Skip to Content

MaestroFusion

Inline Packet Broker + DPU Processing + Precision Timing + Fail-Safe Optical Bypass

Request a Demo Download Datasheet

Out of band or in the production path

The same MaestroFusion system can take copies of traffic from TAPs and SPAN ports, or sit directly in a live link with an MF-BYP4 optical bypass protecting it.

Out-of-band visibility and tool optimization

MaestroFusion collects traffic from TAPs and SPAN ports, filters and load-balances it in the switching ASIC, and passes selected traffic through the DPUs before delivery. Each tool receives only the traffic it needs, already de-duplicated, decrypted or summarized.

Protected inline deployment

MaestroFusion sits between two production segments and brokers the live traffic to your tools as it passes. If it loses power, misses heartbeats or sees abnormal optical power, MF-BYP4 connects the two segments directly through an optical bypass path. How the bypass works

Four layers in one inline system

A switching ASIC for packet brokering, DPUs for advanced processing, a timing subsystem for PTP packet timestamping, and an optical bypass that protects the link when the broker cannot.

Packet brokering in the switching ASIC

A Marvell switching ASIC supports core packet broker functions in hardware. It aggregates links, filters and replicates traffic, and balances load across tools. It also supports truncation, timestamping, packet modification and re-tunneling.

48 SFP28 ports, 10/25G, SFP+ compatible 6 QSFP28 ports, 40/100G, QSFP+ compatible
Packet brokering
Aggregation, filtering and replication
Tool delivery
Load balancing and traffic selection
SFP28 ports
48 × 10/25G
QSFP28 ports
6 × 40/100G
  • AggregateCombine traffic from many links into fewer tool ports.
  • FilterPass each tool only the traffic it needs.
  • ReplicateSend the same packets to several tools at once.
  • Load-balanceSpread traffic across a group of tool ports.
  • TruncateCut packets down to the bytes your tools use.
  • TimestampMark each packet with its arrival time.
  • ModifyRewrite packet fields before delivery.
  • Encap / decapAdd or strip tunnel headers.

Up to two DPUs for deeper processing

DPU-equipped systems carry one or two Marvell OCTEON data processing units inside the chassis. Each has eight Arm Neoverse N2 cores and 16 GB of DDR5 memory, expandable to 48 GB.

Every DPU connects internally to the switching ASIC and to the CPU over PCIe. It supports advanced processing on mirrored and brokered traffic without taking a front-panel port, and you manage it from the same packet broker Web UI as the ASIC.

System configuration
Front panel 48 × 25G + 6 × 100G
Switch ASICPacket brokering
CPUControl plane
Internal linkDPU 1Advanced processingEmpty slot
Internal linkDPU 2Advanced processingEmpty slot
System
MF25-48x25G-DPU2-F-AC
Licenses
MF-INPB-LIC, MF-DPU-ADV-LIC
Reduce
De-duplication that can ignore TTL, MAC, DSCP, IPID, FCS and TCP sequence or checksum fields. Truncation down to network and transport headers.
Encrypt and decrypt
Encryption and decryption, including SSL decryption, with TCP and IP fragment reassembly.
Route and protect
Routing and firewall functions on DPU-equipped systems.
De-identify
Remove identifying data from packets before they reach recording and analysis tools.
Match
Fixed-offset signature matching, full-packet offset range matching and dynamic front-section pattern matching.
Export flows
NetFlow v5, NetFlow v9, IPFIX and sFlow, sampled by 5-tuple or rule at a ratio you set. Load-balance or duplicate the export across collectors.
Stamp and rewrite
PTP packet timestamping and outer MAC address modification.
Run your own code
An open DPU environment with Arm64 Linux, containers and DPDK/VPP for your own packet-processing functions.

A timing subsystem built into the chassis

MaestroFusion supports IEEE 1588v2 PTP as a transparent or boundary clock, SyncE, and external timing references including 1PPS, ToD, 10 MHz and GNSS. PTP packet timestamping helps align records from different tools on a common timeline.

Need a grandmaster or GNSS reference for the rest of the network? See ECIN timing and synchronization.

References
  • GNSS antenna
  • 10 MHz
  • 1PPS
  • ToD
Sync
  • IEEE 1588v2 PTP, TC and BC
  • SyncE
Time base
1PPS edges discipline the clock. Every timestamp comes from that same time base.

Fail-safe optical bypass for inline links

MF-BYP4-100G-AC is a 1U chassis with up to four bypass modules, one per protected link. Each module provides a pure 1:1 optical bypass path without internal splitters.

Switching control runs separately from management so fail-safe protection takes priority. The bypass supports automatic and manual operation.

