Aug 2011 NetHawk M5 Analyzer versus Wireshark - Benefits of using a state-of-the-art product instead of freeware NetHawk M5 Analyzer versus Wireshark - Benefits of using a state-of-the-art product instead of freeware

2 © 2010 EXFO Inc. All rights reserved.. 2 © 2011 EXFO Inc. All rights reserved. M5 Analyzer and WireShark Decoder in brief M5 Analyzer from EXFO NetHawk ›NetHawk is trusted partner in wireless testing since 1991 ›Launched in 2005, the M5 combines software for UTRAN, GSM and Core Analysis ›Over 1500 analyzer licenses sold to over 150 customers › 400+ protocols supported (thousands if baseline versions or applications are calculated too) ›Preferred or Approved supplier at Top-5 Network Equipment Manufacturers WireShark ›First working version of project originally name Ethereal released around (May 2006 the project was renamed Wireshark due to trademark issues) ›Released under GNU GPL license, one person owns the copyrights. In 2010 Riverbed Technology purchased CACE and took over as the primary sponsor of Wireshark ›24 Protocol families – main focus at enterprise and application protocols ›Free opensource application – support and development by community only

3 © 2010 EXFO Inc. All rights reserved.. 3 © 2011 EXFO Inc. All rights reserved. Main Reasons to Choose the M5 Analyzer › Performance and Reliability ›Professional tool with warranty and continuous development adding new technologies › Scalable tool with line-rate capture and processing › Designed for Mobile networks ›The most complete support for 2G/3G/LTE and Core networks with vendor specific proprietary decoders and network security deciphering ›Additional easy to use timesaving applications for statistics, KPI’s, call tracing, etc. Does your testing team need a tool that can trace a large number of calls and correlate different interfaces in realtime? -Then the M5 is the tool for interoperability and live network analyzing. A single source of information.

4 © 2010 EXFO Inc. All rights reserved.. 4 © 2011 EXFO Inc. All rights reserved. Performance and Reliability ›M5 Protocol Analyzer Hardware is selected and tuned for performance. ›To provide real-time capture and analysis of live traffic, EXFO NetHawk has a team of professional engineers selecting, building and tuning the various hardware and software components of the company’s offerings. ›Loading WS onto a PC, even one with the best performance possible, cannot compare in terms of real time capture and storage. WS forum …

5 © 2010 EXFO Inc. All rights reserved.. 5 © 2011 EXFO Inc. All rights reserved. Time = Money ›In Product Development, Field Trials, Troubleshooting; Time = Money ›During an LTE development or roll-out project, explain the use of WS to management? ›“We’re trying to fix bugs in the freeware and getting help in online forums” ›“The freeware doesn’t yet support the latest standard” ›When a network is down, you don’t want to be stuck with a Freeware based tool. ›Need new features for a WS based tool? ›Contract developers ? ›Or use your own teams time? ›Do you put your project on hold while waiting? You wouldn’t fly in an aircraft that runs on Freeware, so why risk your job on it?

6 © 2010 EXFO Inc. All rights reserved.. 6 © 2011 EXFO Inc. All rights reserved. Freeware can get Expensive ›Free stuff!? (Not really) WS aditional costs include ›R&D time -> How to install, build, configure, operate ›Schedule delays(or halt) while waiting for answers from public forum ›Delays due to hidden software bugs in Freeware › In fact it often costs more money to use Freeware than professional solutions. ›EXFO NetHawk’s professional tools ›Professional support ›Quick response › Freeware technical support is “hit and miss” ›Software bugs in Freeware are hidden and no one has the responsibility to fix them.

7 © 2010 EXFO Inc. All rights reserved.. 7 © 2011 EXFO Inc. All rights reserved. Technical Credibility ›EXFO NetHawk ensures its solutions are up to date with the latest revisions of protocols. ›EXFO also follows each new release of published standards e.g. from 3GPP ›When highlighting interoperability issues between networks and equipment it is nice to know that you have an accurate and up to date M5 Protocol Analyzer for the job. ›M5 engineers interact with all major equipment vendors on a daily basis. ›EXFO is always ready to answer your technical questions and to help you confirm your findings. Such service is not available for freeware.

8 © 2010 EXFO Inc. All rights reserved.. 8 © 2011 EXFO Inc. All rights reserved. Freeware exposes your info ›Getting answers for Freeware issues ›It’s a Public forum, competitors also review ›In accordance with legal agreements? ›EXFO NetHawk support ›Confidential, secure ›From the experts

9 © 2010 EXFO Inc. All rights reserved.. 9 © 2011 EXFO Inc. All rights reserved. Your modifications to freeware, becomes freeware ›If you use freeware as part of the products you deliver, beware. ›The GPL imposes conditions on your use of GPL'ed code in your own products ›If your company produces a "derived work" from Wireshark, your customers must be allowed to give away the resulting work. ›You must also make the changes you've made to the Wireshark source available to all recipients of your modified version; those changes must also be licensed under the terms of the GPL. FREEWARE INSIDE

