Market Update Intelligent Network Packet Brokers

Transcription

1 Market Update Report Intelligent Network Packet Brokers Explaining a New Network Infrastructure Category By Bob Laliberte, Senior Analyst July , The Enterprise Strategy Group, Inc. All Rights Reserved.

2 Market Report: Intelligent Network Packet Brokers 2 Contents Managing Networks at Scale is Becoming More Difficult... 3 Need to Take a Different Approach... 4 Market Applicability... 6 Buying Considerations... 8 Compelling Economics and Agility... 9 The Bigger Truth... 10

3 Market Report: Intelligent Network Packet Brokers 3 Managing Networks at Scale is Becoming More Difficult Enterprise organizations are dealing with several IT trends that have a dramatic impact on the character and volume of network traffic. On the infrastructure side, enterprise organizations are consolidating data centers, with those new, consolidated data centers required to service multi-tenant environments for different business units. This results in larger and more complex data center environments. At the same time, organizations continue to increase their use of server virtualization technologies, driving up the ratio of virtual machines (VMs) to physical hosts and subsequently the demand for increased bandwidth, resulting in many organizations upgrading to 10Gb networks. At the same time, applications are growing more sophisticated, leveraging richer content, utilizing service-oriented architectures, and becoming mobile device-accessible. This places additional strain on the organization to provide more granular security, accommodate bursty communications protocols, and react quickly to a highly dynamic environment. Large organizations are attempting to address this evolving set of performance, security, and operational requirements but it is becoming difficult for existing network monitoring and security tools to keep up with these trends and provide adequate coverage. Figure 1 illustrates the treadmill that many enterprise organizations face. Figure 1. Existing Network Tools Scenario Source: Enterprise Strategy Group, In the scenario illustrated in Figure 1, organizations connected security and monitoring tools directly to SPAN/mirror ports and external taps, but this approach is beginning to reach its limits of scalability, as the number of SPAN ports is limited and simply adding more security and monitoring tools to provide coverage over a rapidly expanding network is costly and only serves to increase the complexity. Plus the tools themselves are rapidly

4 Market Report: Intelligent Network Packet Brokers 4 running out of capacity due to increased traffic volumes and the need to process unnecessary packets. A better approach is needed with more intelligence that provides the ability to aggregate or broker actionable network traffic destined for monitoring or security tools. To that end, a number of enterprise organizations are beginning to adopt a particular approach to address these issues. Need to Take a Different Approach The technology, while proven in large scale service providers, is still in need of a commonly accepted industry category. It has gone by several monikers matrix switch, network monitoring switch, network intelligence optimization fabric, and intelligent management aggregation networking (iman) and most recently network packet broker (NPB). In previous ESG publications, we have used iman but Google searches for that term have a tendency to turn up pictures of the Somali fashion model, actress, and businesswoman (and wife of David Bowie) of that same name. Appealing as that may be, it contributes little to an understanding of the effective management of a network. Whatever it ends up being consistently called (in this report, we ve opted for intelligent network packet brokers or INPB), the technology addresses the aforementioned problems by providing an overlay management network. The technology connects network monitoring and security tools to the underlying network, usually via SPAN/mirror ports or network taps, but it can also be placed in-band (typically for security applications). This technology captures network behavior, provides packet processing services (e.g., filtering/grooming/packet fragment reassembly and de-duplication) for tools, and distributes actionable data to monitoring and security tools such as application performance management (APM), network performance management (NPM), intrusion detection/prevention (IDS/IPS), and advanced malware protection systems. As data centers and networks continue to scale, it will be increasingly critical for organizations to have a complete view of their network environments. Intelligent Network Packet Brokers enable organizations to leverage existing network monitoring and security tools to manage larger and more complex environments more effectively and efficiently (See Figure 2).

5 Market Report: Intelligent Network Packet Brokers 5 Figure 2. Technology to Improve Management Source: Enterprise Strategy Group, ESG believes that regardless of what it is called, intelligent is an important modifier to include in its designation. The intelligent network packet broker (INPB) does not merely shuttle packets from here to there. Rather it provides a layer of intelligence much in the same way an application delivery controller provides more than mere load balancing for web servers. The INPB extracts only the necessary information e.g., stripping out unwanted packets or providing time and port stamps for forensic work accelerating network and security intelligence to facilitate smart decisions on the part of the network, security, and monitoring tools. These systems when deployed strategically across the network, also allow for a much more accurate attribution when performing incident analysis and response activities, particularly in environments where analyzing big data is either the norm or the strategic direction going forward. Software Defined Networking or SDN also holds some promise in enabling this technology but it is still very new. Essentially, in an SDN-enabled network, services could be centralized leveraging network APIs or a centralized controller that has access to all the network devices. So an INPB technology could be used to connect via APIs or into a controller and collect all the requisite information to send to management tools. As mentioned previously, this is a future technology, however, worth watching to see whether it develops as promised. The reality today is that organizations need solutions to help them regain visibility and control now.

