PROFISHARK 1G

INSTALLATION AND CONFIGURATION MANUAL

www.profitap.com

BRINGING CLARITY INTO NETWORKS.
ANYTIME. ANYWHERE.

If you have any questions, you can contact us through our website:www.profitap.com
or by email:support@profitap.com
For the latest documentation and software, visit our Resource Center:
https://www.profitap.com/resource-center/

TABLE OF CONTENTS
Installation

1

1. Unpacking

1

2. Hardware Overview

2

2.1 Technical and Electrical Specifications

4

2.2 Visual Description

5

2.3 LED Functionality

6

3. Connecting Power and Start-Up

6

4. Analyzer Installation

8

Monitoring Guide

9

1. ProfiShark Manager

9

1.1 Counters Tab

10

1.2 Charts Tab

11

1.3 Log Tab

12

1.4 Network Ports Tab

13

1.5 Features Tab

16

1.6 Capture Tab

18

1.6.1 Direct Capture Mode

18

1.6.2 Live Capture Mode

21

1.6.3 Live Capture Mode with Hardware Timestamping

21

2. Long Term Capture

22

Legal

24

INSTALLATION
1. UNPACKING
Carefully unpack all the items supplied with the ProfiShark 1G and retain
the packaging for later use:◉

1 x ProfiShark 1G main unit◉

1 x Transport pouch◉

1 x Ethernet cat5e cable (2 m)◉

1 x USB 3.0 cable (1.8 m)◉

1 x USB key (Software, Drivers, Documentation)◉

Quick Start Guide▶

NOTE: Please contact the supplier if any part is missing or damaged.

12. HARDWARE OVERVIEWThe ProfiShark 1G is an integrated network TAP providing safe access to the network
for monitoring purposes. It is a non-intrusive monitoring device, undetectable tothe network, leaving the original data traffic unaltered with no extra packets being
inserted.
In a gigabit network, the ProfiShark 1G negotiates with both attached devices forthe highest common speed. If no common speed can be achieved, or if one of thedevices is disconnected, the TAP disconnects the line to the other attached device,
allowing a redundant path to be activated in the network route node.
As it is based on USB 3.0 (5 Gbps), the ProfiShark 1G manages full-duplex
gigabit capturing at wirespeed, without the bottleneck of an aggregator tap. It
also surpasses all standard NICs in capture mode, as it catches any tags andencapsulation without altering the frames.
When the TAP becomes unpowered, it activates its bypass circuits, connecting thetwo attached devices directly. The ProfiShark 1G integrates a high performance fast
failover circuit and a proprietary algorithm, reducing the unavailability of the network
path down to approximately 1-2 seconds.
The ProfiShark 1G is powered directly from the USB 3.0 port. A dedicated power
adapter can be used to prevent failover when disconnecting the USB 3.0 port. The
unit can be managed by the ProfiShark Manager application, found on the supplied
USB key or downloadable from the Profitap Resource Center.

2

FEATURES:◉

10/100/1G monitoring on USB 3.0◉

USB 3.0 powered, no adapter required◉

Hardware aggregation◉

8 ns hardware timestamping for accurate latency testing◉

Real time statistics◉

Compatible with all industry standard analyzers◉

Fail-safe monitoring◉

Low delay, low jitter◉

Low level error and bandwidth monitoring◉

CRC error capture◉

Direct capture to disk◉

In-Line and SPAN (Dual NIC) capture modes◉

Very low CPU usage◉

Invisible to the network◉

PoE passthrough▶

NOTE: The fast failover relies on the network setup. In case the fast
failover cannot be performed, the devices connected to ports A and B
have to renegotiate the link. This operation takes about 2-4 seconds.

