Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Prepare for the Inevitable: A Best Practice Guide to Network Recording


Published on

For organizations that depend critically on their network for business continuity, dedicated network recording infrastructure is fast becoming an essential part of the data center make-up.

But not all network recorders are equal. The right choice of recorder can help reduce the risk of unplanned downtime, drive down operational costs, improve time-to-value on new IT investments, manage the risk of security breach and kill off all manner of zombie trouble tickets that just refuse to lie down and die. The wrong choice can leave you more confused than when you started.

In this webinar we’ll explore the different infrastructure options that organizations have for recording and mining historical network traffic. We'll explore what matters most when all the lights go off and share some best-practice insights gleaned from working with customers that run some of the largest and most critical data networks on the planet.

Published in: Technology
  • Be the first to comment

  • Be the first to like this

Prepare for the Inevitable: A Best Practice Guide to Network Recording

  1. 1. © 2013 Emulex Corporation Network Recording Best Practice Fail-safe Network and Security Event Analysis Sri Sundaralingam – VP Product Management
  2. 2. 2 Emulex Confidential - © 2013 Emulex Corporation Introducing Endace Products A division of Emulex World leader in packet capture and network recording 10+ year history selling network visibility to top-tier customers – Govt, HFT, telco and enterprise Global reputation for accuracy, scalability and performance
  3. 3. 3 Emulex Confidential - © 2013 Emulex Corporation Investments in Network Health: 4 Categories 1. Prevention 2. Detection Detect things that may be bad and were missed by prevention tools; generate alerts Sit in the network and stop known bad things from happening 3. Response 4. Root cause Help engineers respond to any kind of network-related problem fast Enable engineers to understand exactly what happened and why 3 4 2 1 NPM APM SIEM Firewall Wan Ops NGF
  4. 4. 4 Emulex Confidential - © 2013 Emulex Corporation Standard Corporate Investment Profile 1. Prevention 2. Detection 3. Response 4. Root cause 70% 0% 5% 25% 2 1 3 4 Characteristics • High alert & False +ive rate • Sample driven • Broad view, low granularity • Statistical analysis Characteristics • Signature based • Optimize for known • Static Issues • Hard to isolate problems • Long/indefinite TTR • Tools deployed after event • Intermittent problems Issues • Low bandwidth • Incomplete data • High price / low value
  5. 5. 5 Emulex Confidential - © 2013 Emulex Corporation 70% 25% Impact of Investment ‘Imbalance’ 0% 5% Backlog of events in NOC and SOC Slow time-to-resolution on issues Delayed response to events High incidence of zombie tickets No ability to contain real problems Real risk of unplanned downtime
  6. 6. 6 Emulex Confidential - © 2013 Emulex Corporation Intelligent Network Recording 60% 10% 10% 20% Improve operational productivity Improve confidence levels Reduce operational costs Ensures effective containment Reduce time-to-value on new IT Reduces risk of downtime
  7. 7. 7 Emulex Confidential - © 2013 Emulex Corporation Who Values Accurate Network History? Network operations teams rely on network history for troubleshooting Network planning teams rely on accurate historical data for trending Network security teams need history for breach containment and forensics Compliance, legal and risk teams need history as evidentiary proof
  8. 8. 8 Emulex Confidential - © 2013 Emulex Corporation What’s Important in Network Recording? Accuracy of recording Write-to-disk speed Storage capacity and flexibility Richness of indexing Effectiveness of workflow Platform flexibility
  9. 9. 9 Emulex Confidential - © 2013 Emulex Corporation EndaceProbe™ INR Appliances Next generation sniffer 100% accurate traffic recording – Real 10 Gbps performance Up to 64 TB of local storage – Extensible via sledding or SAN Full flow-based traffic indexing – Including application classification Open and flexible – Endace Application dock – Programmable RESTful API
  10. 10. 10 Emulex Confidential - © 2013 Emulex Corporation Total Datacenter Visibility
  11. 11. 11 Emulex Confidential - © 2013 Emulex Corporation Detection ToolsDDoS IDS NPM Core routers and switches (connectivity) Firewalls (prevention) Corenetworkinfrastructure EndaceProbe Intelligent Network Recorders Data Center Network Visibility Stack APM Network Packet Brokers (aggregation) SIM NMS
  12. 12. 12 Emulex Confidential - © 2013 Emulex Corporation Traffic Search and Retrieval - EndaceVision™ Web-based collaborative traffic search engine More than 20 indexed flow parameters – Includes application classification Rapid network-wide search Elegant investigation workflow Fast access to raw packets as required Local protocol decoding Integrated collaboration tools
  13. 13. 13 Emulex Confidential - © 2013 Emulex Corporation Streamlining Workflow Workflow start with an event detected by 3rd party tool Analysts pivot between 3rd party dashboard and EndaceVision RESTful API integration further streamlines workflow
  14. 14. 14 Emulex Confidential - © 2013 Emulex Corporation Network Retention Best Practice Where to record – Data center: aggregation links – DMZ: web and application gateways What to record – Full packet contents vs. headers – Full NetFlow records / metadata – Control plane vs. data plane How long to retain – 3 days complete history – 30+ days select history
  15. 15. 15 Emulex Confidential - © 2013 Emulex Corporation Business Benefits Reduces time-to-resolution on events – Reduces impact and costs associated with unplanned network downtime Improves overall network performance and application delivery – Treating causes not symptoms Increases analyst productivity – Reduces opex burden – Allows team to scale for the future Closes a potential compliance loop hole Reduces overall capital exposure – One solution for netops and secops
  16. 16. 16 Emulex Confidential - © 2013 Emulex Corporation Conclusions Network recording is essential for mission critical network environments where downtime costs real money Testing the fidelity of recording and the ease of search / retrieval before you invest is key Streamlining the investigation workflow for NetOps and SecOps users generates real measurable business value Dedicated, open recording infrastructure is more valuable and trustworthy than recording as a feature of another solution.
  17. 17. 17 Emulex Confidential - © 2013 Emulex Corporation Thank you.