10 © 2010 EXFO Inc. All rights reserved.. Comparison: WS Freeware vs. M5 Product

11 © 2010 EXFO Inc. All rights reserved.. 11 © 2011 EXFO Inc. All rights reserved. Tens of Thousands of Sessions over LTE Network? ›M5 can handle tens of thousands calls with the C&S application ›Wireshark can only handle one call at a time ›Wireshark does not have LTE Session analysis ›Wireshark simply doesn’t work in live network troubleshooting, system testing and shared test laboratories ›M5 can handle multiple gigabits of single or periodic trace file data ›Wireshark is out of memory after a few hundred megs of signaling data

12 © 2010 EXFO Inc. All rights reserved.. 12 © 2011 EXFO Inc. All rights reserved. Encrypted Signaling—Automatic LTE NAS Deciphering ›NAS deciphering is mandatory in testing the live network ›M5 can decipher NAS-ciphered session in real-time without limitations on the number of sessions ›Wireshark does not have NAS deciphering at all

13 © 2010 EXFO Inc. All rights reserved.. 13 © 2011 EXFO Inc. All rights reserved. Monitoring a Specific Session M5 WireShark ›With WS, 1 message is showing details from multiple different calls. It can’t sort the data into separate clear messages. ›With intelligent M5 SCTP chunk filtering, it is possible to isolate the signal messages of a single session

14 © 2010 EXFO Inc. All rights reserved.. 14 © 2011 EXFO Inc. All rights reserved. Applications: Decoding M5: Fully adjustable views for quick detailed analysis:

15 © 2010 EXFO Inc. All rights reserved.. 15 © 2011 EXFO Inc. All rights reserved. Message Flows: M5 vs. Wireshark (not in real time) M5

16 © 2010 EXFO Inc. All rights reserved.. 16 © 2011 EXFO Inc. All rights reserved. Applications: Call & Session Analysis ›M5: extremely powerful tool from one session test case to live troubleshooting ›Wireshark: no call and session analysis at all

17 © 2010 EXFO Inc. All rights reserved.. 17 © 2011 EXFO Inc. All rights reserved. Call & Session Analysis User Cases ›Tracking or filtering with user IDs over multiple interfaces (IMSI/GUTI (M-TMSI) ) ›Finding the reason for dropped or failed sessions

18 © 2010 EXFO Inc. All rights reserved.. 18 © 2011 EXFO Inc. All rights reserved. LTE Air Interface Support, S1 C & S and Correlation

19 © 2010 EXFO Inc. All rights reserved.. 19 © 2011 EXFO Inc. All rights reserved. Applications: User-Plane Analysis Live update of KPIs. ›M5: Graphical throughput/flow analysis ›1-10 Gbit/s line rate ›WS: some counters with poor throughput (<20 Mbit/s) ›WS Limited by the speed of your own laptops NIC card

20 © 2010 EXFO Inc. All rights reserved.. 20 © 2011 EXFO Inc. All rights reserved. Throughput Measurements Directly from C&S ›Throughput measurements are taken with the C&S analyzer using iPro DB ›Easy access to graphical throughput measurement report (right click menu)

21 © 2010 EXFO Inc. All rights reserved.. 21 © 2011 EXFO Inc. All rights reserved. Detailed Protocol Help Files in M5 (e.g., LTE S1-AP)

22 © 2010 EXFO Inc. All rights reserved.. 22 © 2011 EXFO Inc. All rights reserved. More Reasons to Choose the M5 Analyzer ›Clear and graphical illustrations of all different interfaces ›Multisession support ›LTE Session Correlation over all the interfaces ›LTE NAS Deciphering support (not available openly in Wireshark) ›Real-time support for user-plane analysis up to line rate (with iPro) ›M5 Sampo 3.0, supports up to 10 simultaneous users ›Full user-plane analysis and capturing capacity ›NSN eNB internal interface support: real-time feed of LTE air interface signaling to M5 Analyzer ›As M5 is a professional tool, the user can troubleshoot or create test reports 10 times faster than using Wireshark

23 © 2010 EXFO Inc. All rights reserved.. 23 © 2011 EXFO Inc. All rights reserved. NetHawk M5 vs. Wireshark Comparison Table NetHawk M5 Wireshark Copy/paste Yes, complete calls, colors, csv, etc.Only one row or packet Filtering on hardware level YesNo Accurate time stamping for delay measurements YesNo Support for several Ethernet adapters simultaneously YesNo Dynamic Iub and Abis support YesNo Support for Iub f8 and LTE NAS deciphering YesNo Documentation Yes, complete protocol and GUI help Poor Multi-user support Yes No Call tracing All technologiesSip only User-plane and control-plane correlation YesNo Call correlation over interfaces Yes over all technologiesNo Product support Yes (four yearly releases with updates and improvements No (same well-known bugs after years)