Introducing n2disk 3.4: 100 Gbit Traffic Dump to Disk

Posted · Add Comment

This is to announce a new n2disk release 3.4. In addition to major performance optimisations with FPGA-based NICs, this release adds new interesting features including the ability to filter traffic based on the application protocol, aggregate traffic from multiple (2+) ZC interfaces, a better disk space management in case of multiple output folders (also from the same volume), and other useful options.

With the current n2disk release and adequate storage, it is now possible on FPGA-based NICs to dump up over 40 Gbit of traffic with a single n2disk instance. This means that if you want to dump 100 Gbit to disk using NVMEs, you can now start 3 n2disk instances each dumping on a separate disk partition a portion of the ingress traffic. With npcapextract you can the aggregate the dumped traffic into a single pcap file.



  • n2disk
    • New –l7-filter-conf option to enable l7 filtering (based on FT)
    • New –time-pulse-precision option to lower CPU load when high-precision is not required
    • Bulk/segment mode capture optimizations and fixes
    • Add support for multiple (more than 2) ZC interfaces
    • Add support for interface index encoding in timestamp (LSB)
    • Improve ‘–disk-limit’ support to take into account multiple folders from the same volume
    • Improve exported flows (ZMQ) in JSON/TLV format, add PEN
    • Improve disk utilization monitoring
    • New option –kernel-cluster-id|-K to set a kernel cluster
    • Improve egress queue flushing when idle with –export-flow-offload
    • Improve /proc stats, add number of exported flows and timeline path
    • Fix exported stats (ZMQ) JSON format
    • Fix for mountpoints with no device (e.g. NFS)
    • Fix storage status check on NFS without no_root_squash
    • Fix disk limit check when indexing is not enabled
  • disk2n
    • Add support for interface index encoding in timestamp (LSB) to select the egress interface
    • Add fully-cached mode to avoid continuously reading from disk when full pcap fits in memory
  • npcapextract
    • Increased max number of timelines from 10 to 16
    • New -C <num> option to stop extraction after <num> packets
    • Fix for filesystems with no I_DIRECT support
    • Improve permission check
  • Misc
    • Add -T option to print first/last TS only to npcapprintindex
    • Add more options to control n2membenchmark