Trigger a fault
MF-BYP4 bypass module MaestroFusion Network A Network B Optical bypass active
  • PowerOn
  • HeartbeatReceived
  • Optical powerIn range
  • ModeAutomatic

Inline. Traffic passes through MaestroFusion and heartbeats confirm the path is healthy.

Fail-safe protection
Automatic optical bypass
Switching modes
Automatic and manual
Protected links per 1U
4
Services
10G / 25G / 100G
Power
1+1 redundant

What you can do with MaestroFusion

  1. Right-size traffic for security tools

    Filter, de-duplicate and load-balance before traffic reaches IDS and NDR sensors, so each sensor gets the volume it was sized for.

    Out of band or inlineASICDPU

  2. Keep processing in the live path

    Place MaestroFusion between two production segments with MF-BYP4 in front of it. On a power loss, missed heartbeat or optical alarm, the link moves to a pure optical bypass path.

    InlineASICDPUBypass

  3. Inspect encrypted sessions

    Decrypt SSL on the DPU and hand clear traffic to tools that cannot decrypt on their own.

    Out of band or inlineDPU

  4. Record without exposing personal data

    De-identify packets before they reach forensics and recording systems, and keep only the headers you need with truncation.

    Out of bandDPU

  5. Flow records for every link

    Generate NetFlow, IPFIX or sFlow on the DPU, then split the export across collectors or send copies to several tool types.

    Out of band or inlineDPU

  6. Line up events across tools

    Use PTP packet timestamping at capture to support event correlation and incident timelines across tools.

    Out of band or inlineTiming

  7. Scale out as a visibility fabric

    Arrange several MaestroFusion systems as tap-leaf, spine and tool-leaf layers to cover more links and more tools.

    Out of bandASIC

  8. Run your own packet code

    Deploy containerized applications, DPDK or VPP on the open Arm64 DPU environment, next to the built-in functions.

    Out of band or inlineDPU

One architecture, managed as one

TAPstack gives you access to traffic. PacketMaestro brokers it and PacketMaestro Pro adds DPU processing. MaestroFusion brings brokering, processing and resilience into the production path.

MaestroVision manages and orchestrates PacketMaestro and MaestroFusion together, so inline and out-of-band visibility run from one place.

MaestroVision Manage and orchestrate
  1. TAPstackAccess
  2. PacketMaestroBroker
  3. PacketMaestro ProAdvanced processing
  4. MaestroFusionInline brokering, processing and resilience

Specifications

MaestroFusion MF25-48x25G Series

ParameterSpecification
Network interfaces


25G ports48 × 10/25G SFP28, 10GE SFP+ compatible
100G ports6 × 40/100G QSFP28, 40GE QSFP+ compatible
Switching


Switching chipMarvell
Packet brokeringAggregation, filtering, replication and load balancing
Packet handlingTruncation, timestamping, modification and tunneling
Control plane


CPUBroadwell-DE D-1508
Memory16 GB DDR4, expandable to 96 GB
Storage128 GB M.2 SATA SSD
DPU (DPU1 and DPU2 systems)


DPU slots2
DPU modelMarvell OCTEON
Cores8 × Arm Neoverse N2 (Armv9)
Memory16 GB DDR5, expandable to 48 GB
StorageOptional PCIe Gen4 x4 NVMe SSD
L2/L3 switchingSupported
RoutingSupported
Firewall functionsSupported
Encryption / decryptionSupported, including SSL decryption
DPU advanced processingSupported with MF-DPU-ADV-LIC
ParameterSpecification
Timing


ProtocolsIEEE 1588v2 PTP (TC and BC), SyncE
Time interfaces1PPS, ToD, 10 MHz, GNSS antenna input
Software and management


Operating systemMaestroFusion network OS, based on SONiC and Linux
ManagementPacket broker Web UI, industry-standard CLI, ZTP, SNMP v1/v2/v3, sFlow, syslog
Interfaces1 × USB 2.0, 1 × Console / 1PPS+ToD RJ45, 2 × MGMT RJ45
Physical


Form factor1RU, 19-inch rack-mountable
Dimensions (W × H × D)440 × 44 × 560 mm
Weight10 kg
Power and cooling


Maximum power480 W
Power supplies1+1 redundant, hot-swappable
Input voltage100 to 240 V AC, 36 to 72 V DC
Fans3+1 redundant, hot-swappable
AirflowFront (port side) to power side
Environmental


Operating temperature0 to 45 °C
Relative humidity5% to 90%, non-condensing

Datasheets

MaestroFusion Inline Packet Broker Data sheet v1.1, 8 pages, PDF Download MaestroFusion Optical Bypass Switch Data sheet, 4 pages, PDF Download