network network visibility - the key to rapidly troubleshooting network performance issues

www.wildpackets.com© WildPackets, Inc.

Show us your tweets!Use today’s webinar hashtag:

#wp_networkperformancewith any questions, comments, or feedback.

Follow us @wildpackets

Jay BotelhoDirector of Product [email protected] me @jaybotelho

Network VisibilityThe Key to Rapidly Troubleshooting

Network Performance Issues

© WildPackets, Inc.#wp_networkperformance Network Visibility: The Key to Troubleshooting Networks

Administration

• All callers are on mute‒ If you have problems, please let us know via the Chat window

• There will be Q&A‒ Feel free to type a question at any time

• Slides and recording will be available‒ Notification within 48 hours via a follow-up email

2


Agenda

• The four faces of network visibility

• Breadth vs. depth

• When depth matters

• Achieving depth

• Corporate overview

• Product line overview

3


The Four Faces of Network Visibility

4


There’s no debate about the need for centralized network visibility …

HOW?

The question is …


Choices and ComprisesD

ata

Gra

nula

rity

Data Accuracy

SNMP

Flow-based

Packet-based

Log Files


Traffic on Typical Networks

Slide 7

© 2014 Enterprise Management Associates, Inc.

Email/Collaboration

Secure Web/HTTPS

Web/HTTP

Storage backup/restore

Custom/proprietary apps

VoIP

Virtual/Hosted Desktop (VDI)

Streaming Media

0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

88%

79%

76%

76%

64%

59%

56%

46%Sample Size = 246


Small

Medium

Large

0% 10% 20% 30% 40% 50%

By Org Size

Network Operations Seeing Most Issues Before End Users, But Not By Much

Sample Size = 246

Overall: 40.3%

Exec

Staff

0% 10% 20% 30% 40% 50%

By Role



Three Major Domains Equally Likely to Be Source of Outages

Slide 9

Several times a day

Several times a week, but less than several times a day

Several times a month, but less than several times a week

Every couple of months, but less than several times a month

Once or twice a year

Almost never

0% 5% 10% 15% 20% 25% 30%

7%

20%

24%

23%

16%

9%

10%

15%

25%

25%

17%

7%

9%

18%

22%

25%

17%

9%

Server/Storage related Application related Network related

Sample Size = 246



Sources for Availability/Performance Monitoring

Slide 10

Log Files

Management system APIs

Packet inspection

NetFlow/sFlow/IPFIX

Device APIs

SNMP MIBs/traps

Synthetic test

None of the Above

0% 10% 20% 30% 40% 50% 60% 70%

59%

46%

43%

37%

37%

35%

28%

7%Sample Size = 246



Sources for Network Troubleshooting

Slide 11

Log Files

Ping

Packet capture/analysis

Management system APIs

Device APIs

SNMP MIBs/traps

NetFlow/sFlow/IPFIX

CLI

None of the above

0% 10% 20% 30% 40% 50% 60% 70%

65%

51%

48%

41%

37%

34%

33%

28%

4%

Sample Size = 246



SNMP


SNMP

• Best used to identify and describe system configuration

• Monitor network-attached devices for high-level conditions

‒ Up/Down‒ Total traffic (bytes, packets)‒ Number of users

• Typically polling-based – heavy bandwidth impact

• Typically 5 minute granularity

• Trouble-shooting/root cause analysis not possible


Log Files

© WildPackets, Inc.#wp_networkperformance Network Visibility: The Key to Troubleshooting Networks 15

Log Files – Performance Monitoring and Network Troubleshooting

• The most popular choice per recent EMA survey: http://research.enterprisemanagement.com/network-management-megatrends2014-webinar.html

• Provide a very wide range of data and information‒ Server health‒ Network, application performance‒ Security events

• Collection, management, analysis quickly improving

• Strong indication of problems and their source, but not the root cause or the extent

http://research.enterprisemanagement.com/network-management-megatrends2014-webinar.html

http://research.enterprisemanagement.com/network-management-megatrends2014-webinar.html


Log File ExampleOmniPeek Logs in Splunk

16


Flow-based


"Go With the Flow"

• Flows, or flow records, are the default element used in centralized network monitoring

• A “flow” is a sequence of packets that has the following seven identical characteristics:

‒ Source IP address‒ Destination IP address‒ Source port‒ Destination port‒ Layer 3 protocol type‒ TOS byte‒ Input logical interface

• By implication, a flow is unidirectional


Basic Flow Analysis• Packets enter the switch or

router

• Packets sampled and flows determined

• Flow records compiled and exported to flow collector

• Flow records stored and subsequently analyzed by flow analysis software

• The most common standards for flow records include:

