modules | SFP/SFP+ | ![]() |
Ports | 2 | |
Supported Rates | 10 Mbps : 10 Base-T 100 Mbps : 100 Base-TX 1 Gbps : 1000 BASE-SX/-LX/-T 10 Gbps : 10 Gbase-SR/-LR/-T |
10G-B1 Multirate Media Interface | ||
---|---|---|
Supported Media Modules | SFP/SFP+ | ![]() |
Ports | 4 | |
Supported Rates | 10 Mbps : 10 Base-T 100 Mbps : 100 Base-TX 1 Gbps : 1000 BASE-SX/-LX/-T 10 Gbps : 10 Gbase-SR/-LR/-T |
100G-A2/100G-A3 Multirate Media Interface | ||
---|---|---|
Supported Media Modules | QSFP28/QSFP+ | ![]() |
Ports | 2 (Up to 8 ports when 10/25G I/F mode is selected) | |
Supported Rates | 10 Gbps : 10 Gbase-SR/-LR/-T 25 Gbps : 25 Gbase-SR/-LR/-CR (RS-FEC support) 40 Gbps : 40 Gbase-SR4/LR4/-CR4 100 Gbps : 100 Gbase-SR4/-LR4/-PSM4/-CLR4/-CR4/-ER4 (RS-FEC support) |
(*50G coming soon)
![]() |
|||
---|---|---|---|
Rack Size | 1U | ||
Model | NDR-1US-2XG-A8-8T/-16T/-32T | NDR-1USS2-4XG-B5-5T/-10T/-20T | NDR-1USS2-200Gi-B10-10T/-20T/-40T |
Media Interface | Model: 10G-A2 x 1 (2XG)
Specifications: SFP/SFP+ x 2 |
Model: 10G-B1 x 1 (4XG)
Specifications: SFP/SFP+ x 4 |
Model: 100G-A2 x 1 (200Gi)
Specifications: QSFP+/SFP28 x 2 (※)10/25GBase-SR/-LR can be configured with 8 ports when using a breakout cable |
Dimensions (W:H:D / mm) | 490 x 43 x 650 | ||
Weight | 17 kg | 18 kg | 20 kg |
CPU | Intel Multicore Dual CPU | ||
Memory | Standard 64 GB (max 2 TB) | Standard 128 GB (max 2 TB) | |
Capture Storage (TB) | 8 / 16 / 32 (SSD) | 5 / 10 / 20 (High speed SSD) | 10 / 20 / 40 (High speed SSD) |
Capture Storage Performance | When in RAID5: 20 Gbps (10G x 2 line rate configurable) |
When in RAID5: 50 Gbps (10G x 4 line rate configurable) |
When in RAID5: 80 Gbps (10G x 8, 25G x 2, 40G x 2 line rate configurable) |
Timestamp Granularity | 3.2 ns | ||
Timestamp Accuracy | Within 20 ns Equipped with PPS interface for external synchronization |
||
Capture Packet Size | 64 ~ 10000 Bytes | ||
RAID | RAID5 / RAID6, OS Drive RAID1 |
||
Power | Voltage: AC 100V - 240V Wattage: ~750W |
||
Interface | 6 x USB 3.0 Type-A Ports, 1 x VGA Port | ||
Accessories | - | ||
The above is only an example configuration. The chassis can be fitted with different storage capacities and/or media interfaces. For more information, please feel free to contact us. |
![]() |
||
---|---|---|
Model | Portable Super Light | |
Model | NDR-PS1SN1-2XG-X4-6T/-12T/-24T | |
Media Interface | Model: 10G-A2 x 1 (2XG)
Specifications: SFP/SFP+ x 2 |
|
Dimensions (W:H:D / mm) | 254 x 66 x 226 | |
Weight | 3 kg (Separately: AC power supply approx. 1 kg) |
|
CPU | AMD Multicore Single CPU | |
Memory | 96 GB | |
Capture Storage (TB) | 6 / 12 / 24 | |
Capture Storage Performance | When in RAID5: 20 Gbps | |
Timestamp Granularity | 3.2 ns | |
Timestamp Accuracy | Within 20 ns Equipped with PPS interface for external synchronization |
|
Capture Packet Size | 64 ~ 10000 Bytes | |
RAID | RAID5 | |
Power | Voltage: DC 12V Wattage: 150W |
|
Interface | 2 x USB 3.0 Type-A Ports, 1 x VGA Port | |
Accessories | - | |
The above is only an example configuration. The chassis can be fitted with different storage capacities and/or media interfaces. For more information, please feel free to contact us. |
![]() |
||
---|---|---|
Model | Portable Compact | |
Model | NDR-PC1SN1-2XG/4XGi/200Gi-B4-6T/-12T | NDR-PC1SN1-200Gi-B8-12T/-24T/-48T |
Media Interface | Model: 10G-A2 x1 (2XG) / 10G-B1 x1 (4XGi)
Specifications: SFP/SFP+ x 2 or 4 Model: 100G-A2 x1(200Gi) Specifications: QSFP+/SFP28 x 2 (※)10/25GBase-SR/-LR can be configured with 8 ports when using a breakout cable |
Model: 100G-A2 x1 (200Gi)
Specifications: QSFP+/SFP28 x 2 (※)10/25GBase-SR/-LR can be configured with 8 ports when using a breakout cable |
Dimensions (W:H:D / mm) | 155 x 266(+ 49*) x 315 *With carrying knob attached |
|
Weight | 8 kg (Built-in AC power supply) | |
CPU | Intel Multicore Single CPU | |
Memory | 96 GB | |
Capture Storage (TB) | 6 / 12 | 12 / 24 / 48 (max 60 TB) |
Capture Storage Performance | When in RAID5: 25 Gbps (25G x 1 line rate configurable) |
When in RAID5: 50 Gbps (25G x 2 line rate configurable) |
Timestamp Granularity | 3.2 ns | |
Timestamp Accuracy | Within 20 ns Equipped with PPS interface for external synchronization |
|
Capture Packet Size | 64 ~ 10000 Bytes | |
RAID | RAID5 | RAID50 |
Power | Voltage: AC 100V - 240V Wattage: ~750W |
|
Interface | 2 x USB 3.0 Type-A Ports, 2 x USB 2.0 Type-A Ports, 1 x VGA Port | |
Accessories |
