Abstract

cPacket’s cStor 200S Packet Capture & Analytics Observability Node is positioned as a high-speed capture-to-disk platform for environments where continuous, lossless packet recording is critical, including financial trading, healthcare, and government networks. In Tolly’s evaluation, the 4RU, 220TB cStor 200S was tested on 100GbE links to determine whether it could sustain full packet capture at single- and dual-port line rates, with analytics both enabled and disabled, and while simultaneously performing search and download tasks on captured traffic.  

The core result was consistent zero-loss capture at full operating rates. With one 100GbE interface active, the cStor 200S sustained 100Gbps capture, equivalent to 94.6Gbps effective line rate under the IMIX profile, or 33.4 million packets per second. With two 100GbE interfaces active, it sustained 200Gbps capture, equivalent to 189Gbps effective line rate, or 66.9 million packets per second. Tolly found this linear scaling in both test modes: analytics enabled with 20,000 unique IP endpoints and flows, and analytics disabled with 10 million unique IP endpoints and flows. In both cases, the system captured 100% of full packets with no slicing, filtering, or packet loss.  

The report also highlights operational usability during heavy capture loads. In a search-and-download test run during active capture with analytics enabled, engineers injected a low-rate target stream about 10 minutes into the test, then searched for and downloaded 1,000 specific packets while the unit continued capturing at full rate. Those packets were successfully located and exported in PCAP format out of a traffic set totaling more than 40,140 million packets, and the search task did not affect capture performance. Tolly confirmed the downloaded packets in Wireshark.  

Another notable point is that the unit was equipped with self-encrypting drives for data-at-rest protection, and Tolly reported no performance degradation from encryption in any scenario tested. The platform ran cStor 24.1.5 with cClear 24.2.0 for analytics visibility. Overall, the report presents the cPacket cStor 200S as a high-performance observability appliance capable of sustained 100GbE and 200GbE packet capture, real-time investigative workflows, and encrypted storage without sacrificing throughput.