3

2.1 Technical and Electrical Specifications◉

Powered from USB 3.0 port◉

Optional 5V 1A DC powering for failover prevention◉

Active bypass and fast failover circuits

SYSTEM REQUIREMENTS

MAXIMUM NETWORK LATENCY

Dual Core Processor

1 Gbps: 380 ± 8 ns

4 GB memory

100 Mbps: 720 ± 24 ns

USB 3.0 port

10 Mbps: 7600 ± 25 ns

LEDS

POWER CONSUMPTION (FULL TRAFFIC)

2 x Speed

1 Gbps: 600 mA

2 x Link Activity

100 Mbps: 450 mA

1 x Power

10 Mbps: 520 mA

CONNECTORSACCESSORIES

2 x RJ45 8 pins

1.8 m USB 3.0 cable

1 x USB 3.0

2 m Ethernet cat5e cable

1 x 5V DC (center positive)

USB key, Transport pouch

DIMENSIONS (WxDxH)

SUPPORTED OS

69 x 124 x 24 mm

Windows 7 / 8 / 10 (32/64-bit) / 11

2.72 x 4.88 x 0.94 in

Linux, macOS High Sierra

CAPTURE PERFORMANCE
3.2 Gbps
WEIGHT

STORAGE TEMPERATURE

176g — 0.39 lb-40 to +80 °C — -40 to 176 °F

RELATIVE HUMIDITY

OPERATING TEMPERATURE

10 to 95%, non-condensing

0 to +50 °C — 32 to 122 °F

COMPLIANCE

ORDER REFERENCE

RoHS — CE — EN 45545-2

C1AP-1G

4

2.2 Visual Description

1, 2

RJ45 Ethernet ports A and B

3

Power indicator LED

4

Optional DC power input (5V, 1A, center positive)5

USB 3.0 port type B

6, 9

Link/Activity LEDs

7, 8

Speed LEDs5

2.3 LED Functionality
LED

LED 3

STATE

MEANINGOFFNo USB cable nor power cable are connectedON

USB cable and/or power cable are connected

BLINKING

Constant synchronization between system timeand hardware timestamp (blink ON every evensecond, blink OFF every odd second)

LED 7

ON

ProfiShark 1G is operating at 10 Mbps speed

LED 8

ON

ProfiShark 1G is operating at 100 Mbps speed

ON

ProfiShark 1G is operating at 1 Gbps speed

BLINKING

ProfiShark 1G is not connected or is trying toconnect

ALTERNATINGBLINKING

ProfiShark 1G cannot find a common speed
between the connected devices

LED 7 + LED 8

ON
LED 6, LED 9

BLINKING

The port is linked
The port is linked and has RX/TX activity (traffic ispassing through)3. CONNECTING POWER AND START-UP
In order for the ProfiShark 1G to be ready for analyzing traffic, the following steps
have to be taken:
1.

Install the ProfiShark Manager.

2.

Launch the ProfiShark Manager.

3.

Launch the software network analyzer.

4.

Tap the line that will be monitored by interconnecting the ProfiShark 1G in
between, using Ethernet cables.
6

▶

NOTE: The link must be connected to the unpowered ProfiShark 1G at
first. Make sure the link is active before powering the ProfiShark 1G.

5.

Connect the ProfiShark 1G to a computer, using the supplied USB 3.0
cable.

▶

NOTE: Connecting to a USB port of lower specification than USB 3.0 will
result in data drops, due to bandwidth limitations.

▶

NOTE: Connecting the ProfiShark 1G to a different USB port than the oneused during the installation requires a reboot of the computer (with theProfiShark connected) for automatic driver installation for this USB port,
and proper handling of the interface by Windows.

6.

Optional: Connect a dedicated power supply to the ProfiShark 1G toensure maximum fail-safe operation at all times. In the absence of a
dedicated power supply, the ProfiShark 1G is powered through the USB
3.0 cable.

7

To install the ProfiShark Manager on Windows, launch the setup utility located in the“\Windows\Installer\” folder of the USB flash drive. Uninstall any previous version of
the ProfiShark Manager before starting the setup utility.
1.

Allow the installation to proceed when prompted by Windows User AccountControl, and follow the on-screen instructions.

2.

When prompted, disconnect and reconnect the ProfiShark 1G.

