Skip to Content

MaestroFusion

Inline Packet Brokering. Advanced Processing. Fail-Safe Protection.

Request a Demo Explore the Platform

Out of band or in the production path

The same MaestroFusion system can take copies of traffic from TAPs and SPAN ports, or sit directly in a live link with an MF-BYP4 optical bypass protecting it.

Out-of-band visibility and tool optimization

MaestroFusion collects traffic from TAPs and SPAN ports, filters and load-balances it in the switching ASIC, and passes selected traffic through the DPUs before delivery. Each tool receives only the traffic it needs, already de-duplicated, decrypted or summarized.

Protected inline deployment

MaestroFusion sits between two production segments and brokers the live traffic to your tools as it passes. If it loses power, misses heartbeats or sees abnormal optical power, MF-BYP4 connects the two segments directly in 50 ms or less. How the bypass works

Four layers in one inline system

A switching ASIC for wire-speed brokering, DPUs for deeper processing, a timing subsystem for accurate timestamps, and an optical bypass that keeps the link up when the broker cannot.

Wire-speed brokering in the switching ASIC

A Marvell switching ASIC does the core packet broker work in hardware. It aggregates links, filters and replicates traffic, and balances load across tools. It can also truncate, timestamp, modify and re-tunnel packets, all at wire speed.

MaestroFusion MF25-48x25G front panel with 48 SFP28 and 6 QSFP28 ports
48 SFP28 ports, 10/25G, SFP+ compatible 6 QSFP28 ports, 40/100G, QSFP+ compatible
Switching capacity
2.0 Tbps
Forwarding rate
1332.9 Mpps
SFP28 ports
48 × 10/25G
QSFP28 ports
6 × 40/100G
  • AggregateCombine traffic from many links into fewer tool ports.
  • FilterPass each tool only the traffic it needs.
  • ReplicateSend the same packets to several tools at once.
  • Load-balanceSpread traffic across a group of tool ports.
  • TruncateCut packets down to the bytes your tools use.
  • TimestampMark each packet with its arrival time.
  • ModifyRewrite packet fields before delivery.
  • Encap / decapAdd or strip tunnel headers.

Up to two DPUs for deeper processing

DPU-equipped systems carry one or two Marvell OCTEON data processing units inside the chassis. Each has eight Arm Neoverse N2 cores at 2.5 GHz and 16 GB of DDR5 memory, expandable to 48 GB.

Every DPU connects to the switching ASIC over a 100G internal path and to the CPU over PCIe. It works on mirrored and brokered traffic without taking a front-panel port, and you manage it from the same packet broker Web UI as the ASIC.

Front panel 48 × 25G + 6 × 100G
Switch ASIC2.0 Tbps
CPUControl plane
100GDPU 18 Arm cores, 16 GBEmpty slot
100GDPU 28 Arm cores, 16 GBEmpty slot
System
MF25-48x25G-DPU2-F-AC
Licenses
MF-INPB-LIC, MF-DPU-ADV-LIC
Reduce
De-duplication that can ignore TTL, MAC, DSCP, IPID, FCS and TCP sequence or checksum fields. Truncation down to network and transport headers.
Decrypt and reassemble
SSL decryption. TCP out-of-order reassembly in both directions. IP fragment reassembly for outer and inner fragments.
De-identify
Remove identifying data from packets before they reach recording and analysis tools.
Match
Fixed-offset signature matching, full-packet offset range matching and dynamic front-section pattern matching.
Export flows
NetFlow v5, NetFlow v9, IPFIX and sFlow, sampled by 5-tuple or rule at a ratio you set. Load-balance or duplicate the export across collectors.
Stamp and rewrite
Timestamping with PTP precision and outer MAC address modification.
Run your own code
An open DPU environment with Arm64 Linux, containers and DPDK/VPP for your own packet-processing functions.

A timing subsystem built into the chassis

MaestroFusion runs IEEE 1588v2 PTP as a transparent or boundary clock, supports SyncE, and accepts 1PPS, ToD, 10 MHz and a GNSS antenna directly. Packets are timestamped with PTP precision, so records from different tools line up on the same timeline.