- NetFlow - sFlow- IPFIX - JFlow

Source: Wikipedia

http://en.wikipedia.org/wiki/File:Netflow_architecture_en.svg

http://en.wikipedia.org/wiki/File:Netflow_architecture_en.svg


Common Flow-based Technologies

Netflow IPFIX sFlow Jflow

•Developed by Cisco

•Proprietary•Transit traffic & terminated traffic

•Detailed info for each flow

•NO payloads•Sampling option not 100% accurate

• Internet Protocol Flow Information eXchange

• IETF standard•Based on NetFlow


•NO payloads

•RFC 3176•Statistical time-based sampling

•Higher speed networks

•Less common than NetFlow

•NO payloads•Sampled – not always 100% accurate

•Developed by Juniper

•Proprietary•Similar to NetFlow


•NO payloads•Sampled per global rate – not 100% accurate

Limited Troubleshooting/Root-cause Analysis


Packet-based


Packet-based

• Data generated by DPI systems

• Analysis of every packet AND payload

• Unrivaled info for each flow

• Layer 3 - 7

• 100% accurate

• Minimal network impact – 10’s of Kbps

• Monitor AND troubleshoot


Packet-based Flow Data


Breadth vs. Depth

24


From Monitoring to Troubleshooting

• High-level, aggregated view of all network segments

‒ Monitor per campus, per region, per country

• Wide range of network data‒ NetFlow, sFlow, OmniFlow

• Web-based, customizable network dashboards

• Flexible and detailed reports


Sample WatchPoint Dashboard


Monitoring AND Detailed Analysis


Choices and ComprisesD

ata

Gra

nula

rity

Data Accuracy

SNMP

Flow-based

Packet-based

Log Files


Summary

• Flow records are NOT created equal• OmniFlow analyzes packet headers AND payloads• OmniFlow is NOT statistical - 100% accurate• OmniFlow provides analysis for all network layers• WatchPoint aggregates data from multiple OmniFlow

data streams• When OmniFlow data isn’t available, WatchPoint also

aggregates both NetFlow and sFlow data for a comprehensive network monitoring solution


When Depth Matters

30


Application vs. Network


Measuring Link Quality• Compare simultaneous data from end to end

‒ A single point only tells you flow health‒ Multiple points measure link quality


Determining Sources of Latency• Comparative visualization of latency sources

‒ Allows quick latency troubleshooting‒ Graph wait times by application and network


Quality of User Experience

• Capture directly from end-user PC‒ See what the PC sees‒ No active connection required: diagnose connectivity issues

• Test servers using end-user experience‒ Client perspective measures how well service is delivering‒ Capture from multiple different clients for global perspective‒ Lightweight setup, no special equipment

• Remote troubleshooting‒ IT helpdesk or vendor tech support‒ Strong encryption: data isn’t exposed, even at rest

• Send the data, not an engineer!


Achieving Depth

35


Key Network Analysis Requirements

Ability to monitor VM-to-VM communications

Single platform for managing network performance and security

Access to network performance data based on job role and level of responsibility

Ability to monitor impact of routing changes on network traffic activity

End-to-end visibility into application transactions

Ability to analyze and report performance issues at 10Gbps line rate

24%

27%

30%

30%

34%

39%


10G Deployments – WildPackets Survey

37

The State of Faster Networks, WildPackets, Oct 2013

100 ParticipantsCompany size:

43% - Large organizations 26% - Medium 31% - Small

Functional Breakdown 84% - Network Engineer 15% - IT Director 1% - Executive


A Solution for Every Network

38


Omnipliance Is …

Powerful‒ Fastest network recorder in its class - Up to 25Gbps of real-world traffic‒ Up to 128 TB of storage‒ Simultaneous real-time analysis and comprehensive Forensic Search

Precise‒ Captures complete network traffic, so you can analyze everything, not just

samples or high-level statistics‒ Doesn’t drop packets or sacrifice accuracy for speed‒ Supports rich, detailed analysis, including VoIP and video-over-IP traffic

Affordable‒ Delivers outstanding price/performance (lower price; half the rack space)‒ Allows mix of 1G/10G/40G interfaces without buying extra appliances‒ Solutions start at $16,995


WildPackets Omnipliance FamilyPrice/Performance Solutions for Every Network

Omnipliance CX Omnipliance MX Omnipliance TL

1U rack mountable chassis 3U rack mountable chassis 3U rack mountable chassis - Main unit +3U rack mountable chassis - OmniStorage

