ProfiShark Manager

The Counters tab displays all the ProfiShark built-in counters for both Ethernet ports. These 64-bit hardware counters are cleared at hardware startup.

On the right-hand side are graphical meters displaying current bandwidth usage, average bandwidth usage, and average CRC error rate for each port.

The Counters tab displays 15 customizable counters for both SFP+ ports. Each counter can be configured to register packets matching a specific filter when passing through either SFP+ module.

Edit button	Opens the configuration window for this counter. The counter ignores that frame characteristic. These frames will show in the counter. The counter filters out the matching frames. These frames will not show in the counter. The counter only counts the frames matching this specific filter. IPv4 / IPv6: If checked, only packets originating from or destined to the specified IPv4 / IPv6 address will be taken into account. Packet size: If different than Don’t care, only packets with a size matching the configured filter will be taken into account. Enable on: Depending on the selection made here, only packets passing through either Port A, Port B, or both ports, will be taken into account. Counting mode: The Total and Rate figures can be displayed in either bytes or number of frames. Note: If multiple filter fields are configured, only packets matching all filters will be counted.
Reset button	Resets the Total figure for this counter. Does not reset the configured filters for this counter.
Matching filter	This area displays the matching filters for each counter, displaying in red ( ) for ignoring, green ( ) for taking into account, and grayed out ( ) for filtered out frames. The frame size is always displayed in black.
Total	Displays the total number of packets or bytes matching the configured filter.
Rate	Displays the current rate of packets or bytes per second matching the configured filter.
Chart display	Displays traffic statistics in a graphical representation of the frames matching the configured filter.

The Charts tab offers a view of the same statistical information as the Counters tab, plotted over time, for a better overview of the data flow.

Depending on the type of packets or events selected on the left side of the screen, the statistical data is plotted accordingly for either port A or B. Refresh rate can also be selected using the drop-down list on the top left-hand corner, further tuning the displayed information.

All data can be expressed either in number of packets per second, or in a percentage of the total number of packets:

• By selecting packets/s, each data type displays the corresponding number of packets per second, except for the bandwidth usage which is displayed in bytes per second.
• By selecting percentage, each data type is displayed as a percentage of the total number of packets, except for the bandwidth usage which is displayed in percentage of the total bandwidth.

The plotted statistical data can be reset by clicking the Clear All button. Disconnecting the ProfiShark also resets the plotted statistical data.

The SFP Tab provides real-time information about the connected SFP+ modules, offering an overview of their general capabilities and real-time sensors.

The Ports Control section allows switching between SPAN mode and In-Line mode by ticking or unticking the Span Mode checkbox. In SPAN mode, traffic is only received, on either or both ports. In In-Line mode, traffic is transmitted between both ports. A loopback option is available when SPAN mode is enabled. An autonegotiation option is available for each port when the 1 Gbps firmware is active (see Features tab).

The Traffic Logs tab allows users to monitor network ports events.

Monitor link status, bandwidth usage and CRC error rate for ports A and B. For bandwidth usage and CRC error rate, an entry is added every time the specified threshold is exceeded.

Link status
Logs link status events.

Bandwidth usage
Logs traffic events exceeding the set value. This value represents a percentage of the total bandwidth. For instance, for 1 Gbps, a value of 5.5 will result in only logging traffic events exceeding 55 Mbps (1000 * 0.055).

CRC error %
Logs CRC error events exceeding the set value. This value represents a percentage of the traffic passing through the port. For instance, a value of 5.5 will result in only logging traffic events with a CRC fault rate exceeding 5.5% of the traffic passing through the port.

Monitor SFP module detection, status bit changes, and warnings and alarms.

Additional options for logging timing-specific events are available on this tab for the 1G+ and 10G+ models.

The Network Ports tab allows the customization of port settings for the ProfiShark 1G/1G+, and offers an overview of the ports' status and link capabilities.

When the ProfiShark ports are set to In-Line Mode (Span Mode option unchecked), devices connected through ports A and B can communicate. In this case, both Ethernet ports are controlled at the same time.

Enabling SPAN Mode tells the ProfiShark to intercept two separate data streams, and the connection between ports A and B is severed. In this case, the Ethernet ports can be controlled independently in terms of speed, duplex mode, and autonegotiation.

A comprehensive list of advertised partner network capabilities is displayed on the left side panel.

The Filters Tab gives access to the ProfiShark 10G/10G+ hardware filters and deep packet inspection (DPI) feature. When enabled, only the packets matching the criteria configured in these filters and DPI will be captured in Live Capture and Direct Capture. These filters only affect the captured traffic and do not interfere with the counters displayed in the Counters Tab.

The Packet type section allows you to include or exclude packets based on their type. Selected packet types will be included in the capture, and unselected packet types will be excluded.

The Filter section allows filtering on Ethernet MAC, IPv4/6 addresses, and TCP/UDP ports.

The Deep Packet Inspection section allows users to search for a particular string (up to 16 characters in length) in the packets. This procedure is performed in real time, even at 20 Gbps. The left field accepts hexadecimal characters, while the right field accepts ASCII characters.

Note: Not all hexadecimal characters can be displayed in the ASCII field.

In the example above, ProfiShark has been set to capture only packets originating from or destined to any MAC address ending with 00, originating from or destined to any IPv4 address starting with 192.168, using port 443 for either incoming or outgoing traffic, and carrying matching DPI strings in their payload.

The Timing tab displays settings and information related to the advanced timestamping features.

The Features tab contains information about the device, the firmware update utility, and options for enabling and disabling capture-related features.

In the Status section, the Device tab displays hardware and software information about the connected ProfiShark device, and the Status tab displays the current status of its network interface.

The Firmware Update section allows users to flash the firmware of the connected ProfiShark with a locally stored version. The ProfiShark is unavailable during the firmware update process, which can take up to several minutes to complete. Once finished, the ProfiShark may need to be replugged for the new firmware to take effect. Do not disconnect the USB port or shut the computer down during the update process. The latest firmware is included in the ProfiShark installation folder.

Note: The ProfiShark Manager will compare the firmware of the connected device(s) with the ones included in the installation folder every time it starts, allowing a new revision to be installed if present.

The Capture Format section allows users to enable or disable capture-related features. These options apply to both Direct Capture and Live Capture modes. Additional customization of the capture process is available in the Capture tab.

The Firmware Selection section allows users to switch between 10 Gbps and 1 Gbps firmware for the ProfiShark 10G and 10G+, effectively altering the operating speed of the connected SFP+ modules.

Note: Switching between firmware versions takes between 4 and 8 seconds to complete, during which the network connection will be severed.

ProfiShark can capture traffic without the need for third-party capture software. This Direct Capture is performed at the driver level, prior to all network stacks and frame processing. Direct Capture provides the best performance, enabling small packet capture at wire speed.

The Capture tab contains the controls for the Direct Capture feature. The captured data is saved to PCAP Next Generation files (.pcapng) with hardware-generated packet timestamps. ProfiShark Manager also provides an option for uploading capture files to Cloudshark.

Note: The amount of dropped data depends on the data storage throughput and the amount of allocated memory buffer. Disk arrays or SSDs can drastically improve capture performance.

The Capture Control tab allows you to start and stop the traffic capture on multiple ProfiShark devices at once. Select multiple devices and click the Start Selected or Stop Selected button to start or stop the capture for the selected devices. Each ProfiShark will capture using the settings defined on its Capture tab.