3.

Wait for the installation to complete.

4.

Click Launch.

▶

NOTE: The setup utility will create a launch icon in your start menu.

To install the ProfiShark Manager on Linux or macOS, follow the instructions in
the Installation.txt file located on the USB key or in the latest “ProfiShark USB key”
release located in the Resource Center at www.profitap.com/resource-center/

4. ANALYZER INSTALLATION
All industry standard analyzers are supported and can be used to perform theanalysis.
A comprehensive list of compatible analyzers are listed on the ProfiShark 1G productpage at: www.profitap.com
Wireshark is recommended, and can be downloaded at: www.wireshark.org
To start capturing network data, launch the preferred network analyzer and selectthe new network interface named “ProfiShark 1G Device”.
8

MONITORING GUIDE
1. PROFISHARK MANAGER
ProfiShark Manager is a standalone application designed and developed by Profitap.
It provides means for statistical analysis of a network prior to a deeper investigation
using an analyzer. It also provides options for port diagnostic, port control,
timestamping, and traffic capture.
A built-in utility allows flashing the firmware and updating the device online or using
a locally stored file. ProfiShark Manager can be used simultaneously with a software
network analyzer, without the need to interrupt data capture.
ProfiShark Manager functionalities are grouped in the following tabs:◉

Counter Tab◉

Charts Tab◉

Log Tab◉

Network Ports Tab◉

Features Tab◉

Capture Tab

91.1 Counters Tab
The Counters tab displays all the ProfiShark 1G built-in counters for both Ethernet
ports. These 64-bit hardware counters are cleared at hardware startup and linkreconnection.

VALID

Representing the number of valid packets (of any

PACKETSsize) passing through the port.

INVALID

Representing the number of CRC error packets (ofPACKETSany size) passing through the port.

< 64

64 - 1522> 1522

Representing the number of packets (valid/invalid),
not exceeding 64 bytes in size.
Representing the number of jumbo packets, also known as jumbo
frames (valid/invalid) with a size between 64-1522 bytes.

Representing the number of packets (valid/invalid)
exceeding jumbo packet specifications of 1522 bytes in size.

There are also 6 graphical meters (3 for each port), displaying current bandwidth
usage, average bandwidth usage, and average CRC error rate for each port.
101.2 Charts Tab
The Charts tab offers inspection of the same statistical information as the Counterstab, plotted over time, offering a better overview of the data flow.

Depending on the type of packets or events selected in the left side of the screen,
the statistical data is plotted accordingly for either port A or B. Refresh rate can also
be selected using the drop-down list on the top left, further tuning the displayed
information.
All data can be expressed either in number of packets per second, or in a percentageof the total number of packets:◉

By selecting packets/s, each data type displays the corresponding number ofpackets per second, except for the bandwidth usage which is displayed in bytes
per second.

◉

By selecting percentage, each data type is displayed as a percentage of thetotal number of packets, except for the bandwidth usage which is displayed inpercentage of the total bandwidth.
11

The plotted statistical data can be reset by clicking the Clear All button.
Disconnecting the ProfiShark 1G also resets the plotted statistical data.

1.3 Log Tab
The Log tab allows the user to monitor bandwidth usage and CRC error rate on
either port A or port B. Every time the threshold is exceeded, a log entry is added,
allowing to easily identify the type, date, and port of the event.
A certain degree of filtering can be applied on the logs, only displaying events
matching the specified percentage.

BANDWIDTH USAGE: Select this option to only log traffic events exceeding theset value. This value represents a percentage of the total 1 Gbps bandwidth. For
instance, a value of 5.5 will result in only logging traffic events exceeding 56.32 Mbps
(1024 * 0.055).
CRC ERROR: Select this option to only log CRC error events exceeding the set
value. This value represents a percentage of the traffic passing through the port. For
instance, a value of 5.5 will result in only logging traffic events with a CRC fault rate
exceeding 5.5% of the traffic passing through the port.
121.4 Network Ports Tab
The Network Ports tab allows the customization of ports settings for the ProfiShark
1G, and offers an overview of the ports’ status and link capabilities.

