1

Package contents• 1 x ProfiShark 1G or 1G+ main unit
• 1 x USB key containing drivers,
software and manual• 1 x USB 3.0 cable• 1 x RJ45 cable• 1 x GPS/GLONASS Antenna (1G+ only)• 1 x Carrying pouch

For any questions, technical or otherwise,
contact our customer support
through our website:or by email:For the latest documentation and software,
visit our Resource Center:2

Table of contents
4 General Information
5 Network TAP
6 ProfiShark 1G Visual Description
7 ProfiShark 1G+ Visual Description
8 Driver Installation
8 Analyzer Installation
9 ProfiShark 1G Manager:
9 - Installation
9 - Description
9 - Statistics
9 - Counters
11 - Charts
12 - Log
12 - Network Ports Diagnostic
14 - Features
16 Packet Capture:
19 - Live Capture Mode
20 - Direct Capture Mode
21 - Direct Capture Setup
22 - Timestamping
23 - Advanced Timestamping
26 Additional Information
3

General Information

ProfiShark 1G is a handheld plug and play device dedicated toin-line Gigabit Ethernet monitoring. It facilitates field traffic
capture and troubleshooting. It is equivalent to a 10/100/1G
aggregator tap and two 1 Gbps NICs. All-in-one in a pocketsized box, the only additional hardware required being a laptop
or desktop PC with a free USB 3.0 port.
As it is based on USB 3.0 (5 Gbps), the ProfiShark 1G manages
full-duplex gigabit at wirespeed, without the bottleneck of anaggregator tap. It also surpasses all standard NICs in capturemode, as it catches any tag and encapsulation without altering
the frames.
ProfiShark 1G is the perfect tool for the field engineer as well
as for long-term traffic collection.

Features- 10/100/1G monitoring on USB 3.0- USB 3.0 powered, no adapter required- Fail-safe monitoring- Low delay, low jitter- Hardware aggregation- 8 ns hardware timestamping for accurate latency testing- Real time statistics- Low level error and bandwidth monitoring- CRC error capture- Capture any packet with any analyzer- Direct capture to disk
- Dual NIC mode (SPAN)- Very low CPU usage- Invisible to the network

4

Network TAP
The ProfiShark 1G integrated network TAP provides safe
access to the network for monitoring purposes. It is a passive
monitoring device, in the sense that it is undetectable, theoriginal traffic staying unaltered and no extra packets being
inserted. As most of the TAP’s functions are performed bydedicated hardware circuits, it is much more reliable and error
proof than SPAN ports.
In a gigabit network, the TAP has to negotiate with both
attached devices for the highest common speed. If no common
speed can be found, or if one of the devices is disconnected,
the TAP propagates the error to the other attached device,
allowing a redundant path to be activated.
In case of power failure, it activates its bypass circuits,connecting the two attached devices directly. The ProfiShark
1G integrates a high performance fast failover circuit anda proprietary algorithm, reducing the unavailability of the
network path down to 30ms.
NOTE The fast failover relies on the network setup. In casethe fast failover cannot perform, the two end devices have torenegotiate the link. This operation takes about 2 seconds.

NOTE The user should verify that the two end devices connect
together with either a single cable, an RJ45 coupler, or theunpowered TAP. The straight or crossover cables must be
employed in case of end devices that do not support Auto MDI/
MDIX operation (i.e. Auto Crossover). Experienced users can
bypass this procedure.
NOTE Although some vendors recommend the use of the
non-IEEE compliant “Forced Gigabit” mode, we strongly
recommend activating auto-negotiation when Gigabit speed isrequired. More generally, auto-negotiation should always beenabled on both end devices in order to avoid duplex mismatch
issues.

