This article discusses the 'sematics' analyzer part of Narius monitor equipment installed in ATT's switching centers.
http://www.dailykos.com/story/2006/4/8/14724/28476How powerful is this? OC-192 carries about 10 gigabits of data per second. Ten billion bits per second, monitored in real-time. That is stunning. This is one damned powerful machine, one of the most powerful I've ever heard of in 25 years in IT.
And what does it monitor while looking at this 10 billion bits of IP data per second? First lets take a look at what the network model is, the OSI model of seven layers. NarusInsight focuses on two layers: number four, the transport layer, built on standards like TCP and UDP, the physical building blocks of internet data traffic, and number seven, the application layer, built on standards like HTTP and FTP, which are dependent on the application using them, i.e. Internet Explorer, Kazaa, Skype, etc. It monitors 10 billion bits per second at level four and 2500 million bits per second at level seven. For reference, the 256K DSL line I am using equals .25 million bits per second. So one NarusInsight machine can look at about 39,000 DSL lines at once in great detail. That is a pretty damn big number. This is some really serious hardware with equally serious software. Which is our next subject.
Much, much more at the link.
Edit to clarify 'semantics': Suppose for example you plugged "John Kerry" into this Narius 'packet sniffer', it could analyze all traffic (IP packets, e-mails, ect) looking for the words "John Kerry" and when it encountered those words, zero in on that specific call detail (message). I'd say this could be a handy tool, if you are into snooping on your political opponents.