16GB RAM 32GB RAM 64GB RAM

2 PCI-E Slots 4 PCI-E Slots 4 PCI-E Slots

2 Built-in Ethernet Ports 2 Built-in Ethernet Ports 2 Built-in Ethernet Ports

4/8/16TB Storage 16/32TB Storage 32/48/64TB StorageOptional OmniStorage 32/48/64 Up to 128TB total Storage

OmniAdapter 1G/10G MX OmniAdapter 1G/10G MX OmniAdapter 1G/10G/40G

3.8Gbps CTD 8.8Gbps CTD 25Gbps CTD with OmniStorage


Omnipliance TLIndustry Leading Network Analysis and Recorder Appliance

• Sets a new standard in capture-to-disk speeds‒ 25Gbps sustained capture to disk rate with zero packet drop

• Best price/performance Network Analysis Appliance in the market

‒ 25Gbps with only one Omnipliance TL and one OmniStorage‒ Consuming less rack space, less cooling, less electrical power

• Most flexible network interface offering‒ 1G/10G/40G interfaces supported in a

single unit eliminates additional unit requirement

• Most accurate real-time analytics− Packet-based processing and analysis vs.

inaccurate sample-based calculations


A Solution for Every NetworkLess demanding 1G or 10G traffic

•SMBs•Remote offices•Data center traffic less than 4Gbps

Omnipliance CX

Omnipliance MX

Omnipliance TL

Highly utilized 1G and 10G networks•Network Operation Centers (NOCs)•Data Centers•WAN Links •Data rate less than 8Gbps

High performance 1/10/40G networks•Network Forensics (large storage)•Transaction verification•Compliance/security•Data rate up to 20Gbps


Omnipliance – Achieving Breadth and Depth

43

Myth Busted

Can’t analyze at 10G line rate

Dropped packets

Captured data is not reliable

Inability to collect packets at all network locations

Inadequate real-time stats

Real-time analysis no longer an option

Limited visibility into VoIP

Inability to analyze/search recorded traffic

No end-to-end visibility into application transactions

Limitations in security monitoring


WildPackets Omnipliance Advantages

• Fastest write to disk with no packet loss

• Best price/performance

• Most flexibility with 1G/10G/40G Interface mix and match

• Newest technology

• Best UI

• Most accurate, packet-based analytics and statistics

• Fastest real-time analysis and capture to disk

• Rich, detailed analysis, including VoIP and video


Q&A

Show us your tweets!Use today’s webinar hashtag:

#wp_networkperformancewith any questions, comments, or feedback.

Follow us @wildpackets

Follow us on SlideShare!Check out today’s slides on SlideShare

www.slideshare.net/wildpackets


WildPackets Corporate Overview

Optimizing Network and Application Performance


Corporate Background

• Experts in network monitoring, analysis, and troubleshooting‒ Founded: 1990 / Headquarters: Walnut Creek, CA‒ Offices throughout the US, EMEA, and APAC

• Customers spanning leading edge organizations‒ Mid-market and enterprise lines of business‒ Financial, manufacturing, ISPs, major federal agencies,

state and local governments, universities‒ Over 7,000 customers / 60+ countries / 80% of Fortune 1,000

• Award-winning solutions that improve network performance‒ Internet Telephony, Network Magazine, Network Computing awards‒ United States Patent 5,787,253 issued July 28, 1998

• “Apparatus and Method of Analyzing Internet Activity”


Why Our Customers Need Us

• VoIP, video, cloud, virtualization, and key business applications are saturating critical network services

• Evolving network technologies create discontinuities‒ 1 Gig 10 Gig 40 Gig 100 Gig networks‒ Wireless, BYOD initiatives

• Users and business can not tolerate network problems for mission critical services

Increasing demand for better real-time network visibility, network analytics, network forensics, and DPI


How We Create Value

We provide innovative, industry-leading, real-time network performance management solutions

‒ Easy-to-use, easy-to-learn user interface

‒ Uniquely extensible solutions

‒ Wireless network leadership

‒ Detailed analytics related to network applications

‒ Fastest network traffic capture appliance in its class

‒ Technical superiority at competitive price point

WildPackets has continually advanced its solution to meet the needs of its customers


Unprecedented Network Visibility

ROOT-CAUSE ANALYSISOmniPeek network analyzer performs deep packet inspection and can reconstruct all network activity, including e-mail and IM, as well as analyze VoIP and video traffic quality.

PINPOINT NETWORK ISSUES ANYWHEREOmnipliance Portable can rapidly identify and troubleshoot issues before they become major problems—wired or wireless—down the hall or across the globe.