The ProfiShark 1G ports are set to In-Line Mode by default (SPAN Mode option
unchecked), meaning that devices connected through ports A and B cancommunicate. In this case, both Ethernet ports are controlled at the same time.
Enabling SPAN Mode tells the ProfiShark 1G to intercept two separate data streams,
and the communication between the devices connected to ports A and B is severed.
In this case, the Ethernet ports can be controlled independently in terms of speed,
duplex mode, and autonegotiation.

PORTS CONTROL VIEW
Checking this option tells the ProfiShark 1G to intercept
SPAN MODEa separate data stream for each port. Each port can becontrolled independently. Unchecking the option sets theProfiShark to In-Line Mode.
13

LOOPBACKThis feature is only available for ProfiShark 10G.
This feature tries to link the two network devices on the highest
possible speed out of those selected for each port (1000TX-FD,

AUTO

100TX-FD/HD, 10TX-FD/HD). Enabling this feature also allows to

NEGOTIATION

select flow control features (Asymmetric/Symmetric Pause) andestablish or force the Slave/Master device.
▶

Note: This option is required for 1 Gbps speeds.

If the Auto negotiation feature is enabled, multiple speeds canbe selected in this section (1000, 100 or 10 in Full or Half Duplex

1000TX-FD/HD,
100TX-FD/HD,
10TX-FD/HD

mode) and a link will be attempted at the highest possible speed.
If the Auto negotiation feature is disabled, only one speed can beselected in this section (10/100 in Full or Half Duplex mode) forcing
the link to be established at the selected speed.
▶

Note: If no common speeds are selected for port A and B(only in SPAN Mode) a link cannot be established.

ASYMMETRIC/

These features are flow control related, regulating traffic in cases

SYMMETRIC

of buffer overflow situations.

PAUSE

▶

Note: Only available if the Auto negotiation feature is enabled.

Enabling this feature signals to the negotiation process that the

FORCE MASTER/
SLAVE

network device connected to this port is desired to be the Slave
device.
▶

Note: Only available if the Auto negotiation feature is enabled.

Enabling this feature signals to the negotiation process that the

MASTER

network device connected to this port is forced to be the Masterdevice.
▶

Note: Only available if the Auto negotiation feature is enabled.

14

FORCE

Enabling both features signals to the negotiation process that the

MASTER/

network device connected to this port is forced to be the Master

SLAVE &

device.

MASTER▶

Note: Only available if Auto negotiation feature is enabled.

A comprehensive status of network capabilities is displayed on the left side panel,depending on the customization done in Port A Configuration / Port B Configuration.

15

1.5 Features Tab
The Feature Tab is divided into 3 sections:◉

The Status section, displaying firmware, hardware and network status for theconnected ProfiShark 1G.

STATUSSOFTWARE
DROPPED
PACKETS◉

Represents the number of packets dropped by the driver inLive Capture mode.

HARDWARE

Represents the number of packets dropped due to low USB

DROPPEDbandwidth, for example when connecting the ProfiShark 1G

PACKETS

to a USB 2.0 port and attempting a 1 Gbps capture.

The Firmware Update section, allowing users to flash the firmware of theconnected ProfiShark 1G with a locally stored version. The ProfiShark 1G isunavailable during the firmware update process, which can take up to several
minutes to complete. Once finished, the ProfiShark 1G may need to be replugged
for the new firmware to take effect. Do not disconnect the USB port or shutthe computer down during the update process. The latest firmware can be
downloaded from the Resource Center at:
www.profitap.com/resource-center/▶

Note: The ProfiShark Manager will search for a new firmware release
online every time it starts, allowing a new revision to be downloaded andinstalled, without the need of a locally stored update.

16

◉The Capture Format section, allowing users to enable or disable capture-related
features. Additional customization of the capturing process is available in the
Capture tab.

