Chapter 11: Gigastor In A Financial Firm; Using Observer In Financial Firms - Network Instruments GigaStor User Manual

Chapter 11: GigaStor in a Financial Firm

Using Observer in financial firms

In an environment where even nanoseconds matter, a GigaStor allows you to identify when an anomaly in your
network occurs and alerts you to it so that you can resolve it quickly.
If you are a network administrator in a financial or trading firm, small amounts of time can mean the difference
between making or losing money or making money versus making a lot of money. Your networks must be fast,
and your trading algorithms must be running as efficiently as possible with no data loss on your network. In
addition to the in-depth network troubleshooting features, the GigaStor has several components designed with
your business in mind:
GigaStor probe: The GigaStor probe is a high-performance capture-based network appliance that is
extremely fault tolerant with redundant, high efficiency cooling. It captures both packet and flow-based
traffic for long-term retention of raw, indexed data. Having this data allows you rapid event analysis of
errors and anomalies. It can sustain full-duplex wire speed capture and write-to-disk.
GPS time synchronization: With the GigaStor probe connected to the optional GPS antenna, the time
on the Gen2 capture card is based on atomic clock sources. The clock updates every second and is
within 150 nanoseconds of GPS/UTC time. This ensures remarkably accurate timing without concern for
clock drift (gain or loss).
Trading Multicast analytics: Multicast is used in trading firms to deliver information on pricing, volume,
and more. Getting this information as fast as possible is critical because it affects profits. Therefore,
multicast streams use connectionless UDP rather than the connection-oriented TCP protocol to traverse
the network. UDP has little overhead in comparison to TCP (like the three-way handshake). Hence, it is
much faster and more efficient for traversing the network. However, UDP also has weaknesses that can
have seriously negative implications for the trading network. Packets can be lost, arrive out of order,
and/or be corrupted. Data is not retransmitted when this occurs with UDP, and even if it were, given the
high speed of today's trading, it would likely be too late. When any of these occur, it directly impacts
trade execution. No data can mean that no trade or the wrong trade is placed. To partially overcome
this weakness with UDP, multicast streams almost always use sequence numbers within their payload
to allow detection of these events. As a network administrator in a trading firm, you likely monitor these
sequence numbers quite closely looking for gaps in the numbers. In Observer, you are able to create
custom feed definitions to monitor for missing sequence numbers if you are not using BATS, CME, Edge
feed, JSE feed, LSE, Mold UDP 64, SIAC, FIX Fast. In addition to gap sequence detection and alarming,
Observer can perform proximity analysis near anomalous events. What was occurring when the gap was
GigaStor in a Financial Firm | 59