A Confluence of Flows: Keeping Your Head Above Water

1,098 views
1,024 views

Published on

Watch the full OnDemand Webcast: http://bit.ly/confluenceoflows

Just about everyone, or at least everyone interested in network monitoring and analysis, has heard of NetFlow and sFlow. But how about OmniFlow, an expanded version of flow-based data based on deep packet inspection?

Flow-based data is widely available from almost any modern network device, and this data has become the basis of many very popular network monitoring solutions. Though readily available, traditional flow-based data can be incomplete, sometimes generating misleading results. Also, traditional flow-based analysis does not provide the detailed information required to troubleshoot network anomalies. What if the sampling algorithm is skewing your data or causing you to miss critical issues? What if the information required to troubleshoot a problem is in the payload and not the packet header? What if you need a single solution to monitor AND troubleshoot network problems?

This web seminar will introduce you to OmniFlow, and the possibility of a new "standard" in flow-based analysis.

In these slides, we cover:

- Common techniques used in network monitoring
- Strengths and weaknesses of current network monitoring technologies
- The importance of packet-based troubleshooting in today’s networks
- The role of OmniFlow in providing end-to-end network monitoring and analysis

What you will learn:

- What network monitoring technologies best meet your requirements
- How to achieve greater visibility with OmniFlow
- Why analysis that includes packet payloads is critical
- How end-to-end network monitoring and analysis saves time and money

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
1,098
On SlideShare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
45
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