Carrying Case with Wheels, USB Mouse, Mobile Display, Mini USB Keyboard |
|
The above is only an example configuration. The chassis can be fitted with different storage capacities and/or media interfaces. For more information, please feel free to contact us. |
![]() |
||
---|---|---|
Model | Portable M | |
Model | NDR-PA2-240Gi-B16-16T/-32T | NDR-PA2SS1-200Gi/400Gi-B16-15T/-30T/-60T |
Media Interface | Model: 100G-A3 x1 + 10G-B1 x 1 (240Gi)
Specifications: SFP/SFP+ x 4 Specifications: QSFP+/SFP28 x 2 (※)10/25GBase-SR/-LR can be configured with 8 ports(200Gi) when using a breakout cable |
Model: 100G-A3 x 1 (200Gi) / 100G-A3 x 2 (400Gi)
Specifications: QSFP+/SFP28 x 2 or 4 |
Dimensions (W:H:D / mm) | 436 x 329 x 185 | |
Weight | 15 kg | |
CPU | Intel Multicore Dual CPU | |
Memory | Standard 128 GB (max 2 TB) | |
Capture Storage (TB) | 16 / 32 (SSD) (max 64 TB) |
15 / 30 / 60 (High speed SSD) (max 500 TB) |
Capture Storage Performance | When in RAID50: 40 Gbps (25G x 1 line rate configurable) |
When in RAID50: 55 Gbps (25G x 2 line rate configurable) |
Timestamp Granularity | 3.2 ns | |
Timestamp Accuracy | Within 20 ns Equipped with PPS interface for external synchronization |
|
Capture Packet Size | 64 ~ 10000 Bytes | |
RAID | RAID50 | |
Power | Voltage: AC 100V - 240V Wattage: ~680W |
|
Interface | 2 x USB 2.0 Type-A Ports | |
Accessories |
Carrying Case with Wheels, USB Mouse |
|
The above is only an example configuration. The chassis can be fitted with different storage capacities and/or media interfaces. For more information, please feel free to contact us. |
![]() |
||
---|---|---|
Model | Portable L | |
Model | NDR-PL1SS1-240Gi-C32-60T/-120T/-240T/-480T | NDR-PL1SS1-200/400Gi-C32-60T/-120T/-240T/-480T |
Media Interface | Model: 100G-A3 x 1 + 10G-B1 x 1 (240Gi)
Specifications: QSFP28/QSFP+ x 2 |
Model: 100G-A3 x 1 (200Gi) / 100G-A3 x 2 (400Gi)
Specifications: QSFP28/QSFP+ x 2 or 4 |
Dimensions (W:H:D / mm) | 420 x 425 x 250 | |
Weight | 24 kg | |
CPU | Intel Multicore Dual CPU | |
Memory | Standard 128 GB (max 4 TB) | |
Capture Storage (TB) | 60 / 120 / 240 / 480 (High speed SSD) (max 960 TB) |
|
Capture Storage Performance | When in RAID50: 150 Gbps (25G x 6 line rate configurable) When in RAID0: 200 Gbps and up |
|
Timestamp Granularity | 3.2 ns | |
Timestamp Accuracy | Within 20 ns Equipped with PPS interface for external synchronization |
|
Capture Packet Size | 64 ~ 10000 Bytes | |
RAID | RAID50 OS Drive RAID1 |
|
Power | Voltage: AC 100V - 240V Wattage: ~1400W |
|
Interface | 4 x USB 3.0 Type-A Ports, 2 x USB 2.0 Type-A Ports | |
Accessories |
Carrying Case with Wheels, USB Mouse |
|
The above is only an example configuration. The chassis can be fitted with different storage capacities and/or media interfaces. For more information, please feel free to contact us. |
Carrying Case with 4 Wheels (Option) |
---|
Portable Compact / Portable M / Portable L is available in a carrying case with 4 wheels. |
*50G coming soon
![](/wp-content/uploads/2023/05/seb_k_45mm150dpi.jpg)
Johan Roggenbuck: Infrastructure Division
"SwiftWing Sirius solution has been carefully selected with the highest standards put together in a long-lasting system. Since more than 3 years of continuous operation 24/7, we have not seen a single missed or dropped network-packet."
"Timestamping of network-packets, with the accuracy of sources like PPS or PTP has worked flawlessly."
SEB (Skandinaviska Enskilda Banken)
SEB is a leading Nordic financial services group headquartered in Stockholm, Sweden, and offers a wide range of financial services and advice in Sweden and the Baltic States.
The company offers corporate business and investment banking based on a full-service concept for companies and institutions in Denmark, Finland, Norway, Germany and the UK.
![](/wp-content/uploads/2017/10/bt.jpg)
John McLaren: BT Netec Services Edinburgh ETC Division
"SwiftWing Sirius solution addressed the business needs of its company. SwiftWing Sirius delivered impressive performance and provided exceptional value as required by BT Netec."
BT Group
BT Group is a telecommunications and network provider headquartered in London, UK. They provide fixed and mobile communications and related secure digital products, solutions and services.
The company also provides managed communications, security, network and information technology (IT) infrastructure services to customers in approximately 180 countries.