It has two main functions: 1. In JSON format, output 20 KPIs and 10 latency KQIs of each TCP / UDP / HTTP / SQL session in real time, store them in local file with FIFO, or encapsulate JSON into UDP packet output them to remote data collector (such as KAFKA); 2. Store network traffic to a local PCAP files with FIFO (supports packet truncation) , or forward RAW packets to other DPI traffic analysis products in real-time over VXLAN tunnel.
In addition, it can capture network traffic with a variety of policies, and can automatically resolve VXLAN and GRE encapsulated protocols. The most important premise above is that when you deploy Tmarlin, you don't need to worry about t's resource consumption and impact on other applications, because it only occupies 50 MB of memory, and even at 500 Mbps, it only occupies 7% resource just in only one vCPU.