Slide for Savvius workshop on 26 Feb 2016

1. © S A V V I U S , I N C | w w w . s a v v i u s . c o m
Introduction to Network Analytics
Santisook L.
Director
26 March 2016

2. © Savvius, Inc.
2Confidential
Networking analytics
provides insight into what devices are on the network
and how they are communicating with each other. This helps
networking teams who are increasingly responsible for more and
more applications/services traversing the network via an increasing
number of locations.
So, the killer use-case is network troubleshooting (is it the app
or the network?), but this analytics information could also be
monetized by the network operator (think public venue… if they want
to know what sites people are going to…).
by Andrew Lerner | September 26, 2014

3. © Savvius, Inc.
3Confidential
Traditional Network Troubleshooting Challenge
• Network slow issue (increase bandwidth, changing hardware – will not solve
the problem)
• Do not have the flexibility to monitor the entire networks, including network
segments at remote office.
• Network or Application performances problem.
• Use multiple programs to troubleshoot different network issue (WIFI, VOIP,
WIRE)
• Engineers know there’s a problem but don’t know where it is happen (in
which packet? Flow? From where to where?).
• Too much information provided, no filtering feature to narrow down the
problem for easy troubleshooting.
• Traditional troubleshooting tools were very reactive in nature, lacking the
historical visibility required to research past incidents.
WildPackets Overview
PROPRIETARY AND
3

4. © Savvius, Inc.
4Confidential
Network Performance Monitoring
and Diagnostic (NPMD of Gartner)
https://www.gartner.com/doc/reprints?id=1-2Y36R22&ct=160205&st=sb
• SNMP Polling
• Flow-Based Technology
• Packet Based Technology
Overlapping with
• Application Performance Monitoring
• Infrastructure Monitoring
• IT Operation Analytic
• Network Packet Broker

5. © Savvius, Inc.
5Confidential
Basic NMS & flow-based

6. © Savvius, Inc.
6Confidential
Basic NMS Features
• Ability to monitor the traffic load on network- links.
• Most NMS system generates HTML pages (or a client/
server based) containing graphs which provide a LIVE
visual representation of this traffic.
• Most NMS solutions collects, stores, and graphs
customer network health data.
• It does a great job, but it has some performance and
flexibility issues.

7. © Savvius, Inc.
7Confidential
NMS Limitations
• NMS system generates each graph every 5 minutes
based on sampling data, creating a lot of overhead in
customer network.
• Sampled data only – not 100% accurate
• Limited customizable graphing options and require
scripting.
• No deep packet analysis to drill down for further network
analysis.
• NMS solutions function from Layer 1 to Layer 4
• No Expert Analysis for quick troubleshooting.
• Lack of application performance analysis.

8. © Savvius, Inc.
8Confidential
NMS VS Network Analyzer
PROs CONs
NMS &
Netflow
- Monitor traffic utilization,
based on OID.
- Quick monitor top talker / top
protocol.
- Easy to install.
- Polling, Sampling Data only.
- No Deep packet analysis
- Lack of Application Performance
Monitoring
- Limited root cause & Trouble
shooting tool.
- License on number of devices
Network
Analyzer
- Collect all network data.
Passive & No-effect network
- Monitor all protocol &
application in network.
- Able to find root cause &
troubleshooting
- Dashboard & Automatic
analysis
- Automate filter, trigger, alert.
- License on number of devices
-

9. www.wildpackets.com© WildPackets, Inc.
Savvius
Company Overview

10. © Savvius, Inc.
10Confidential
Savvius Corporate Background
Founded
Located
Customers
Products
Awards
1990, by Tim McCreery and Mahboud Zabetian
Walnut Creek, California
Over 7,000 in U.S., EMEA, & APAC
OmniPeek, Omnipliance, Vigil, Insight
Network Computing, Network Magazine,
Internet Telephony, and more …
www.savvius.com

11. © Savvius, Inc.
11Confidential
| © SAVVIUS, INC.11
Savvius Overview
Understanding the root cause of network
performance and reliability issues.
Fast and accurate investigations into security
breaches.
Their need
Our customers
Network professionals responsible for network
performance and reliability.
Security professionals responsible for incident
response.
Capture and run analytics on network traffic;
facilitate visual interaction with the results.
Integrate with security systems to capture months
of appropriate network traffic.
Savvius approach

12. © Savvius, Inc.
12Confidential
| © SAVVIUS, INC.12
Network traffic contains those answers.
Savvius Packet Intelligence produces insight
from analytics.
Savvius products
solve problems...
Customers
need useful
answers, fast.