5

ProfiShark 1G Visual Description
5
6 7

1

8

9

4

3

2

1 - Port A (RJ45) connected to the network
2 - Port B (RJ45) connected to the network
3 - Power indicator LED
4 - USB 3.0 connector linked to your monitoring device(i.e. a laptop computer)5 - Optional DC input (5V/1A)
6 - 7 - 8 - 9 - The ProfiShark’s state is displayed on the front
LEDs. LEDs functions are named on top of the ProfiShark.
TAP functions:
Steady LED 10 (7): TAP is operating at 10 Mbit/s
Steady LED 100 (8): TAP is operating at 100 Mbit/s
Steady LED 10 (7) + LED 100 (8): TAP is operating at 1000 Mbit/s
Steady Link/Activity (6)(9): the port is linked up
Blinking Link/Activity (6)(9): the port is linked up and has RX/TX
activity
Blinking LED 10 (7) + LED 100 (8): TAP not connected or trying
to connect
Alternating LED 10 (7) + LED 100 (8): TAP cannot find a common
speed between network A and network B
General functions:
Blinking LED 10 (7): The ProfiShark is initializing
Blinking LED 100 (8): The ProfiShark HW firmware is corrupted

6

ProfiShark 1G+ Visual Description
9 10

1

8

7

6

11 12

2
3

4

5

1 - Port A (RJ45) connected to the network
2 - Port B (RJ45) connected to the network
3 - PPS input (SMA Female)
4 - GNSS (GPS/GLONASS) antenna input (SMA Female)
5 - Sync LED
6 - Power indicator LED
7 - Optional DC input (5V/1A)
8 - USB 3.0 connector linked to your monitoring device(i.e. a laptop computer)9 - 10 - 11 - 12 - The ProfiShark’s state is displayed on the front
LEDs. LEDs functions are named on top of the ProfiShark.
TAP functions:
Steady LED 10 (10): TAP is operating at 10 Mbit/s
Steady LED 100 (11): TAP is operating at 100 Mbit/s
Steady LED 10 (10) + LED 100 (11): TAP is operating at 1000 Mbit/s
Steady Link/Activity (9)(12): the port is linked up
Blinking Link/Activity (9)(12): the port is linked up and has RX/TX
activity
Blinking LED 10 (10) + LED 100 (11): TAP not connected or trying
to connect
Alternating LED 10 (10) + LED 100 (11): TAP cannot find acommon speed between network A and network B
Steady Sync LED (5): the internal timestamping is synchronizedwith the UTC time with a ± 16ns precision
General functions:
Blinking LED 10 (10): The ProfiShark is initializing
Blinking LED 100 (11): The ProfiShark HW firmware is corrupted

7

Driver Installation
Drivers are available for Windows 7 32/64 bits, Windows 832/64 bits, and Linux.
ProfiShark 1G Windows drivers are included in the ProfiShark
1G Manager. Please refer to the ProfiShark 1G Manager
Installation section of this manual.
After having installed the ProfiShark 1G Manager, connect theProfiShark 1G on a free USB 3.0 port and the drivers should
install automatically. For a manual installation, the drivers canbe found in the default installation folder:“C:\Program Files (x86)\Profitap\ProfiShark 1G\Driver\PT3”.
When the ProfiShark hardware is connected for the first time,a reboot of the PC is required in order to refresh the Winpcap/
Wireshark device list. The Winpcap/Wireshark device list may
also be refreshed using the following command lines in a
cmd.exe window:- open a CMD window- net stop npf- net start npf
To install the ProfiShark 1G drivers on Linux, follow the
instructions in the Installation.txt file located on the USB flash
drive.
The latest driver releases can be found in the Resource Centerat www.profitap.com. You will need to register to access thisarea. Registering is free and will let you participate in ongoingproduct improvements.

Analyzer Installation
Any of the compatible analyzers can be used to perform theanalysis. Compatible analyzers are listed on the ProfiShark 1G
product page at: www.profitap.com.
Wireshark is recommended and can be downloaded at:www.wireshark.org.
To start capturing network data, launch your preferred
network analyzer and select the new network interface named“ProfiShark 1G Device”. Refer to your analyzer’s user manual
to learn more about how to select a network interface.

8ProfiShark 1G Manager
Installation

To install the ProfiShark 1G Manager on Windows, execute thesetup utility located in the “Windows” folder of the USB flash
drive. Please make sure any previous version of the ProfiShark
1G Manager has been uninstalled before starting the setup
utility. The setup utility will create a launch icon in your startmenu.
To install the ProfiShark 1G Manager on Linux, follow the
instructions in the Installation.txt file located on the USB flash
drive.
The latest software releases can be found in the Resource
Center at www.profitap.com.

