Next-Generation Network Packet Brokers: Defining the Future of Network Visibility Fabrics

IT & DATA MANAGEMENT RESEARCH,
INDUSTRY ANALYSIS & CONSULTING
Next-Generation
Network Packet Brokers
Defining the Future of Network Visibility Fabrics
Shamus McGillicuddy
Research Director
Enterprise Management Associates

Watch the On-Demand Webinar
• Next-Generation Network Packet Brokers: Defining the Future
of Network Visibility Fabrics On-Demand webinar is available
here: https://ema.wistia.com/medias/fvzt3secse
• Check out upcoming webinars from EMA here:
http://www.enterprisemanagement.com/freeResearch

INDUSTRY ANALYSIS & CONSULTING3 © 2018 Enterprise Management Associates, Inc.
Featured Speaker
Shamus McGillicuddy
Research Director, EMA
Shamus has more than 12 years of experience in
the IT industry, as an industry analyst and
journalist. At Enterprise Management Associates
(EMA), he is the research director for the network
management practice.

INDUSTRY ANALYSIS & CONSULTING4 © 2018 Enterprise Management Associates, Inc.
Logistics
An archived version of the event recording will be available at
www.enterprisemanagement.com
• Log questions in the chat panel located on the lower left-
hand corner of your screen
• Questions will be addressed during the QandA session of
the event
QUESTIONS
EVENT RECORDING

Sponsors
6 © 2018 Enterprise Management Associates, Inc.

Agenda
• Definitions, Research Goals, and Methodology
• Network Visibility Fabric Deployments
• Defining the Network Visibility Fabric of the Future
• Using the Fabric
• Benefits and Challenges

Definitions, Research Goals,
and Methodology

Definitions: What is a Network Visibility Fabric?
• Network Visibility Fabric
• A network that collects and delivers traffic (primarily packets) to IT
operations & security analysis tools
• Includes taps, SPAN ports, software probes, bypass switches, and
network packet brokers
• Network Packet Broker
• AKA network visibility controllers and network monitoring switches
• Core of the fabric
• Aggregates traffic from taps, SPANs, etc.
• Processes the traffic data (filtering, modifying, time stamping, etc.)
• Sends groomed and/or load balanced traffic to individual tools for
analysis

Research Goals
• Identify the current and future state of enterprise network visibility
fabrics—particularly network packet brokers
• Implementation strategies
• Product requirements
• Current use cases
• Emerging solutions for new use cases
• Technical and business challenges

Research Methodology
• Survey 250 enterprise IT professionals who:
• Hold mid- to executive-level positions in enterprise IT and security
organizations
• Possess subject matter expertise
• Have NPBs currently deployed in their infrastructure
• Are directly involved in at least one aspect of the visibility fabric and
NPB lifecycle
 Product evaluators
 Purchasers
 Implementers
 Users

Research Demographics
IT Role
• 37% IT executives
• 63% IT staff and
• middle management
IT Group
• 25% Security
• 75% IT ops/engineering,
etc.
Size of Company
• 50% Midmarket (250 to 2,499
employees)
• 50% Large Enterprise
(2,500+ employees
Annual Revenue
• 37% less than
$100 million
• 63% $100 million
or more
Geography
• 51% North American
• 49% European
19 Industries
• 15% Finance/Banking/Insurance
• 14% Software
• 12% Retail/Wholesale/Distribution
• 11% Application/Cloud Service
Provider
• 8% Manufacturing (non-IT products)

Network Visibility Fabric Deployments

Enterprises are Gradually Expanding the use of Taps
1%
11%
37%
35%
12%
2% 2%
5% 6%
32%
40%
14%
3%
1%
100% Tap 76%-99% Tap 51%-75% Tap 50% Tap/50%
SPAN
51%-75% SPAN 76-99% SPAN 100% SPAN
Mix of Taps vs. SPAN in visibility fabrics, 2013 versus 2018
2018 2013

Where Network Packet Brokers are Deployed
2%
30%
31%
32%
35%
35%
36%
42%
48%
2%
27%
25%
25%
22%
30%
25%
27%
23%
Other
Campus backbone
DMZ
End of row
Backhaul links
Remote sites
Top of rack
Data center edge (ingress/egress)
Data center core network
Deploying in 12 months Current
• Most popular locations
for NPBs
• Data center core
• Data center edge
• Significant uptick in
remote site deployments
next year

Visibility Fabrics Rarely Monitor 100% of the Network
NetOps Coverage
• Only 5% of enterprises have
100% coverage
• 17% cover between 80%
and 99% of segments
and 90%
Security Coverage
• Only 11% of enterprises
have 100% coverage
and 99% of segments
• 35% between 60% and 80%

Why not 100% Coverage?
Network Complexity
38%
Compliance Risk
33%
Current Coverage is
Enough
30%
Lack of Budget
27%
Shortage of
Taps/SPANs/NPB
26%

Defining the Network Visibility
Fabric of the Future

Critical NPB Architectural Features
47%
46%
45%
44%
43%
43%
41%
40%
38%
38%
36%
High availability/fault tolerance
Event-triggered automated actions
Onboard data storage
Direct/embedded security controls
RSPAN/remote access
Direct/embedded performance monitoring
Direct/embedded security monitoring
Data-triggered automated actions
NEBS compliance
Clustering
Support for copper and fiber on the same appliance