A Confluence of Flows: Keeping Your Head Above Water

  1. 1. A Confluence of Flows Keeping Your Head Above WaterJay Botelho Show us your tweets!Director of Product Management Use today’s webinar hashtag:WildPacketsjbotelho@wildpackets.com #wp_omniflowFollow me @jaybotelho with any questions, comments, or feedback. Follow us @wildpackets © WildPackets, Inc. www.wildpackets.com
  2. 2. There’s no debate about the need for centralized network monitoring The question is HOW? A Confluence of Flows © WildPackets, Inc. 2
  3. 3. Choices and ComprisesData Granularity Packet-based Flow-based SNMP Data Accuracy Overhead??? Cost??? A Confluence of Flows © WildPackets, Inc. 3
  4. 4. SNMP © WildPackets, Inc. www.wildpackets.com
  5. 5. SNMP• Best used to identify and describe system configuration• Monitor network-attached devices for high-level conditions ‒ Up/Down ‒ Total traffic (bytes, packets) ‒ Number of users• Typically polling-based – heavy bandwidth impact• Typically 5 second granularity• Trouble-shooting/root cause analysis not possible A Confluence of Flows © WildPackets, Inc. 5
  6. 6. Flow-based © WildPackets, Inc. www.wildpackets.com
  7. 7. "Go With the Flow"• Flows, or flow records, have become the default element used in centralized network monitoring• A ―flow‖ is a sequence of packets that has the following seven identical characteristics: ‒ Source IP address ‒ Destination IP address ‒ Source port ‒ Destination port ‒ Layer 3 protocol type ‒ TOS byte ‒ Input logical interface• By implication, a flow is unidirectional A Confluence of Flows © WildPackets, Inc. 7
  8. 8. Basic Flow Analysis• Packets enter the switch or router• Packets sampled and flows determined• Flow records compiled and exported to flow collector• Flow records stored and subsequently analyzed by flow Source: Wikipedia analysis software A Confluence of Flows © WildPackets, Inc. 8
  9. 9. Flows vs. Flow Records• Flows are a defined element• Flow Records are analytical results that vary by overall standard, vendor and configuration• The most common standards for flow records include: ‒ NetFlow ‒ IPFIX ‒ sFlow ‒ JFlow A Confluence of Flows © WildPackets, Inc. 9
  10. 10. Focus on NetFlow• Packets typically 1500 Bytes each• Packets come in spurts – up to several Mbytes• 20 – 50 flow records per reporting interval• Typically 1 minute reporting granularity• Typically ―1 out of k‖ static sampling• Overhead (bandwidth usage - # of packets in reporting period) linearly proportional to the # of flows• Remember the prime directive – a switch MUST perform its primary function – forwarding packets!• Lost reporting packets can seriously impact data reliability• A higher number of smaller flows creates greater inaccuracies A Confluence of Flows © WildPackets, Inc. 10
  11. 11. On Your Network … A Confluence of Flows © WildPackets, Inc. 11
  12. 12. The Details A Confluence of Flows © WildPackets, Inc. 12
  13. 13. Common Flow-based Technologies Netflow IPFIX sFlow Jflow • Developed by • Internet Protocol • RFC 3176 • Developed by Cisco Flow Information • Statistical time- Juniper • Proprietary eXchange based sampling • Proprietary • Transit traffic & • Emerging IETF • Higher speed • Similar to terminated traffic standard networks NetFlowLimitedinfo for • Based on • Detailed Troubleshooting/Root-cause Analysis for • Much less • Detailed info each flow NetFlow common than each flow • NO payloads • Detailed info for NetFlow • NO payloads each flow • NO payloads • Sampling option • Sampled per not 100% • NO payloads • Sampled – not global rate – not accurate 100% accurate 100% accurate A Confluence of Flows © WildPackets, Inc. 13
  14. 14. Packet-based OmniFlow © WildPackets, Inc. www.wildpackets.com
  15. 15. Packet-based - OmniFlow• Developed by WildPackets• Analysis of every packet AND payload• Unrivaled info for each flow• Layer 3 - 7• 100% accurate• Minimal network impact – 10’s of Kbps• Monitor AND troubleshoot A Confluence of Flows © WildPackets, Inc. 15
  16. 16. OmniFlow Data A Confluence of Flows © WildPackets, Inc. 16
  17. 17. Why Are Payloads Important? A Confluence of Flows © WildPackets, Inc. 17
  18. 18. OmniFlow and WatchPoint • High-level, aggregated view of all network segments ‒ Monitor per campus, per region, per country • Wide range of network data ‒ NetFlow, sFlow, OmniFlow • Web-based, customizable network dashboards • Flexible and detailed reports A Confluence of Flows © WildPackets, Inc. 18
  19. 19. Sample WatchPoint Dashboard A Confluence of Flows © WildPackets, Inc. 19
  20. 20. Monitoring AND Detailed Analysis A Confluence of Flows © WildPackets, Inc. 20
  21. 21. Not All Flows Are Created Equal Netflow IPFIX sFlow Jflow OmniFlow• Developed by • Internet • RFC 3176 • Developed by • Developed by Cisco Protocol Flow • Statistical Juniper WildPackets• Proprietary Information time-based • Proprietary • Proprietary eXchange sampling• Transit traffic • Similar to • Analysis of & terminated • Emerging • Higher speed NetFlow every packet traffic IETF standard networks AND payload • Detailed info• Detailed info • Based on • Much less for each flow • Unrivaled info for each flow NetFlow common than for each flow • NO payloads• NO payloads • Detailed info NetFlow • Layer 3 - 7 • Sampled per for each flow • NO payloads• Sampled global rate – • 100% option not • NO payloads • Sampled – not not 100% accurate 100% 100% accurate • Monitor AND accurate accurate troubleshoot A Confluence of Flows © WildPackets, Inc. 21
  22. 22. Choices and ComprisesData Granularity Packet-based Flow-based SNMP Data Accuracy Overhead Cost A Confluence of Flows © WildPackets, Inc. 22
  23. 23. Summary• Flow records are NOT created equal• OmniFlow analyzes packet headers AND payloads• OmniFlow is NOT statistical - 100% accurate• OmniFlow provides analysis for all network layers• WatchPoint aggregates data from multiple OmniFlow data streams• When OmniFlow data isn’t available, WatchPoint also aggregates both NetFlow and sFlow data for a comprehensive network monitoring solution A Confluence of Flows © WildPackets, Inc. 23
  24. 24. Company Overview © WildPackets, Inc. www.wildpackets.com
  25. 25. Corporate Background• Experts in network monitoring, analysis, and troubleshooting ‒ Founded: 1990 / Headquarters: Walnut Creek, CA ‒ Offices throughout the US, EMEA, and APAC• Our customers are leading edge organizations ‒ Mid-market, and enterprise lines of business ‒ Financial, manufacturing, ISPs, major federal agencies, state and local governments, and universities ‒ Over 7,000 customers / 60+ countries / 80% of Fortune 1,000• Award-winning solutions that improve network performance ‒ Internet Telephony, Network Magazine, Network Computing Awards ‒ United States Patent 5,787,253 issued July 28, 1998 • Different approach to maintaining availability of network services A Confluence of Flows © WildPackets, Inc. 25
  26. 26. What We Do• Provide network visibility and intelligence … ‒ WatchPoint, OmniPeek, OmniEngines • Expert systems – we find the problems for you • Superior drill-down capability – trouble-shoot from anywhere • Flexible, customizable, extensible – leverage your investment ‒ Professional services, training, best practices• For all network segments … ‒ Data center to desktop to remote office ‒ LAN, WAN, Wireless … ‒ HTTP, Email, Database, VoIP, Video …• To … ‒ Network engineers; IT Management; Developers A Confluence of Flows © WildPackets, Inc. 26
  27. 27. Real-World Deployments Education Financial GovernmentHealth Care / Retail Telecom Technology A Confluence of Flows © WildPackets, Inc. 27
  28. 28. Product Line Overview © WildPackets, Inc. www.wildpackets.com
  29. 29. Product Offerings Software and Turnkey Appliances• Enterprise Monitoring and Reporting ‒ WatchPoint Server ‒ OmniFlow, NetFlow, and sFlow Collectors• Network Probes & Recorders ‒ Omnipliance Network Recorders – Edge, Core ‒ TimeLine Network Recorder ‒ OmniAdapter Analysis Cards• Distributed Analysis Software ‒ OmniPeek – Enterprise, Professional, Basic, Connect ‒ OmniEngine – Enterprise, Desktop, OmniVirtual• Portable Solutions ‒ OmniPeek software ‒ Omnipliance Portable A Confluence of Flows © WildPackets, Inc. 30
  30. 30. WatchPointCentralized Monitoring for Distributed Enterprise Networks • High-level, aggregated view of all network segments ‒ Monitor per campus, per region, per country • Wide range of network data ‒ NetFlow, sFlow, OmniFlow, SNMP • Web-based, customizable network dashboards • Flexible and detailed reports A Confluence of Flows © WildPackets, Inc. 31
  31. 31. A Confluence of Flows © WildPackets, Inc. 32
  32. 32. Omnipliance Network Recorders• Captures and analyzes all network traffic at the source 24x7 ‒ Runs our OmniEngine intelligent probe software ‒ Generates vital statistics on network and application performance ‒ Intuitive root-cause analysis of performance bottlenecks• Intelligent data transport ‒ Network data analyzed locally ‒ Detailed analysis passed to OmniPeek on demand ‒ Summary statistics sent to WatchPoint for long term trending and reporting ‒ Efficient use of network bandwidth• Expert analysis speeds problem resolution ‒ Fault analysis, statistical analysis, and independent notification• Multiple Issue Digital Forensics ‒ Real-time and post capture data mining for compliance and troubleshooting A Confluence of Flows © WildPackets, Inc. 33
  33. 33. TimeLine Network Recorder 11.7Gbps Sustained Capture • Fastest network recording and real-time statistical display — simultaneously ‒ Network statistics display in TimeLine visualization format • Rapid, intuitive forensics search and retrieval ‒ Historical network traffic analysis and quick data rewinding ‒ Several pre-defined forensics search templates making searches easy and fast • A natural extension to the WildPackets product line • Turnkey bundled solution A Confluence of Flows © WildPackets, Inc. 34
  34. 34. Omnipliance Network Recorders Price/performance solutions for every application Portable Edge Core TimeLine Ruggedized Small Networks / Regional Offices / Datacenter Troubleshooting Remote Offices Small Datacenter WorkhorseChassis 1U 3U 3UMemory 2 GB / 8 GB 4 GB / 8 GB 6 GB / 24 GB 18 GB / 24 GBExpansion 1 PCI-E / 2 PCI-X 1 PCI-E or 1 PCI-X 4 PCI-E 4 PCI-EStorage 500 GB / 2.5 TB 1 TB 8 TB 8 TB / 16 TB / 32 TB A Confluence of Flows © WildPackets, Inc. 35
  35. 35. OmniPeek Network Analyzer• OmniEngine Manager ‒ Connect and configure distributed OmniEngines/Omnipliances• Comprehensive dashboards present network traffic in real-time ‒ Vital statistics and graphs display trends on network and application performance ‒ Visual peer-map shows conversations and protocols ‒ Intuitive drill-down for root-cause analysis of performance bottlenecks• Visual Expert diagnosis speeds problem resolution ‒ Packet and Payload visualization provide business-centric views• Automated analytics and problem detection 24/7 ‒ Easily create filters, triggers, scripting, advanced alarms and alerts A Confluence of Flows © WildPackets, Inc. 36
  36. 36. Key Differentiators• High-level network monitoring to root-cause analysis• Single solution for today’s converged networks ‒ Wired, Wireless, 1GB, 10GB, VoIP, Video, TelePresence, IPTV• Reduce and even eliminate network downtime ‒ Automated monitoring 24x7 ‒ Speedy resolution of network bottlenecks• Improve network and application performance• Uniquely Extensible Platform – tailored to your needs ‒ Plug-ins and APIs for integration and customization A Confluence of Flows © WildPackets, Inc. 37
  37. 37. Q&A Show us your tweets! Use today’s webinar hashtag: Follow us on SlideShare! Check out today’s slides on SlideShare #wp_omniflow www.slideshare.net/wildpacketswith any questions, comments, or feedback. Follow us @wildpackets © WildPackets, Inc. www.wildpackets.com
  38. 38. Thank You!WildPackets, Inc.1340 Treat Boulevard, Suite 500Walnut Creek, CA 94597(925) 937-3200 © WildPackets, Inc. www.wildpackets.com

×