CAPTURE FORMATENABLEIf checked, a Unix formatted timestamp is appended in the

TIMESTAMPS

header of the packet data. This timestamp can be interpreted

IN LIVE

by the Profitap Wireshark dissector in Live Capture mode.

CAPTUREFor more information, see page 21.

TRANSMITCRC ERRORS

If checked, the ProfiShark 1G will include packets with CRC
errors in the capture. These packets are usually filtered out
by network interfaces.

17

CAPTURE FORMAT
If checked, the CRC32 information (32-bit Frame Check

KEEP CRC32

Sequence) located at the end of the packets will be kept in thecapture. FCS can be interpreted in Wireshark (Edit \ Preferences \Protocols \ Ethernet \ Assume packets have FCS).

DISABLEIf checked, frames from port A will not be captured.

PORT ADISABLEIf checked, frames from port B will not be captured.

PORT B

PACKETSLICING

Enabling this feature will result in dropping the payload of
every frame captured, keeping only the header information(the first 128 bytes) up to the application layer.

1.6 Capture Tab
1.6.1 Direct Capture Mode
ProfiShark 1G can capture traffic without the need for third-party capture software.
This Direct Capture is performed at the driver level, prior to all network stacks andframe processing. Direct Capture provides the best performance, enabling small
packet capture at wire speed.
The Capture tab contains the controls for the Direct Capture feature. The captured
data is saved to a PCAP Next Generation file (.pcapng) with hardware-generated
packet timestamps. ProfiShark Manager also provides an option for uploading
capture files to Cloudshark.

18

OUTPUTCAPTURE FILECAPTURE FULL
FRAMESMAXIMUM
CAPTURE
FILE SIZENUMBER OF
FILES TO USEMAXIMUM
FILE
DURATION

Specify the name and location of the capture file. Name extension
will be added to the specified name:(_#####_YYYYMMDDHHMMSS).
Enable this option to capture the entire L1 Ethernet frames, which
include the preamble (0x55), the SMD, and the CRC. This can be
useful for TSN (Time-Sensitive Networking) capture.
Sets the maximum file size allowed for storing the captured data.
When the file size reaches this value, the capture either continues
in a new file, or stops, depending on the other options.
After reaching the configured maximum duration or file size, thecaptured traffic will be saved to a new file, until the number of files
set here is reached.
Sets the maximum duration for storing the captured data. When
this value is reached, the capture either continues in a new file, or
stops, depending on the other options.

19Enabling this option makes the capture overwrite the same fileLOOP(or files, depending on the “Number of Files to Use” option) after
reaching the configured maximum duration or file size.
In high bandwidth utilization scenarios, a bigger buffer size

BUFFER SIZE

accommodates more data to be temporarily stored into thecomputer’s memory before being saved to the file, helping to avoid
captured data being dropped.
Written to File - Performance statistics. Displays the amount ofdata currently written in the output file, helping users determine
the best buffer size.

STATISTICS

Dropped - Dropped bytes. Indicates the amount of data dropped
during the capture, due to performance issues or buffer overflow.
Current buffer usage - If dropped packets start to appear(“Dropped” statistic), increase the Buffer Size value.

UPLOAD PCAP-NG
FILES TO
CLOUDSHARKAPPLIANCE URL

API TOKEN

Enable this option to upload capture files to Cloudsharkautomatically.
Set the appropriate URL of the Cloudshark server on which to
upload the capture files.
Set the appropriate token for the Cloudshark server set above.
Optional display filter for the capture files uploaded to Cloudshark.

DISPLAY FILTER

Regular Cloudshark/Wireshark display filters can be set here.
See: https://wiki.wireshark.org/DisplayFilters▶

Note: The amount of dropped data depends on the data storage
throughput and the amount of allocated memory buffer. Disk arrays or
SSDs can drastically improve capture performance.

201.6.2 Live Capture Mode
ProfiShark 1G can also be used to capture network traffic and send it unaltered to a
dedicated capture software. The process is transparent for packet size, packet type,
and protocol. All tags and encapsulation are preserved (e.g. VLAN, MPLS, GRE).