13. © Savvius, Inc.
13Confidential
Real-World Deployments
Education
Health Care / Retail
Financial
Telecom
Government
Technology
WildPackets Proprietary

14. © Savvius, Inc.
14Confidential
Savvius Solutions
Distributed
Network Analysis
Network
Forensics
Security Incident
Response
Voice over IP,
WLAN Analysis

15. www.wildpackets.com© WildPackets, Inc.
Distributed Network Analysis

16. 24x7 Network monitoring,
analysis, and troubleshooting
Data Center Remote Office
CorporateWireless Users
AP
Controller
AP
Access
Points
WAN
CorporateCampus
Portable
CX
MX
TL
Virtual Servers
CaptureEngine
CorporateWiredUsers

17. © Savvius, Inc.
17Confidential
Omni Distributed Analysis Platform
Omnipliances
Network Capture and Analytics
• High-performance packet capture
• Real-time analysis
• Stream-to-disk for forensics analysis
OmniPeek
Network Analysis Software
• 1/10/40/100 Gigabit, 802.11, and VoIP
• Expert analysis for rapid root-cause analysis
• Aggregate analysis data across multiple
capture points

18. www.wildpackets.com© WildPackets, Inc.
Network Forensics

19. © Savvius, Inc.
19Confidential
Business network
speeds are getting
faster than ever
BYOD is ubiquitous in
every organisation
Network traffic now are
rich in media – voice
over IP and Video
Business Networks are changing

20. © Savvius, Inc.
20Confidential
The Challenge – 5 Questions
1. Who was the Intruder?
2. How did the intruder penetrate
security?
3. What damage has been done?
4. Did the intruder leave anything
behind?
5. Did we capture sufficient
information to effectively
analyze and reproduce the
attack?

21. © Savvius, Inc.
21Confidential
Network Forensics
1. Attack
bypasses
firewall
2. Omnipliance records
and aggregates data
throughout attack
3. Post event analysis reveals
attacker, method, damage!
TL
Network Switch

22. © Savvius, Inc.
22Confidential
Network Performance Forensics
Reducing mean time to
resolution (MTTR) of
network issues through
monitoring and rapid root-
cause forensics.
Network traffic capture
and analytics appliances.
Software to view,
analyze, and investigate.

23. www.wildpackets.com© WildPackets, Inc.
Voice over IP Analysis

24. © Savvius, Inc.
24Confidential
• Voice Quality
• Latency issues
• Effects of Jitter
• Packet Loss
• Sequence Errors
• RTP issues
• Codec quality
• Voice over Wifi issues
VoIP major issues
STRESS

25. © Savvius, Inc.
25Confidential
• OmniPeek is able to measure voice quality in 3 ways:
‒ MOS (Mean Opinion Score),
‒ R-Factor (Rating Factor)
‒ Voice Playbak
• MOS and R-Factor are industry voice quality
standard
• MOS is also used to measure voice call quality and
uses a scale of 1 (bad) to 5 (excellent)
• R-Factor helps you quickly assess the quality of
experience of VoIP on your network and score from
zero to 100. Typical score of 50 (bad) to 90
(excellent)
Measuring Voice Quality

26. © Savvius, Inc.
26Confidential
• Verify voice quality through Call Play Back
Measuring Voice Quality

27. © Savvius, Inc.
27Confidential
OmniPeek of MOS and Rfactor

28. © Savvius, Inc.
28Confidential
Latency

29. © Savvius, Inc.
29Confidential
Jitter

30. © Savvius, Inc.
30Confidential
Packet Loss

31. www.wildpackets.com© WildPackets, Inc.
Our Products

32. 24x7 Network monitoring,
analysis, and troubleshooting
Data Center Remote Office
CorporateWireless Users
AP
Controller
AP
Access
Points
WAN
CorporateCampus
Portable
CX
MX
TL
Virtual Servers
CaptureEngine
CorporateWiredUsers

33. © Savvius, Inc.
33Confidential
OmniPeek
• Distributed analysis manager
– Connect to and configure distributed Omnipliances and software capture
engines
• Comprehensive dashboards present network traffic in real-time
– Vital statistics and graphs display trends on network and application
performance
– Visual peer-map shows conversations and protocols
– Intuitive drill-down for root-cause analysis of performance bottlenecks
• Visual Expert diagnosis speeds problem resolution
– Packet and payload visualizers provide business-centric views
• Automated analytics and problem detection 24/7
– Easily create filters, triggers, scripting, advanced alarms, and alerts

34. © Savvius, Inc.
34Confidential
• The first and only intelligent Software capture engine on the market
• 24 x7 monitoring and analysis of network traffic
• Full packet path visibility through Multi-Segment Analysis, correlating
data from multiple Capture Engines to accelerate troubleshooting
• Expert System providing streams-based network traffic analysis and
correlations between events and conversations
• Sophisticated alarms that alert network engineers to potential issues
before they become major problems
• Application layer expert diagnoses, user satisfaction scores, and
application response time analysis
• Can execute SNMP traps, notifying SNMP monitoring systems of
potential problems.
Capture Engine for OmniPeek

35. © Savvius, Inc.
35Confidential
Powerful
‒ Captures traffic up to 16.5Gbps of real-world traffic (all size packet
distribution)
‒ Scales up to 128 TB of storage
‒ Provides simultaneous real-time analysis and a comprehensive Forensic
Search that rapidly searches through terabytes of captured traffic for the
details relevant to an investigation
Precise
‒ Captures complete network traffic, so you can analyze everything, not just
samples or high-level statistics
‒ Doesn’t drop packets or sacrifice accuracy for speed
‒ Supports rich, detailed analysis, including VoIP and video-over-IP traffic
Your network is bigger and faster. Now your analysis solution is, too.
Omnipliance