Need a grandmaster or GNSS reference for the rest of the network? See ECIN timing and synchronization.

References
  • GNSS antenna
  • 10 MHz
  • 1PPS
  • ToD
Sync
  • IEEE 1588v2 PTP, TC and BC
  • SyncE
Time base
1PPS edges discipline the clock. Every timestamp comes from that same time base.

If MaestroFusion stops, the link does not

MF-BYP4-100G-AC is a 1U chassis with up to four bypass modules, one per protected link. Each module is a pure 1:1 optical switch. There are no internal splitters, all of the optical power passes through, and insertion loss stays under 1.5 dB.

Switching control runs separately from management, so a switchover always takes priority. It completes in 50 ms or less, in automatic or manual mode.

MF-BYP4 bypass module MaestroFusion Network A Network B Switched in ≤50 ms
  • PowerOn
  • HeartbeatReceived
  • Optical powerIn range
  • ModeAutomatic

Inline. Traffic passes through MaestroFusion and heartbeats confirm the path is healthy.

Switching time
≤50 ms
Insertion loss
<1.5 dB
Protected links per 1U
4
Services
10G / 25G / 100G
Power
1+1 redundant

What you can do with MaestroFusion

  1. Right-size traffic for security tools

    Filter, de-duplicate and load-balance before traffic reaches IDS and NDR sensors, so each sensor gets the volume it was sized for.

    Out of band or inlineASICDPU

  2. Keep processing in the live path

    Place MaestroFusion between two production segments with MF-BYP4 in front of it. On a power loss, missed heartbeat or optical alarm, the link moves to a pure optical path in 50 ms or less.

    InlineASICDPUBypass

  3. Inspect encrypted sessions

    Decrypt SSL on the DPU and hand clear traffic to tools that cannot decrypt on their own.

    Out of band or inlineDPU

  4. Record without exposing personal data

    De-identify packets before they reach forensics and recording systems, and keep only the headers you need with truncation.

    Out of bandDPU

  5. Flow records for every link

    Generate NetFlow, IPFIX or sFlow on the DPU at line rate, then split the export across collectors or send copies to several tool types.

    Out of band or inlineDPU

  6. Line up events across tools

    Timestamp packets with PTP precision at capture, so latency measurements and incident timelines from different tools agree.

    Out of band or inlineTiming

  7. Scale out as a visibility fabric

    Arrange several MaestroFusion systems as tap-leaf, spine and tool-leaf layers to cover more links and more tools.

    Out of bandASIC

  8. Run your own packet code

    Deploy containerized applications, DPDK or VPP on the open Arm64 DPU environment, next to the built-in functions.

    Out of band or inlineDPU

One architecture, managed as one

TAPstack gives you access to traffic. PacketMaestro brokers it and PacketMaestro Pro adds DPU processing. MaestroFusion brings brokering, processing and resilience into the production path.

MaestroVision manages and orchestrates PacketMaestro and MaestroFusion together, so inline and out-of-band visibility run from one place.

MaestroVision Manage and orchestrate
  1. TAPstackAccess
  2. PacketMaestroBroker
  3. PacketMaestro ProAdvanced processing
  4. MaestroFusionInline brokering, processing and resilience