UNDERSTAND END-USER PERFORMANCEOmnipliance network analysis and recorder appliances monitorand analyze performance across critical networksegments, virtual environments, and remote sites.

NETWORK HEALTHWatchPoint can manage and report on keydevice performance and availability acrossthe entire network, from anywhere on the network.

GLOBAL

DISTRIBUTED

PORTABLE

DPI


A History of Innovation

2003Distributed real-time

troubleshooting

2001• First 802.11 wireless analyzer• First network analyzer with automated expert analysis

2005Combined distributed network and VoIP network analysis

2008Enterprise-wide

Monitoring and Reporting

2009Innovative dashboard with drill-down for VoIP and video

2012• Capture, record, and

analyze from 40G network segments

• First wireless network analyzer to support

801.11ac, k, r, u, v, w

2011• Total visibility with zero packet loss• First wireless network analyzer to support capture and analysis of 802.11n 3-stream wireless

2010First to achieve 11

Gbps sustained capture-to-disk

2013Industry leading

network analysis and

recorder appliances


Product Line Overview


Omni Distributed Analysis PlatformOmniPeek

Enterprise Packet Capture, Decode and Analysis• Ethernet,1/10 Gigabit, 802.11, and voice and video over IP• Portable capture and OmniEngine console • Aggregate analysis data across multiple capture points

OmniplianceNetwork Analysis and Recorder Appliances

• High-performance packet capture and real-time analysis• Stream-to-disk for forensics analysis• Integrated OmniAdapter network analysis cards up to 40G

WatchPointCentralized Enterprise Network Monitoring Appliance

• Aggregation and graphical display of network data• WildPackets OmniEngines• NetFlow and sFlow


Omni Distributed Analysis PlatformSoftware and Turnkey Solutions

• Enterprise monitoring and reporting‒ WatchPoint Server‒ OmniFlow, NetFlow, and sFlow Collectors

• Network Analysis and Recorder Appliances ‒ Omnipliance CX, MX, TL‒ Optional OmniStorage‒ OmniAdapter analysis cards

• Distributed analysis software‒ OmniPeek – Enterprise, Professional, Basic, Connect‒ OmniPeek Remote Assistant‒ OmniEngine Enterprise

• Portable solutions‒ OmniPeek network analyzer‒ Omnipliance Portable


OmniPeek Network Analyzer

• Distributed analysis manager– Connect to and configure distributed OmniEngines and Omnipliances,

• Comprehensive dashboards present network traffic in real-time– Vital statistics and graphs display trends on network and application

performance– Visual peer-map shows conversations and protocols– Intuitive drill-down for root-cause analysis of performance bottlenecks

• Visual Expert diagnosis speeds problem resolution– Packet and payload visualizers provide business-centric views

• Automated analytics and problem detection 24/7– Easily create filters, triggers, scripting, advanced alarms, and alerts


OmniPeek Remote AssistantDistributed, End-user Packet Capture Made Simple

• Simple to deploy, simple to use‒ Remote push, download from server, or even

email‒ Simple user interface - eliminates confusion for

end user‒ Full fidelity capture - see exactly what the PC

sees‒ Wired or wireless

• Encrypted file‒ Only the analyst can open it‒ Different encryption keys for different locations

or customers

• Detailed client-side/end-user experience analysis

• Perfect for Tech Support or IT Desktop support

Trouble call from remote site - network response is slow.

User downloads and installs OmniPeek Remote. Encrypted capture

data sent back for analysis.

Network analyst uses OmniPeek Enterprise to quickly troubleshoot problem without leaving the office.


OmniWiFi USB WLAN Capture Adapter

• A single device for all WLAN packet capture needs

• Driver included with Omni v7.9 CDs

• Tested and supported with OmniPeek and OmniEngine

• Product features:• USB device with extension cable• Dual band operation – 2.4GHz and 5GHz• Supports all standard international 802.11 channels (a/b/g/n)• Supports 802.11n - 3 transmit/receive streams (450Mbps)• Supports 802.11n 20MHz and 40MHz channel operation• Supports multi-channel aggregation and roaming

• Technical Details:‒ Size (LWH): 6 inches, 1.5 inches, 5.5 inches‒ Weight: 5.6 ounces

• Available via Amazon - $99/each

NOTE: • Capture ONLY – no network services• Does not capture 802.11ac


New Network Analysis and Recorder Appliances

Powerful Precise Affordable

The new family of WildPackets Network Analysis and Recorder appliances gives IT organizations powerful and precise analysis of

high-speed networks in an affordable solution with half the hardware footprint of rival offerings.


