32 x 400Gb QSFP-DD Packet Broker

PB-APP: packet broker as a containerized application

PB-APP runs as a container on AsterNOS rather than as a separate operating system, so the switch retains its Enterprise SONiC L2/L3 stack while adding dedicated traffic-orchestration logic. Configuration, rule management, and visualization are handled through a Web UI with drag-and-drop policy workflows and real-time hit counters, alongside CLI, RESTful API, SNMP, Syslog, and Prometheus/Grafana integration for teams standardizing on existing O&M tooling.

Role-based port isolation

Each of the data ports is assigned one of four roles — Network, Service, Tool, or Hybrid — separating production traffic ingress, service-chained inline paths, and tool-facing egress on the same device. This isolation model prevents analysis traffic from being reinjected into the production path.

Deep multi-tunnel parsing

PB-APP decapsulates GRE, VXLAN, GTP-U, MPLS, ERSPAN, IPinIP, CFP, and PPPoE tunnels, then matches inner-layer 5-tuple fields for filtering and load-balancing decisions — supporting visibility into overlay and mobile-core traffic without an upstream decapsulation step.

Multi-dimensional precision ACL

Ingress and egress filtering spans L2, L3, L3V6, EX, EM, and EMV6 rule types, matched against 5-tuple, VLAN, MAC, port range, TCP flags, VNI, DSCP, and inner/outer IP fields, with any combination of fields supported per rule. Rules can be reprioritized, searched, and batch-managed from the Web UI, with hit counters tracked per rule and per policy.

Traffic replication, forwarding, and load balancing

Matched traffic can be mirrored (local SPAN, RSPAN, or ERSPAN to an L3 port), replicated to single ports, LAGs, or combined port+LAG groups, or forwarded/dropped by ACL match. Hardware truncation to 128 bytes reduces the volume sent downstream. Four LAG modes — Flexible, Static, Weight, and Standby — distribute output across tool ports, with custom hash keys, symmetric hashing, and configurable hash seeds to balance probe bandwidth.

Nanosecond timestamping

PB-APP appends packet-level nanosecond timestamps using IEEE 1588v2 PTP synchronization, giving downstream analysis tools a common time reference for performance profiling, security auditing, and fault demarcation.

Passive and inline deployment

The PX732Q-M supports both passive mode, tapping SPAN/RSPAN/ERSPAN sources without sitting in the data path, and inline mode, where the packet broker sits directly between core and edge devices to chain traffic through IPS or firewall tools — reducing the optical transceiver count required for a comparable dedicated-appliance deployment.

Architecture & performance

• 9th-generation, 16nm Marvell Prestera Falcon — 2.0 Tbps to 12.8 Tbps wire-speed switching across the 98CX85xx family

• Large shared tables: 128K MAC, 288K IPv4 / 144K IPv6 prefixes, high-scale multi-tenant L2/L3

• Globally shared packet buffer with dynamic thresholds for microburst (µBurst) absorption

• Cut-through switching and dynamic load balancing (DLB) across the fabric

Virtualization & overlays

• eBridge unified virtualization architecture with hardware-based interface/domain virtualization

• Programmable header editor: hardware-accelerated VXLAN, VXLAN-GPE, Geneve and NSH

• MPLS and IPv6 segment routing for flexible transport

RDMA, telemetry & openness

• RoCEv2-aware congestion management for lossless RDMA storage and AI/ML traffic

• In-band network telemetry built into the data path — sFlow, IPFIX, remote port analysis

• Open Switch Abstraction Interface (SAI) + Telemetry & Monitoring (TAM) APIs — merchant-silicon foundation for SONiC/AsterNOS