Description

ProfiShark 1G Manager is a standalone application designed
by Profitap. It provides means for statistical analysis of a
network prior to a deeper investigation using an analyzer.
It also provides options for port diagnostic, port control,
timestamping, and traffic capture. It also includes afirmware flashing utility. ProfiShark 1G Manager can be usedsimultaneously with a software network analyzer, without theneed to interrupt data capture.

Statistics

ProfiShark 1G Manager provides several different visual
representations for network statistics.

Counters

The Counters tab lists every counter embedded in theProfiShark 1G for both network ports. The counters are 64-bit
hardware counters. They are cleared at hardware startup andat link reconnection.
Statistics can be reset individually for each port or for the two
ports at the same time using the buttons on the left.
Clearing the counters using the buttons does not clear the
hardware counters, but stores all counters in reference
counter. The displayed counters are the result of the formula(hardware counter - reference counter).

9

Size < 64 bytes:
CRC valid frames with a size inferior to 64 bytes
64 < size < 1518:
CRC valid frames with a size superior or equal to 64 bytes andinferior or equal to 1518 bytes
Size > 1518 bytes:
CRC valid frames with a size superior to 1518 bytes
Collisions:
CRC error frames with a size inferior to 64 bytes
CRC errors:
CRC error frames with a size superior or equal to 64 bytes andinferior or equal to 1518 bytes
Jabbers:
CRC errors frames with a size superior to 1518 bytes
Valid frames:
CRC valid frames of any size
Invalid frames:
CRC error frames of any size
Total bytes:
Valid frame bytes
Meters:The meters on the right display the current bandwidth usage,
the average bandwidth usage and the average CRC error rate
for each port.

10

Charts

The Charts tab allows the inspection of statistical data overtime, using plots.
For each port, you can plot any of the statistical data by using
the checkboxes on the left. Once a box is checked,
the corresponding data appears on the chart on the right.
Refresh rate can be selected using the drop down list on theleft, allowing you to plot up to 10 hours of statistics.
When “packet/s” is selected, each series displays thecorresponding number of packets per second, except for the
bandwidth usage which is displayed in bytes per second.
When “percentage” is selected, each series is displayed interm of percentage of the total number of packets, except forthe bandwidth usage which is displayed in percentage of thetotal bandwidth.
Both graphs’ history can be reset using the Clear History buttonon the left. Disconnecting the ProfiShark 1G also reset thegraphs’ data.

11

Log

The Log tab offers to set thresholds for bandwidth usage and
CRC error rate. Every time the threshold is exceeded, a log
entry is added, allowing to easily identify the type, date, andport of the event.
This can be used for long term analysis, where events happen
randomly over a long period of time.

Network Ports Diagnostic
Ports Control
Customizable port settings are located on the right side of thistab:

The ProfiShark 1G is set to in-line mode by default. Span modecan be enabled or disabled in this section.
In in-line mode, both ports are controlled at the same time. In
Span mode, both ports can be configured separately (speed,
Full-Duplex/Half-Duplex, enable/disable autonegotiation).

12

Network Port Status
On the left side of this tab is a chart giving in-depth informationon the network link:- Link status and speed- Master/slave resolution- Link partner capabilities- Faults

13

Features

The Features tab regroups information about the driver andfirmware version, port status, the firmware update utility, and a
way to enable or disable certain ProfiShark 1G features.
To update the ProfiShark 1G firmware, press the Browse
button, select the appropriate firmware file and press the Flash
Firmware button.
The corresponding firmware update will begin. The ProfiShark
1G Manager cannot be used while the update is in progress.
The update process can take a few minutes to complete.
Unplug and replug the ProfiShark device to use the newfirmware. Do not disconnect the USB port or shut yourcomputer down during the update process.
The latest firmware can be downloaded from the Resource
Center at: www.profitap.com.

