Making sense of network traffic

In the Star Trek: The Next Generation episodes, Capt. Picard would get a handle on a situation, turn to his Number 1, and say, “make it so.” At that point things would get in gear. Usually Picard was pressed due to poor visibility into alien behaviour.

It’s fun to watch on TV. Not so fun for network administrators.

Visibility can be clouded by poorly thought-out access. The data is then of limited use, even if there is a decent process for dealing with problems. Nothing gets done. Or, sometimes worse, the wrong thing gets done.

“The industry has an unbalanced approach to network management,” says Chris Bihary, director of sales for Network Critical Solutions in Buffalo.

“Millions of dollars are spent on enterprise network tools, various analyzers, sniffers, QoS gear, stuff for VoIP, and then on the security side there is content filtering, intrusion detection, the list goes on. But no-one asks: how will the device get access?”

The challenge isn’t to buy a specific tool, but to get complete network access. When looking at critical tasks, people tend to look at the core (data centre, database, server farms), the perimeter, or the edge.

From Network Critical’s perspective the solution is to take a temporary access port (TAP) and make it permanent. This way the out-of-band device has uninterrupted visibility into network traffic with no competition for access, and no affect on network flow.

However, whether access is from a TAP, appliance at the edge or perimeter, or application on a host server, the next issue is what to do with visibility.

“You have to set service quality definitions to assess things based on performance and behaviour, not just device availability and status,” says Jayanth Angle, research analyst for infrastructure at Info-Tech Research Group. “The engineers should know before the end-users.” Dean Pothorin, chief executive officer of PresiNET Systems in Victoria, sees the merit in appliances because data is not that accessible in logs.

“Networks are dynamic,” says Pothorin. “It’s timely and costly to run a sniffer when you’ve got a problem. An appliance can get to every single user, application, and destination.”

The value in this kind of visibility is that the information can travel from the user, to IT manager, and then to CIO or CEO. At this stage visibility should translate into policy development and enforcement.

But here lies one of the biggest challenges in making the visible actionable: the reporting has to translate into language understood by the network administrator and the CFO.

Loki Jorgenson, chief scientist for Apparent Networks in Vancouver, says part of the problem is that network and application people often don’t talk across the enterprise, and management rarely communicates with service providers.

“It’s a trick to generate a report and make it sensible to all,” Jorgenson says. “There has to be a balance of detail and a summary of information that directly explains the cause of the degradation.”

Apparent Networks’ approach is IP-centric. This is a software-based point-and-shoot technology. The application is generic to all IP networks and can sit virtually anywhere — at the edge, in the core, or parachuted remotely in the field.