Introducing Endace DAG
Introducing
Endace
DAG Cards
Endace DAGTM (Data Acquisition and Generation) cards
are the ultimate in network packet capture interface
cards. They guarantee 100% packet capture on any
network regardless of packet size, interface type, or
network load. DAG cards have become the industry
gold standard for use in appliances for security and
network monitoring where guaranteed packet capture
is essential.
For more than 15 years, the worlds leading banks,
telecommunications and service providers, government
agencies, e-commerce giants and other enterprises
with high-speed, complex networks have trusted DAG
cards to deliver class-leading reliability, accuracy and
performance for their packet capture applications.
DAG Card Features
PCIe based options from PCIe 1.1 to PCIe 3.0
Ethernet (10/100/1000), 10GBE, 40GbE, SONET/SDH
Single, dual and quad port models available
Hardware-based, enhanced packet-processing
Linux, FreeBSD, and Windows1 drivers
Engineered for high-reliability and extended mean time
between failure (MTBF) rates
Zero-fan cooling reduces failure points
1
Selected DAG card models
Why accurate packet capture is essential
Customers rely on the powerful packet capture and
processing capability of DAG cards to provide their
security and network monitoring solutions with a
complete, detailed and accurately time-stamped
source of packet data.
Ultimately, only a 100% accurate source of network
packets provides the irrefutable evidence needed
to quickly and effectively identify and remediate
security or network performance issues, or comply
with regulatory and governance obligations such as
archiving and lawful intercept. Metadata records or
incomplete, inaccurate sources of captured packets
simply dont deliver the detail necessary to reconstruct
events and resolve issues such as intrusions, data
breaches or network performance problems with
certainty.
The Genius of DAG
DAGs unique power and accuracy results from its onboard FPGA
(field-programmable gate array) which enables smart packet
processing on the card, and its on-board memory buffer which
enables traffic to be captured off the wire at full line rate without
dropping any packets. DAG also uses host memory via DMA to
provide large packet buffers for maximum performance.
DAGs powerful, onboard processing and DMA support removes
packet processing overhead from the host CPU, leaving it free to
service security or network monitoring applications running on
the host and ensuring host performance is not impacted by peaks
in network load.
DAGs unique technology
Delivers guaranteed 100% packet capture at full line rate up
to 10Gbps per port and 40Gbps per card
Leverages Direct Memory Access (DMA) to capture traffic
directly to host memory. This removes interrupt servicing
load from the host servers CPU, freeing it up for application
processing and maximizing server performance
Provides hardware-based, configurable packet-preprocessing
functions such as packet duplication, steering (directing
packets to specific streams) and filtering further reducing
load on the host CPU
Delivers nanosecond accurate hardware time-stamping on
every captured packet. Onboard time sync ports support
synchronization with the host or an external time reference
Provides easy integration with applications via standard
capture formats (PCAP, ERF) and API access to captured data
Supports Linux and FreeBSD (and Windows on selected
models) making it easy to integrate with your chosen
platforms and applications
Is invisible to all other network elements (no MAC or IP
address is assigned to DAG interface ports) making it ideal for
security applications.
The DAG Card Family
DAG 10X2-S
The DAG 10X2-S card is a dual-port card designed for monitoring
and capturing network traffic in mixed 1GbE and 10GbE
environments. Each monitoring port can be configured for either
1GbE or 10GbE links. It is ideally suited for core, enterprise and
cloud network environments and provides onboard classification
for a range of enterprise and encapsulation protocols, such as
MPLS and VLAN types, for load balancing, filtering and traffic
duplication. It also supports relative timed replay for precise
reproduction of traffic as captured for testing, performance
measurement and other purposes.