14

The following features can be turned on and off:
Transmit CRC Errors:
If checked, the ProfiShark will not filter out network packets
with CRC errors like a normal NIC would.
Keep CRC32:
Keep the CRC32 information (32-bit Frame Check Sequence)located at the end of the packets. FCS can be interpreted in
Wireshark (Edit -> Preferences -> Protocols -> Ethernet ->Assume packets have FCS).
Disable Port A:
If checked, the frames which input on port A are not captured.
Disable Port B:
If checked, the frames which input on port B are not captured.
Packet Slicing:
If checked, the first 128 bytes of each frame are captured.
Enable timestamps:
If checked, a Unix formatted timestamp is adjoined at theend of the packet data, after the FCS. This timestamp can beinterpreted by the Profitap Wireshark dissector in live capturemode.
Unix timestamp format: the 64-bit timestamp is organized in two
32-bit words, representing the seconds since 01/01/1970, and thefraction of second.
NOTE If the “Packet Slicing” feature is enabled, the hardware
automatically disables the “Keep CRC32” feature. No padding
is added to frames smaller than 128 bytes.
NOTE If both options “Transmit CRC Errors” and “KeepCRC32” are enabled, all erroneous packets will be treated ascorrect ones.

15

Packet Capture
ProfiShark 1G has the ability to capture:- Any type of frames (VLAN, VXLAN, MPLS, Pause frames, etc.)- Any encapsulated frames- CRC errors frames- Short frames (< 64 bytes)- Jumbo frames (> 1518 bytes)- Any frames between 10 bytes and 10 Kbytes
Once the drivers have been properly installed, a newconnection is added in the Network Connection panel.
ProfiShark 1G acts as two 1 Gbit/s unidirectional NICs,
regardless of the network connection speed. Frame
aggregation is done in the ProfiShark hardware and respects
the original frame order. As opposed to FIFO (First In, FirstOut), the ProfiShark 1G employs an FCFS (First Come, First
Served) mechanism.

16

17

Two modes of capture are available:- NIC Capture mode
- Direct Capture mode.
In NIC Capture mode (live capture), the capture is performed
like on any other network card. The frames are routed to the
NDIS driver.
In Direct Capture mode, the frame stream is dumped to the
disk. The capture file format is computed in the ProfiShark
hardware.

ProfiShark Hardware, 8ns Timestamp
Direct Capture Format Computation

ProfiShark NIC
Capture Driver

ProfiShark Direct
Capture Driver

Network Driver(NDIS)

HDD/SSD

Capture Driver(e.g. Winpcap)

Protocol Analyzer(e.g. Wireshark)

18

Live Capture Mode
ProfiShark 1G transmits network frames to the capture
software without altering them. It is transparent for packet
size, packet type, or protocols. All tags and encapsulation arepreserved (e.g. VLAN, MPLS, GRE).

The “Software Dropped Packets” counter in the Features tab
indicates the number of packets dropped by the driver in Live
Capture mode. It is not representative of the packets dropped
in Direct Capture (see “Direct Capture Mode” chapter). Thesedrop events are caused by high CPU usage.
The “Hardware Dropped Packets” counter indicates theamount of captured packets that were dropped due to low USB
bandwidth (e.g. Gigabit capture on USB 2.0). In USB 3.0 mode,
this counter should not increase, even in full speed gigabit
capture.
NOTE Capture of small packet at full speed gigabit isextremely challenging for processors and can cause software
drops. For that reason, another capture mode is available (see“Direct Capture Mode” chapter).

19

Direct Capture Mode
ProfiShark 1G provides with the option to capture traffic
without the need for third-party capture software. This modeof capture is performed on a driver level, prior to all network
stacks and frame processing. With the support of direct
capture, small packet capture can be performed at wire speed.

The capture file is saved in PCAP Next Generation format(.pcapng).
The packet timestamps are hardware generated with 8
nanosecond accuracy. The direct capture feature is compatible
with the different hardware features: “Packet Slicing”,“Transmit CRC errors”, “Keep CRC32”, “Disable Port” (see“Features” chapter).