36. © Savvius, Inc.
36Confidential
Savvius Network Analysis Recorder Appliances
Price/Performance Solutions for Every Application
Portable Omnipliance CX Omnipliance MX Omnipliance TL
Ruggedized
Troubleshooting
Less Demanding Networks
Remote Offices
Datacenter Workhorse
Easily Expandable
Enterprise, Highly-
Utilized Networks
Aluminum chassis / 17” LCD 1U rack mountable chassis 3U rack mountable chassis 3U rack mountable chassis
32GB RAM 16GB RAM 32GB RAM 64GB RAM
2 PCI-E Slots 2 PCI-E Slots 4 PCI-E Slots 4 PCI-E Slots
2 Built-in Ethernet Ports 2 Built-in Ethernet Ports 2 Built-in Ethernet Ports 2 Built-in Ethernet Ports
8TB Storage 4/8/16TB Storage 16/32TB Storage 32/64TB
Optional Storage: 32/64TB
Up to 128TB total Storage
Adapter 1G and 10G Adapter 1G/10G Adapter 1G/10G Adapter 1G/10G/40G
11.4 Gbps CTD 3.8Gbps CTD 9Gbps CTD 16.5Gbps CTD with
Storage

37. © Savvius, Inc.
37Confidential
Savvius Insight
Edge Packet Capture, Decode and Analysis
• 100Mbps packet capture and real time analysis
• Easily portable mini appliance
• Small networks and Enterprise Edge
• Pre-loaded with Splunk Forwarder and Insight Analytics software
Omnipliance
Network Analysis and Recorder Appliances
• High-performance packet capture and real-time analysis
• Stream-to-disk for forensics analysis
• Integrated OmniAdapter network analysis cards up to 40G
• Dedicated appliances for wired and wireless
Savvius Hardware Platform
Savvius Vigil
Long Term Packet Storage for Forensics Intelligence
• Long term Incident Response
• Correlate Security Events from SIEM/IPS/IDS with relevant packets
• Store relevant packets for months for security investigations
New
Product

38. © Savvius, Inc.
38Confidential
Product Use Traffic Environment Storage
Omnipliance
Packet Capture for
Troubleshooting
Up to 16.5 Gbps
Data centers,
remote offices
4-128TB
Omnipliance
WiFi
WLAN troubleshooting
including 802.11ac
Up to 3.8 Gbps Enterprise WLAN 8TB
Savvius Vigil
Long-term packet storage
for security investigations
IDS
performance up
to 3 Gbps
Cybersecurity
infrastructure
64 or128TB
Savvius Insight
Packet Capture for
Monitoring and
Troubleshooting
Up to 100 Mbps
Remote offices,
network edge
128GB
OmniPeek
Professional
Software for Analytics and
Troubleshooting
Platform
Dependent
Portable Network
Analysis
N/A
OmniPeek
Enterprise
High performance
software for Analytics and
Troubleshooting
Platform
Dependent
Network Analysis N/A
Capture Engine
For OmniPeek
Software for remote
troubleshooting
and analysis
Platform
Dependent
Distributed
Platform
Dependent
USB WiFi Adapter
(11n or 11ac)
WLAN adapter for
portable analysis
200Mbps Portable N/A
Savvius Solutions

39. www.wildpackets.com© WildPackets, Inc.
The New Features

40. © Savvius, Inc.
40Confidential
Application Awareness
• Adds a new dimension to
OmniPeek – a single
product to do it all
• Real-time, layer 7
classification to rapidly
identify mobile, social
network, file sharing, and
web applications
• Application oriented
features are included
throughout
‒ App Dashboard
‒ App Stats view
‒ Compass
‒ Packet view
‒ Expert analysis

41. © Savvius, Inc.
41Confidential
Long-term Reporting Solution
• Provides improved real-time and
historical network analysis
• Enables aggregated data
reporting across multiple
Omnipliances
• Seamless collection and reporting
of network statistics to better
understand long-term operational
trends
• Customized dashboards available
through the Savvius Splunk
Application available on
SplunkBase

42. Corporate Overview
42
Splunk
Support
Savvius Insight comes
pre-configured with
Splunk Forwarder
Savvius for Splunk
dashboards are free
at splunkbase.com
Supports Splunk
Enterprise Free edition
Reporting, trending,
alerts, baselines, maps,
and much more.

43. © Savvius, Inc.
43Confidential
100 Mbit-class mini appliance
For smaller networks and the enterprise edge
Savvius DPI-based network analytics running under Linux
Four-core Atom processor and 128 GB SSD
Splunk Forwarder and OmniPeek Insight included
Bridge ports, management port, three additional, all 1 Gigabit
Affordable price for hardware, analytics engine, OmniPeek Insight

44. © Savvius, Inc.
44Confidential
OmniPeek
Insight
Savvius Insight comes
with OmniPeek Insight
Premier network &
packet analysis software
Support for capture to
disk, remote monitoring,
analytics, app aware
The complete OmniPeek
experience at 100 Mbits.

45. © S A V V I U S , I N C | w w w . s a v v i u s . c o m
Thank You