Specifications

MaestroFusion MF25-48x25G Series

ParameterSpecification
Network interfaces
25G ports48 × 10/25G SFP28, 10GE SFP+ compatible
100G ports6 × 40/100G QSFP28, 40GE QSFP+ compatible
Switching
Switching chipMarvell
Switching capacity2.0 Tbps
Forwarding rate1332.9 Mpps
Control plane
CPUBroadwell-DE D-1508
Memory16 GB DDR4, expandable to 96 GB
Storage128 GB M.2 SATA SSD
DPU (DPU1 and DPU2 systems)
DPU slots2
DPU modelMarvell OCTEON
Cores8 × Arm Neoverse N2 (Armv9), 2.5 GHz
Memory16 GB DDR5, expandable to 48 GB
StorageOptional PCIe Gen4 x4 NVMe SSD
L2/L3 switching100 Gbps
Routing100 Gbps
Firewall80 Gbps
Encryption/decryption80 Gbps
ParameterSpecification
Timing
ProtocolsIEEE 1588v2 PTP (TC and BC), SyncE
Time interfaces1PPS, ToD, 10 MHz, GNSS antenna input
Software and management
Operating systemMaestroFusion network OS, based on SONiC and Linux
ManagementPacket broker Web UI, industry-standard CLI, ZTP, SNMP v1/v2/v3, sFlow, syslog
Interfaces1 × USB 2.0, 1 × Console / 1PPS+ToD RJ45, 2 × MGMT RJ45
Physical
Form factor1RU, 19-inch rack-mountable
Dimensions (W × H × D)440 × 44 × 560 mm
Weight10 kg
Power and cooling
Maximum power480 W
Power supplies1+1 redundant, hot-swappable
Input voltage100 to 240 V AC, 36 to 72 V DC
Fans3+1 redundant, hot-swappable
AirflowFront (port side) to power side
Environmental
Operating temperature0 to 45 °C
Relative humidity5% to 90%, non-condensing

MF-BYP4-100G-AC Optical Bypass Switch

ParameterSpecification
Chassis
Form factor19-inch 1U chassis
Dimensions (W × D × H)440 × 326 × 44.5 mm
Module slots4
Power supply1+1 redundant, built-in. 220 V AC standard, 48 V DC optional
WeightUnder 2 kg
Operating temperature−10 to 50 °C
Storage temperature−40 to 85 °C
Relative humidity5% to 95%, non-condensing
MTBF140,127 hours
Optical power monitoring
Range+25 to −50 dBm
Accuracy≤0.5 dB from +25 to −40 dBm, ≤1.0 dB from −40 to −50 dBm
Resolution≤0.01 dB
ParameterSpecification
Bypass protection module
Services10G / 25G / 100G transparent transmission
Fiber typeSingle-mode standard, multi-mode optional
Wavelength1310 ±50 nm and 1550 ±50 nm
Protection mode1:1 pure optical switch bypass
Insertion loss<1.5 dB, all optical paths
Switching time≤50 ms
Return loss≥45 dB
Crosstalk≥55 dB
Polarization-dependent loss≤0.1 dB
Wavelength-dependent loss≤0.25 dB
Operation and management
TriggersOptical power detection, heartbeat loss, power-down protection
Operating modesManual and automatic
ManagementConsole, Web UI, EMS/NMS
FirmwareRemote upgrade over TFTP

Ordering information

Pick a system, add the licenses it needs, then add optical bypass for inline links and a support term.

Part numberDescription
Systems
MF25-48x25G-F-ACBase chassis with 48 × 10/25G SFP28 and 6 × 100G QSFP28, dual AC power supplies, no DPU
MF25-48x25G-DPU1-F-ACMaestroFusion system with one internal 8-core Marvell OCTEON DPU
MF25-48x25G-DPU2-F-ACMaestroFusion system with two internal 8-core Marvell OCTEON DPUs
Software licenses
MF-INPB-LICInline Network Packet Broker license, required on every system
MF-DPU-ADV-LICDPU Advanced Processing license, requires a DPU1 or DPU2 system
Optical bypass
MF-BYP4-100G-AC4-slot optical bypass switch for inline links, works with any MaestroFusion system
Support
MF-SUP-STD-1Y / 3Y / 5YStandard Support for 1, 3 or 5 years, renewal at 10% of MSRP per year
MF-SUP-PREM-1Y / 3Y / 5YPremium Support for 1, 3 or 5 years, renewal at 15% of MSRP per year

Every MaestroFusion system and MF-BYP4 includes a first-year hardware warranty and first-year software technical support.

Datasheets

MaestroFusion Inline Packet Broker Data sheet v1.1, 8 pages, PDF Download MaestroFusion Optical Bypass Switch Data sheet, 4 pages, PDF Download