Powerful‒ Fastest network recorder in its class! Captures traffic up to 20Gbps of real-

world traffic (all size packet distribution) ‒ Scales up to 128 TB of storage‒ Provides simultaneous real-time analysis and a comprehensive Forensic

Search that rapidly searches through terabytes of captured traffic for the details relevant to an investigation

Precise‒ Captures complete network traffic, so you can analyze everything, not just

samples or high-level statistics‒ Doesn’t drop packets or sacrifice accuracy for speed‒ Supports rich, detailed analysis, including VoIP and video-over-IP traffic

Affordable‒ Delivers outstanding price/performance (lower price; half the rack space)‒ Allows mix of 1G/10G/40G interfaces without buying extra appliances‒ Solutions start at $16,995

Your network is bigger and faster. Now your analysis solution is, too.


Omnipliance TLIndustry Leading Network Analysis and Recorder Appliance

• Sets a new standard in capture-to-disk speeds‒ 20Gbps sustained capture to disk rate with zero packet drop

• Best price/performance Network Analysis Appliance in the market

‒ 20Gbps with only one Omnipliance TL + OmniStorage‒ Consuming less rack space, less cooling, less electrical power

• Most flexible network interface offering‒ 1G/10G/40G interfaces supported in a single unit eliminates

additional unit requirement

• Most accurate real-time analytics‒ Packet-based processing and analysis vs. inaccurate sample-

based calculation


WildPackets Network Analysis Recorder AppliancesPrice/Performance Solutions for Every Application

Portable Omnipliance CX Omnipliance MX Omnipliance TL

Ruggedized Troubleshooting

Less Demanding Networks

Remote Offices

Datacenter WorkhorseEasily Expandable

Enterprise, Highly-Utilized Networks

Aluminum chassis / 17” LCD 1U rack mountable chassis 3U rack mountable chassis 3U rack mountable chassis

24GB RAM 16GB RAM 32GB RAM 64GB RAM

2 PCI-E Slots 2 PCI-E Slots 4 PCI-E Slots 4 PCI-E Slots

2 Built-in Ethernet Ports 2 Built-in Ethernet Ports 2 Built-in Ethernet Ports 2 Built-in Ethernet Ports

6TB Storage 4/8/16TB Storage 16/32TB Storage 32/48/64TB StorageOptional OmniStorage: 32/48/64TB Up to 128TB total Storage

OmniAdapter 1G and 10G OmniAdapter 1G/10G MX OmniAdapter 1G/10G MX OmniAdapter 1G/10G/40G

6.5Gbps CTD 3.8Gbps CTD 8.8Gbps CTD 20Gbps CTD with OmniStorage


WatchPointCentralized Monitoring for Distributed Enterprise Networks

• High-level, aggregated view of all network segments– Monitor per campus, per

region, per country• Wide range of network

data– NetFlow, sFlow, OmniFlow

• Web-based, customizable network dashboards

• Flexible detailed reports• Direct link to detailed,

packet-based analysis


Comprehensive Support and Services Standard Support

Maintenance and upgrades Telephone and email contacts Knowledgebase MyPeek Portal

Premier Support 24 x 7 x 365 Dedicated escalation manager 2 customer contacts per site Plug-in reconfiguration assistance

WildPackets Training Academy Public, web-based, and on-site classes Complete curriculum: technology and product focused Practical applications and labs covering network analysis,

wireless, VoIP monitoring and advanced troubleshooting

Consulting and Custom Development Services Deployment, configuration, and assessment engagement Systems integration and testing Application integration, driver, decode, interface development


WildPackets Key Differentiators

• Visual Expert intelligence with intuitive drill-down– Let computer do the hard work, and return results, real-time – Packet /payload visualization is faster than packet-per-packet diagnostics– Experts and analytics can be memorized and automated

• Automated capture analytics– Filters, triggers, scripting, and advanced alarming system combine to provide

automated network problem detection 24x7• Multiple issue network forensics

– Can be tracked by one or more people simultaneously– Real-time or post capture

• User-extensible platform– Plug-in architecture and SDK

• Aggregated network views and reporting– NetFlow, sFlow, and OmniFlow


24x7 Network Monitoring,Analysis, and Troubleshooting


Thank You!

WildPackets, Inc.1340 Treat Boulevard, Suite 500Walnut Creek, CA 94597(925) 937-3200

network network visibility - the key to rapidly troubleshooting network performance issues

Technology

network troubleshooting

centralized network

jaybotelho network visibility

network performance

org size network operations

typical networks

flow records

flow flows