DAG 10X2-P
The DAG 10X2-P is the premium version of the DAG 10X2-S and
adds support for encapsulated telecom protocols, such as General
Packet Radio Service Tunneling Protocol (GTP) and Generic
Routing Encapsulation (GRE). The DAG 10X2-P also supports up
up to 64 classification rules and increased memory allocation
capability allowing highly sophisticated, onboard classification
for environments with complex data types or other specialized
requirements.
DAG 10X4-P
The DAG 10X4-P is a quad-port version of the DAG 10X2-P. Each
port can be configured to monitor 1GbE or 10GbE links or four
ports can be combined to provide native 40GbE monitoring.
With up to seven cards in an 3RU appliance, the DAG 10X4-P has
extremely low Space, Weight and Power (SWaP) requirements
and can substantially reduce OPEX costs. It is ideally suited where
40GbE monitoring and/or high-density deployment are needed.
Designed for multi-core
DAG technology is highly optimized for modern multi-socket
and multicore CPU architecture. Each CPU or core can have its
own allocated memory space in the buffer so captured packets
can be directed to specific CPUs or cores. This enables efficient
load balancing with full session continuity, (including supported
tunneling protocols) across multiple CPUs, multiple cores and
multiple applications or application instances.
A DAG card for every need
Endace DAG cards are available in a range of models for
monitoring every type of network interface; from entry level cards
for monitoring 10/100/1000 Ethernet links, to cards supporting
10GbE, 40GbE and SONET/SDH links (up to SONET OC192, SDH
STM-64 clear channel or channelized to STS3/STM-1).
With up to 4 monitoring ports per card, DAG cards deliver
industry-leading port density for appliances managing multiple
links saving on rack space, power and cooling and ensuring low
cost of ownership. And with Mean Time Between Failure (MTBF)
rates measured in the hundreds of thousands of hours, DAG
cards are engineered for reliability.
DAG 9.2SX2
The DAG 9.2SX2 is the gold standard for monitoring and
capturing network traffic at high-speed in SONET/SDH, PoS,
ATM and 10GbE environments. It offers sophisticated de-
channelization of SONET OC192 and SDH STM64 down to OC3/
STM1 including PoS and ATM processing, complete capture of
SONET/SDH overhead fields and simultaneous capture of up to
128 channels of payload and overhead data.
The DAG 9.2SX2s powerful SONET/SDH functionality removes
the need for a number of other SONET ADMs and capture
devices, minimizing power, space and cooling requirements, and
substantially reducing CAPEX and OPEX.
DAG 7.5G4
The DAG 7.5G4 is a high-performance, quad-port data capture
card, designed for capturing network traffic at high-speed in
10/100/1000BASE-T and optical 1GbE environments. It provides
flexible memory allocation and powerful on-card, rule-based
filtering, duplication and steering with up to 32 capture
streams. For new designs, where support for 10/100BASE-T is
not required, we recommend the DAG10X2-S, DAG10X2-P or
DAG10X4-P.
DAG 7.4S
The DAG7.4S is a dual port card designed for capturing
concatenated OC-3c/12c/48c or STM-1 VC4c, STM-4 VC4-4c,
STM-16 VC4-16c. It supports Packet over SONET (PoS), ATM
(OC3c/12c only) and RAW SONET frame capture.
For further information on DAG card models and datasheets
for each model, see endace.com/products
Contact Endace
Endace has offices in the US, UK, Australia and New Zealand. For further USA and Americas: +1 877 764 5411
information about Endace products and services or to speak with a United Kingdom, Europe, Middle East
representative, please contact us: and Africa: +44 0800 088 5008
Australia: +61 1800 642 476
Email: info@endace.com New Zealand: +64 9 582 0360
Web: endace.com/products

Endace, the Endace logo and DAG are registered trademarks in New Zealand and/or other countries of Endace Technology Limited. Other trademarks used may be the property of their
respective holders. Use of the Endace products described in this document is subject to the Endace Terms of Trade and the Endace End User License Agreement (EULA).

Copyright Endace Technology Limited, 2016. All rights reserved. endace.com