▶

Note: Capturing traffic at 1G line rate is extremely CPU intensive and cancause software packet drops. For better performance, Direct Capturemode is recommended.

1.6.3 Live Capture Mode with Hardware Timestamping
The hardware timestamping feature can be used in both Live Capture and Direct
Capture modes. It enables timestamp accuracy to the nanosecond, as opposed tothe microsecond accuracy of software timestamping.
When using this feature in Live Capture mode, the ProfiShark Dissector for
Wireshark must be installed for the hardware timestamping information to beproperly interpreted by Wireshark.
The dissector files can be found on the provided USB key, or in the Resource Centerat www.profitap.com/resource-center/
Hardware timestamping can be enabledfrom the Features Tab, by selecting“Enable timestamps in live capture”.

21

2. LONG TERM CAPTURE
The long-term capture feature expands the number of use cases for ProfiShark 1G.
By combining the capture capabitilies of ProfiShark 1G with the storage capabilities
of a NAS, it becomes possible to capture traffic for extended periods of time, making
it easier to catch intermittent network problems in the act.
The ProfiShark USB key package (included with the product, and also available
at profitap.com/resource-center/) provides packages for various Synology
architectures.
Install the package corresponding to your Synology NAS. See the image file includedin the packages folder for information on the type of CPU used in your Synology
NAS.
For optimal capture results, an Intel-equipped Synology NAS is recommended.

22

DEVICE STATUS
CAPTURESTATUSTOTALCAPTURED

Displays the connected TAP and its MAC address.
Specifies whether the capture process is in progress.
Displays the total amount of data captured.

DROPPED BY

Displays the amount of packets dropped due to performance issues or

SOFTWARE

buffer overflow.
By default, the ProfiShark 1G ports are set to In-Line Mode, meaningthat devices connected through ports A and B can communicate.
In this case, both ports are controlled at the same time. Unchecking

INLINE“Inline ports” enables SPAN mode, setting the ProfiShark to intercept

PORTS

two separate data streams. In this case, communication between
devices connected to ports A and B is severed, and ports A and B
can be controlled independently in terms of speed, duplex mode, andautonegotiation.

CAPTURE

Allows users to select the destination folder of the capture file.

DIRECTORYRING
BUFFER

MAXIMUM
FILES

MAXIMUM
FILE SIZE

If enabled, overwrites old data, using the circular buffer method ofstoring new data at the beginning of an existing data file.
After reaching the configured maximum file duration or size, thecaptured traffic will be saved in a new file, until the number of files
configured here is reached.
This option sets the maximum file size allowed for storing the captured
data. Exceeding this value will result in stopping the capture or storing
the capture data in a new file.

MAXIMUM FILE
DURATIONSTATISTICS

This option sets the maximum duration for storing the captured data.
Exceeding this value will result in stopping the capture or storing thecapture data in a new file.
Displays ongoing and total traffic data for both port A and port B.

23

LegalDISCLAIMER
The manufacturer makes no representations or warranties with respect to thecontents hereof and specifically disclaims any implied warranties of merchantability
or fitness for any particular purpose. The manufacturer reserves the right to revise
this publication and to make changes in the content thereof without obligation of the
manufacturer to notify any person of such revision or changes.
COPYRIGHT
This publication, including all photographs and illustrations, is protected underinternational copyright laws, with all rights reserved. Neither this manual, nor anyof the material contained herein, may be reproduced without written consent of theauthor.
TRADEMARKSThe trademarks mentioned in this manual are the sole property of their owners.

24

FOR MORE INFORMATION:

www.profitap.com

profitap-international@Profitap

Profitap

Profitap HQ B.V.

25

PROFITAP HQ B.V. — High Tech Campus 84
5656AG Eindhoven — The Netherlands
sales@profitap.com
www.profitap.com© 2023 Profitap — v5.5-11