20

Direct Capture Setup
Output Capture File:
Specify the name and location of the capture file. Nameextension will be added to the specified name:(_#####_YYYYMMDDHHMMSS).
Maximum Capture File Size (MB):The capture will stop when the file reaches the specified sizein MB.
Loop:
If selected, the capture does not stop. The files are erased
to keep the specified amount of capture files. A round-robin
capture can be done, with one or multiple files.
Number of files to use:
Specify the amount of capture files to be created.
Start Capture:
When capture isn’t running, starts the capture with thespecified parameters.
Stop Capture:
When capture is running, stops the capture and releases thecapture file.
Written to File:
Indicates the amount of data written in the Output Capture File.
Current Cache Usage:
Indicates the RAM cache’s current usage.
Dropped:Indicates the amount of data dropped during the capture.
NOTE The amount of dropped data depends on the data
storage throughput and the amount of RAM cache. Disk arrays
or SSDs can drastically improve capture performance.

21

Timestamping
The hardware timestamping feature can be used in Live
Capture mode, using Profitap’s Wireshark dissector. The
dissector files can be found on the provided USB flash drive,or in the Resource Center at: www.profitap.com.
The dissector is compatible with Wireshark (x86 and x64) 1.12.x
and 2.0.x.
Linux:
Copy the two files (profishark_1g.la and profishark_1g.so) to:‘/usr/local/lib/wireshark/plugins/[wireshark_version]/’, from x86
or x64 depending on the Linux version.
Windows:
Copy the file (profishark_1g.dll) in:‘C:/Program Files/Wireshark/plugins/[wireshark_version]/’, fromx86 or x64 depending on the Windows version.
The dissector can be enabled or disabled in the Wireshark
preferences (Edit -> Preferences -> Protocols -> ProfiShark ->Decode timestamps for ProfiShark 1G).
The timestamp option must be enabled in the ProfiSharkManager’s Features tab (see «Features» chapter).

22

If «Decode timestamps for ProfiShark 1G» is enabled,
Wireshark assumes that every packet contains the ProfiShark
timestamp.
If timestamps aren’t displayed in nanosecond resolution in
Wireshark, select ‘Nanoseconds’ in ‘View -> Time Display
Format’.

Advanced Timestamping (ProfiShark 1G+ only)
The Timing tab contains information and settings related totimestamping. It only appears on the ProfiShark Manager if a
ProfiShark 1G+ is connected.
The ProfiShark 1G+ offers multiple advanced timestamping
features. The GPS chip can retrieve the UTC time, andsynchronize it with the internal PPS, with a typical precision of±16 ns. The ProfiShark 1G+ can also retrieve the time via SNTP,
or use the internal RTC (real-time clock), and synchronize
it via an external PPS signal. A PPS output is possible, forsynchronization with another ProfiShark device, or with anyother device accepting PPS input.
These systems can be combined in different ways,
providing multiple possible options for accurate and precise
timestamping of packets.
Note that the GPS antenna should be set up outside, or near awindow, for the best results. The GPS can take about a minuteto synchronize the UTC time with the internal PPS. The stabilityof synchronicity increases over time, and may take 10 to 15
minutes to reach its peak.

23

The following section of the Timing tab informs you about thestatus of advanced timestamping systems.
The GPS antenna is
detected by the device.
Green: the GPS connexion is stable.
Yellow: the GPS connexion is close
to being stable.
Once the GPS has enough stable
GPS connexions, the PPS chip will
start its synchronization.
If green, an external PPS is detected(bypasses the internal PPS).
Indicates that the time data has beenobtained, and how it has been obtained(GPS/SNTP/System clock/RTC).
Indicates that the internal
timestamping is synchronized with
the UTC time (± 16 ns precision).
The following section displays the status of GPS synchronizationand its deviation from the internal PPS over time:

The Timing tab provides the following configuration options:24

Timestamp initialization:
Specifies how the timestamp will be set at hardware startup.
Wait for sync:
Waits until timestamp synchronization before allowing traffic
capture.
PPS port output:
Sets the PPS port to output mode. Will output a PPS signal if
the GPS is synchronized.
Force PPS generation:
If PPS port output is set, forces the generation of a PPS signal
from the internal RTC (real-time clock).
Set time from SNTP / Set time from GPS:
Sets the ProfiShark 1G+ to the selected mode of timestamping.
PPS compensation:
The PPS compensation slider can set the PPS to compensate
for latency. For instance, 1 meter of cable adds 3 ns of latency,
in which case the slider should be set to -3 ns (-15 ns for 5
meters, -30 ns for 10 meters, etc.).