6 Market Applicability Market Report: Intelligent Network Packet Brokers 6 There are a number of tools that organizations are interested in using to better monitor their networks. Previously conducted ESG research 1 revealed that the tools most commonly used by organizations are performance and security monitoring devices (see Figure 3). Figure 3. Use of Network Monitoring or Security Tools Is your organization using any of the following types of network monitoring and/or security tools that require access to the network? (Percent of respondents, N=160) Currently use Do not use, but we plan to do so Do not use, but we are interested in doing so Do not use, and we have no plans or interest in doing so Don't know Network performance monitoring 86% 9% 4% 1% IPS/IDS (intrusion prevention software/intrusion detection software) 69% 16% 14% 1% Application performance 61% 25% 13% 1% Packet capture/network 58% 22% 16% 4% 1% Other types of tools 38% 12% 16% 9% 25% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% Source: Enterprise Strategy Group, Until now, this space has largely been the domain of service providers. However, given the speed and scope of the aforementioned trends, the technology is rapidly expanding into the enterprise as data centers take on a decidedly more service or cloud provider feel to them. ESG expects that INPBs will become far more important in the near future. Indeed, recent ESG research 2 indicates that enterprise data centers are experiencing dramatic changes in traffic volume and complexity, which make it increasingly difficult to effectively use traditional traffic management and monitoring techniques. Those changes include: Data center consolidation. Some 63% of organizations with more than 1,000 employees are actively engaged in or have recently completed data center consolidation, typically reducing the number of data centers by 25% to 50%. And 48% of organizations have implemented multi-tenant facilities to support independent business units, resulting in IT environments that begin to resemble those of service providers. Server virtualization technologies. Virtualization technologies are being almost universally adopted, with deployment of virtual machines (VM) expected to double over the next few years and typical VM densities to increase from 5-10 per physical server to more than 25 VMs per physical server over the next two years. 1 Source: ESG Research Survey, Intelligent Management Aggregation Networks, December Source: ESG Research Report, Data Center Networking Trends, January 2012.

7 Market Report: Intelligent Network Packet Brokers 7 Web application deployment. SOA or web-based applications have been adopted extensively by 24% of large organizations and somewhat by another 60%. Based on multiple x86 server tiers and horizontal scaling, these applications add significantly to server deployment and VM mobility. Geographical distribution. In addition, approximately 40% of organizations are implementing applications over geographically distributed data centers. In ESG s view, this trend presages the need for cloud computing with workloads nimbly utilizing the different data center capacities as performance needs dictate. BYOD/BYO3. IT consumerization and increasing mobility are also affecting campus networks, which are growing in use and complexity as a result of Bring Your Own Device (BYOD) trends or, more accurately, Bring Your Own Three Devices (BYO3) the three referring to smartphones, tablet computers, and laptops. Here the challenge is ensuring the scaling of wireless networks. This increase in the number of mobile devices and associated applications creates additional traffic and complexity to challenge the network operations personnel and network management applications. At some point, existing tools and techniques can no longer cope with business requirements, leading to a condition that ESG terms network discontinuity. At this point, organizations are forced to hire more staff to accommodate the increasingly complex environment and manual collection and correlation tasks that result from deploying a number of different tools. This is just a band-aid, however, not a permanent solution. Most large organizations surveyed by ESG reported that they regularly monitor a large number of hosts, networking devices, applications, and network services (see Figure 4). In fact, nearly half (47%) monitor more than 500 such entities and 11% even monitor in excess of 5,000. This trend also presents organizations with massive storage requirements as all data from the collection points can easily result in hundreds of GBs of management data per week. Large organizations are deploying additional tools and consuming larger numbers of SPAN/mirror ports, leading to problems with performance e.g., dropped packets or the inability of the tools to keep up with throughput or just causing the administrator to run out of available ports. In addition, the time required to provision the additional ports can lead to unacceptable downtime. All of these issues limit visibility into the network. Figure 4. Number of Monitoring Points Approximately how many hosts, networking devices, applications, and network services does your organization monitor regularly (i.e., for network health, performance or security reasons)? (Percent of respondents, N=160) Between 1,001 and 2,500, 9% Greater than 5,000, 11% Between 2,501 and 5,000, 13% Less than 25, 2% Between 26 and 50, 5% Between 51 and 100, 12% Between 101 and 250, 18% Between 501 and 1,000, 14% Between 251 and 500, 18% Source: Enterprise Strategy Group, 2012.