Critical Packet Manipulation Features for Network
Operations Monitoring
• Decryption (45%)
• Time stamping (42%)
• Outer (non-encapsulated) layer 2-4 load balancing (41%)
• IPv6 support (40%)
• Inner (encapsulated) layer 2-4 load balancing (40%)
• Outbound layer 2-4 filtering (39%)
• Outbound layer 7 filtering (38%)
• Packet slicing (38%)
• Metadata generation (38%)

Critical Packet Manipulation Features
for Out-of-Band Security
• Intelligent deduplication (e.g., session ID) (44%)
• Metadata generation (44%)
• NetFlow/sFlow/IPFIX generation (43%)
• Outer (non-encapsulated) layer 2-4 load balancing (42%)
• Inbound layer 2-4 filtering (42%)
• Packet slicing (40%)
• Basic packet deduplication (39%)
• Tunneling (38%)
• Time stamping (38%)

Critical Packet Manipulation Features for
Inline Security Monitoring and Controls
• Decryption (41%)
• Inbound layer 7 filtering (40%)
• Basic packet deduplication (40%)
• Inbound layer 2-4 filtering (38%)
• Outbound layer 2-4 filtering (38%)
• Advanced header stripping (e.g., MPLS, GRE) (38%)

Disaggregated Network Packet Brokers
• 29% have deployed “white box”
or “brite box” NPBs
• 56% plan to deploy within 3
years
• Disaggregation challenges
1. Internal skills gap (32%)
2. Commodity hardware lacks
resources for advanced
functionality (26%)
3. Divided support model (22%)
45%
40%
34%
29%
26%
Flexible software options
Flexible hardware options
Reduced complexity
Reduced operational expenses
Reduced capital expenses
Why disaggregate?

Traffic Capture in the Public Cloud
• 37% are collecting traffic data in the public cloud for analysis
• 33% are planning or implementing a solution
• No consensus on how to approach this
• 34% use native traffic capture solutions (e.g., Azure Network Watcher)
• 32% use NPB or tap software implemented via cloud provider
marketplace
• 34% use NPB or tap software installed directly in cloud workload
• What do they capture?
• 55% collected packet header info
• 56% collect full packets
• 57% collect packet metadata

Using the Network Visibility Fabric

Network and Security Teams Share the Fabric
• EMA recommendation
• Establish processes & best
practices
• Avoid conflicts over packet
access
• Better security posture
 Broader coverage with security
tools
 More use of layer 7 packet
manipulation features
Formal
processes
and best
practices
51%
Ad hoc
39%
Third-party
intermediary
4%
No
collaboration
6%
Nature of NetOps/SecOps
visibility fabric collaboration

Inline Network Packet Broker Usage
• 78% have connected security tools to inline NPBs
• 86% of organizations with formal network and security collaboration
• Applying patches/updates to inline tools
• 43% leverage high-availability architecture
• 34% schedule downtime
• 22% allow traffic to pass through uninspected

Tools connected to network packet brokers,
today and in 12 months
55%
50% 50% 50% 47% 46% 44% 44% 40% 39% 38% 38% 37% 36% 36% 34%
28%
12%
17% 17% 15% 18% 16% 19% 17%
18% 22% 21% 20%
17%
24% 23%
20%
27%
Currenlty deployed Deployed in 12 months

Benefits and Challenges
of Network Visibility Fabrics

Challenges to Success with Network Visibility Fabrics and
Packet Brokers
33%
32%
31%
30%
26%
24%
20%
20%
0%
Architectural complexity
Lack of personnel with visibility fabric skills
Scalability/ease of expansion
Traffic is overwhelming the visibility fabric
Lack of change management control
Limited access to packet flows in the cloud
Insufficient budget
Poor product quality/reliability
Other
Sample Size = 250, Valid Cases = 250, Total Mentions = 543

Enhanced IT productivity
(38%)
Improved IT collaboration
(37%)
TOP
BENEFITS
IT agility (28%)
Accelerated security incident detection
(26%)
Faster resolution of IT service trouble
(24%)
Improved SLA performance (24%)
Secondary
benefits
Most Valuable Benefits of Network Visibility Fabrics
and Packet Brokers

Conclusion
• Visibility fabrics rarely cover 100% of a network
• Network complexity and compliance risk are chief barriers
• Critical packet broker features vary by use case
• L7 and L2-4 filtering and decryption are critical to inline security
• Decryption, time-stamping, and load balancing are critical to NetOps
• Enterprises have significant interest in disaggregated NPB solutions, but a
skills gap looms
• No consensus on public cloud traffic capture
• Many NetOps and SecOps teams have formalized fabric collaboration
• Visibility fabrics typically boost IT productivity and enhance IT collaboration

Q&A
Please log your
questions in the
Q&A window

Next-Generation Network Packet Brokers: Defining the Future of Network Visibility Fabrics

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Next-Generation Network Packet Brokers: Defining the Future of Network Visibility Fabrics

Similar to Next-Generation Network Packet Brokers: Defining the Future of Network Visibility Fabrics (20)

More from Enterprise Management Associates

More from Enterprise Management Associates (20)

Recently uploaded

Recently uploaded (20)

Next-Generation Network Packet Brokers: Defining the Future of Network Visibility Fabrics