Timestamp on:- Capture: timestamps are set to the packets at the moment
they are captured within the device.
- Ingress: timestamps are adjusted to account for latency inorder to simulate timestamping at port ingress.
- Egress: timestamps are adjusted to account for latency inorder to simulate timestamping at port egress.
- Example of use: set one port to egress on a first ProfiSharkand one to ingress on a second ProfiShark to measure thelatency between both ports.

25

Additional information
Ordering reference
ProfiShark 1G: C1AP-1G
ProfiShark 1G+: C1AP-1G2
Connectors: 1G
2 x RJ45 8 pins
1 x USB 3.0
1 x 5 VDC optional input
Connectors: 1G+
2 x RJ45 8 pins
1 x USB 3.0
1 x 5 VDC optional input
1 x SMA female (PPS)
1 x SMA female (GPS)
LEDs: 1G
2 x Link activity
2 x Speed
1 x Power
LEDs: 1G+
2 x Link activity
2 x Speed
1 x Power
1 x Sync
Dimensions (WxDxH)
1G: 69 x 124 x 24 mm
1G: 2.72 x 4.88 x 0.94 in
1G+: 105 x 124 x 26 mm
1G+: 4.13 x 4.88 x 1.02 in
Weight1G: 176 g - 0.39 lb
1G+: 280 g - 0.62 lb
Compliance: 1G
RoHS
CE
Compliance: 1G+
RoHS

26

Max Network Latency
370 nsLink @ 1Gpbs
660 nsLink @ 100Mbps
6600 ns
Link @ 10Mbps
Power Consumption 1G (5V)
1 Gbps (full traffic)
600 mA
100 Mbps (full traffic) 450 mA
10 Mbps (full traffic) 520 mA
System requirements
Dual Core Processor
4 GB memory
USB 3.0 port
Supported OS
Windows 8 32 & 64 bits
Windows 7 32 & 64 bits
Linux
Operating Temperature
0 to +50°C - 32 to 122°F
Storage Temperature-40 to +80°C - -40 to 176°F
Relative humidity
10 to 95%, non-condensing
Accessories: 1G
1.8m USB 3.0 cable
RJ45 cablePouch
USB key
Accessories 1G+
1.8m USB 3.0 cable
RJ45 cablePouch
USB key
GPS/GLONASS Antenna

Disclaimer
The information in this document is subject to change without
notice. The manufacturer makes no representations or
warranties with respect to the contents hereof and specificallydisclaims any implied warranties of merchantability or fitness
for any particular purpose. The manufacturer reserves theright to revise this publication and to make changes in thecontent hereof without obligation of the manufacturer tonotify any person of such revision or changes.

Warranty and Liability
Profitap warrants that this product is free from defects inmaterial and workmanship at time of shipment. The warranty
period is two years from the date of purchase. Profitap
assumes no liability for products that have been subjected toabuse, modification, misuse, or if the model or serial number
has been altered, tampered with, defaced or removed. Profitap
is not liable under any contract, negligence, strict liability
or other legal or equitable theory for any loss of use of the
product, inconvenience or damages of any character, whether
direct, special, incidental or consequential (including, but notlimited to, damages for loss of goodwill, loss of revenue or
profit, work stoppage or malfunction).

Copyright
This publication, including all photographs and illustrations
is protected under international copyright laws with all
rights reserved. Neither this manual, nor any of the material
contained herein, may be reproduced without written consent
of the author.

Trademarks
The trademarks mentioned in this manual are the soleproperty of their owners.

27

CUSTOMER SUPPORT INFORMATION
To order or for technical information support:
Telephone+31 (0) 40 782 0880
Mail order
Profitap HQ B.V.
High Tech Campus 95656 AE Eindhoven
The Netherlands
E-mailinfo@profitap.com
Websitewww.profitap.com©2016 PROFITAP - v3.0
28