8 Buying Considerations Market Report: Intelligent Network Packet Brokers 8 Vendors providing INPB solutions include Anue (now Ixia), APCON, Gigamon, NetOptics, Netscout (Simena) and VSS Monitoring, and it is probable that more will appear as this market continues to gain acceptance. As the market segment grows, users should address the following issues when considering their purchase options: Full Featured Product: Most vendors offer a range of solutions based on need and environment. In general, it makes sense to look for full featured products with: o o Multiple Ethernet interface speeds (1Gb, 10Gb, expandable to address 40 or 100Gb). o Support for a wide range of analysis tools, including but not limited to: network performance monitoring, application performance management, out-of-band and inline security, and application acceleration. o Forensic capabilities, including time and port stamping. o Load balancing, i.e., the ability to distribute traffic effectively among network monitoring and/or security tools. o Intelligent tool offloading, i.e., the ability to offload many of the core packet processing tasks required, and often performed, by monitoring and security tools (e.g., packet filtering, grooming, fragment reassembly, and deduplication) o In-band or out-of-band access, as required: In-band security puts the security application directly in the flow of traffic. It tends to support a richer set of security features than out-of-band, provides direct visibility into the network traffic, and is relatively easy to install without any significant network reconfiguration. Its disadvantages include required network outages upon installation, potential for traffic delays or disruption in the case of equipment malfunction. Look for inband solutions with bypass technologies, flow-based load-balancing for asymmetric routing and health check capabilities. Out-of-band security places the application outside the flow of traffic, e.g., through a SPAN/mirror port attachment. It is less disruptive to network traffic than in-band and can scale more easily. However, it comes with the downside of some potential delay between detection and correction of a problem (during which the offending traffic continues to flow) and the need for some degree of network reconfiguration upon installation. Seamless Scalability: The product offering should be capable of graceful upgrades and capacity expansion as needs evolve, offering a scalable product architecture that adapts to increases in traffic volume and complexity, and avoids network discontinuity problems. Credibility: References, proof of concept, and other indications of vendor and product maturity should be readily available. Overall Integration: The intelligent network packet broker should be viewed in the context of overall network monitoring and security operations. Whatever product is purchased, it should dovetail with existing operational scenarios. Existing applications or operational procedures should not have to change significantly. Purchasing Model: Given that much of the network scale and growth is driven by the creation of private clouds capable of rapid growth (or contraction), organizations may want to investigate the ability to consume this technology on a pay as you grow model. This may make sense if you are evolving your network from 1GbE to 10 or 40GbE solutions.

9 Market Report: Intelligent Network Packet Brokers 9 Compelling Economics and Agility Network operations teams are typically cost constrained and looking to make more effective use of people, space, and equipment. INPBs have the ability to help them reduce the number of monitoring tools and probes needed, centralize monitoring and management, economize on the use of SPAN/mirror ports, extend the lifecylce of existing tools, and make more effective use of operations personnel. More specifically: INPBs can reduce the number of monitoring tools and probes by connecting to a network location once, but distributing that data to multiple monitoring tools. Because SPAN/mirror ports are limited, organizations need to make the best use of them. INPBs eliminate the need to have to decide what monitoring tool needs to be connected to what device. Intelligently filtering and grooming the data collected from each network location can dramatically reduce the amount of data ingested by the monitoring and security tools, resulting in fewer tools being required. This is especially true in 10Gb network environments where 1Gb monitoring/security tools are deployed. Operations staff can more efficiently manage their environment as there are fewer monitoring screens to view and less manual correlation that needs to be done. Troubleshooting and resolution of problems is accelerated. By having greater visibility into an end-to-end network environment and processing only the required and more granular information coupled with more detailed forensic capabilities like time and port stamping, organizations are able to find and fix smaller problems more proactively, thus dramatically reducing the number of service impacting events. New devices can be easily added. Simply plug in the SPAN/Mirror port to the INPB, adjust the INPB configuration, and begin monitoring the network segment across all relevant monitoring/security tools.

10 The Bigger Truth Market Report: Intelligent Network Packet Brokers 10 Trends toward increasing data center consolidation, VM-to-physical server ratios, web application deployment, networking of mobile devices, use of network monitoring tools, and SPAN/mirror port availability all point to a growing need for intelligent network packet brokers to process, consolidate, and filter monitored traffic and provide increased visibility into the network. Large enterprises and service providers are in the forefront of these trends and many have already deployed INPBs or are planning to do so in the near future. The market drivers described in this report demonstrate the need for INPBs through the network visibility process flow illustrated in Figure 5. Figure 5. Network Visibility Process Flow IT trends drive scale and complexity Network discontinuity impacts network operations Enterprises deploy more network management and security tools Network management and security tools need network visibility Visibility requirements lead to greater use of SPAN/mirror ports and taps Greater use of SPAN/mirror ports and taps leads to scaling/visibility issues INPB address scaling/visibilty issues with SPAN ports and taps and enable increase management tool capacity Source: Enterprise Strategy Group, Organizations looking to purchase INPBs need to evaluate them in terms of the available features i.e., support for existing network monitoring/security tools, the desired type of security data flow, appropriate interface speeds as well as speed and media conversion support and necessary filtering, forwarding, and load balancing capabilities the ability to upgrade and scale as load and complexity increases, the credibility of the vendor and product, and the ability to fit seamlessly (or nearly so) into existing operations. It is ESG s belief that the INPB market will continue to grow into a best practices adoption in large scale data centers and networks. As more organizations consolidate data centers and build out increasingly larger and more complex environments, the existing players, including Anue, APCON, Gigamon, NetOptics, and VSS Monitoring, will experience considerable opportunity for growth. Earlier this year, ESG predicted consolidation in this market and to date the industry has witnessed the acquisition of Anue, Simena and VSS Monitoring by Ixia, NetScout and Danaher respectively. We expect that this market will continue to be hot as larger companies look to capitalize on opportunities in this space.

11 20 Asylum Street Milford, MA Tel: Fax: