Application Visibility in Federal Networks > White Paper

Transcription

1 > White Paper

2 Application Visibility in Federal Networks Identify, classify and prioritize everything running on your network No matter where you serve in government, all federal agencies face the same IT challenges. Each department must provide secure access to critical data and enable inter-agency collaboration through reliable, highquality voice and video applications. You also have to enhance productivity and control rising network infrastructure costs. It s a tall order, so where do you start? To optimize application performance across your distributed network, you first need a clear, in-depth view of your entire infrastructure. Then you need to identify and classify all applications in real time so you can assess traffic patterns, bandwidth consumption and more. For instance, can you tell the difference between mission-critical communication and casual Web surfing? Most importantly, can you prioritize and allocate bandwidth to ensure your critical applications perform optimally while achieving your mission? Blue Coat PacketShaper enables total application visibility, control and monitoring To help you achieve complete network visibility, Blue Coat PacketShaper delivers integrated monitoring, control and compression capabilities in a single appliance. With PacketShaper, you can identify all the applications on the network and monitor response times and utilization at the application level. You can also optimize application performance by using granular quality of service (QoS) controls to regulate traffic and increase WAN capacity through application-specific compression techniques. Designed as a scalable, flexible platform, PacketShaper can be easily configured for additional functionality with a range of software modules or hardware components that enhance each appliance. In this white paper, you ll learn how PacketShaper can help you achieve the complete visibility you need to identify, classify and prioritize all the traffic and users on your entire network. This paper will specifically outline how you can: -> Identify all the applications running on your WAN and determine which consume the most bandwidth. 1 < >

3 -> Know how much of your bandwidth is consumed by recreational traffic. -> Determine if application performance meets your users expectations and service levels. -> Identify the top users of a specific application at each office. -> Ensure remote locations get the bandwidth they need to meet their mission requirements. Traffic Classification Government networks often host many more types of traffic than IT administrators can see. To diagnose and solve performance problems, you first need to identify and categorize all the types of traffic on your network. As soon as PacketShaper is installed, it auto-identifies and organizes each distinct type of traffic and sets a priority for that traffic. It builds a hierarchical traffic-classification tree, inserting an entry for every traffic type it observes. Each traffic category is called a class and all classes together form a traffic tree. While many products can differentiate traffic based on IP address and port numbers, PacketShaper can scrutinize multiple packets, behavioral characteristics, application markers and traffic histories to determine precisely which applications are in use. In fact, traffic classification is one of PacketShaper s key benefits. PacketShaper can classify traffic with a wide range of criteria, including: -> Advanced Layer 7 application signatures -> Application sub-classification including Oracle and PostgreSQL (by database), Citrix (by published application, client name, or priority tag), FTP (by file name or extension), ICMP (by message type such as ping), NNTP (by name or type of newsgroup), DICOM (by healthcare application) and VoIP (by protocol, CODEC or device type) -> HTTP sub-classification by URL, URL wildcard, content type, MIME type, browser type, HTTP tunnel, HTTP 1.1 virtual server -> SSL sub-classification by certificate common name 2 < >

4 -> Layer 4 UDP and TCP ports, port ranges and port lists -> Layer 3 IP addresses, address ranges, subnets, subnet ranges, MAC addresses, host lists, and LANs or physical devices -> QoS markings, including DiffServ, IP-ToS, IP-CoS, IP precedence, MPLS label, MPLS experimental bits -> Frame relay interface, PVC/DLCI, ATM PVC and VLAN Types of Traffic Classification With increasingly complex traffic on your network, you need sophisticated classification techniques that go beyond simple IP address or static port schemes. PacketShaper detects dynamic and migrating port assignments, differentiates applications using the same port and uses Layer 7 indicators to identify specific applications. Web Classification The majority of your network traffic can come from the Web and consist of both recreational browsing and legitimate government business. Therefore, how you prioritize all this traffic depends on urgency, time of day, type of application, bandwidth requirements, user and other criteria. PacketShaper differentiates between various types of traffic so you can manage each with an appropriate response. You can sub-divide HTTP traffic (using mime type, URLs, browser type and more), detect non-http traffic using port 80, spot non-http traffic within an HTTP tunnel, and more. You can also separate critical HTTP XML from recreational HTTP MPEGs to prevent an employee s hobbies from interfering with important missioncritical communications. Occasionally, in an attempt to bypass security controls, Web traffic disguises itself by running over an HTTP tunnel (using http-tunnel or socks2http protocols) and disrupts performance of critical HTTP applications. The PacketShaper spots and separates this tunnel traffic so you can manage it appropriately. 3 < >

5 Citrix and Oracle Classification PacketShaper can automatically isolate each published application running within a Citrix environment. For example, it can distinguish Microsoft Word from Oracle, and it can separate interactive Oracle traffic from its print traffic. In cases where Citrix features (e.g., encryption) obscure PacketShaper s ability to sub-classify Citrix, PacketShaper can still protect each individual user to ensure productive Citrix sessions. In addition, PacketShaper differentiates many types of Oracle traffic, allowing you to tailor your analysis or management strategies. For instance, you can separate Oracle traffic accessing a specific database from Oracle traffic accessing another database. PacketShaper also identifies backend database traffic consisting of Oracle8i/9i/10g and netv2 protocols using a multi-threaded server as well as the older Oracle 7 (or before) and netv1 protocols using a dedicated server. Furthermore, PacketShaper identifies Oracle s Java-based, front-end client traffic, as well as Oracle over SSL and Oracle s Enterprise Manager traffic. Intricate Port Classification When multiple applications use the same port, it can be difficult to manage because they appear as one application. PacketShaper, however, can distinguish between different applications on the same port, such as TN3270, TN5250 and other Telnet sessions that all use port 23. By contrast, an application that hops from port to port can be a challenge to identify because it looks like multiple applications. But PacketShaper can easily identify and track individual applications that frequently hop ports or applications such as FTP or VoIP that use dynamic ports. File-Sharing Protocols Although specific peer-to-peer (P2P) applications come and go with political and legal battles, there are now whole groups of P2P applications that facilitate file sharing. These applications voraciously consume bandwidth, so you absolutely must maintain control over who and what uses your network to guarantee performance of mission-critical applications. PacketShaper automatically identifies a large number of these file-sharing applications, enabling you to analyze or control their behavior. PacketShaper can also help you identify P2P applications hiding inside an HTTP tunnel, as well as traffic that uses encryption to disguise itself and avoid detection. 4 < >

6 Multiple Locations When federal agencies choose a main-site deployment, the ability to distinguish traffic to and from each remote site becomes crucial. PacketShaper can classify traffic according to subnet, IP address, address ranges and host lists, which can all work to discern traffic from different offices. PacketShaper can then automatically discover all applications used by each location. Even if there s a classified application, PacketShaper might not know what type of traffic it is, but it can still classify and prioritize each packet by signature. By separating these applications (or not, your choice) from those discovered at other locations, PacketShaper enables you to apply different management strategies for the same application at different sites. Classification in Heterogeneous Networks PacketShaper can identify and track hosts by DNS name, even if Dynamic Host Configuration Protocol (DHCP) changes the host s IP address frequently. You can use the Lightweight Directory Access Protocol (LDAP) host lists to isolate any traffic associated with any host on the list. PacketShaper can also classify traffic based on IP COS/TOS bits, Diffserv settings, and MPLS labels, allowing traffic types to have uniform end-to-end treatment by multi-vendor devices in heterogeneous WANs. Hierarchical Classification More granular and targeted classification leads to more insightful analysis and more precise control of performance. PacketShaper s hierarchical classification and traffic tree structure help pinpoint precisely the traffic you need to manage. Many nested levels enable you to split one type of traffic into different categories so that you can treat them differently or run separate reports on each network segment. For example, you can separate Microsoft Exchange traffic into its components. Or, instead of lumping all VoIP traffic together, you can divide it by function or CODECs. Common Classification Approaches Network administrators often categorize their traffic based on applications, source or destination locations, or a combination of both. Your choice depends on where you install PacketShaper and how you want to manage traffic. 5 < >

7 Application-based Traffic Tree An application-based traffic tree distinguishes traffic based on application (such as SAP) or application-related criteria (such as a URL or particular database) and builds a traffic tree of application-based classes. This configuration is most common at distributed branches where the focus is on the site s own applications, rather than on dividing traffic for multiple locations. Location-based Traffic Tree A location-based traffic tree separates traffic according to location or user group, based on subnets, host lists or IP addresses. Then, optionally, it can expand each location to list its applications. This configuration is most common at main sites to manage traffic with distinct strategies for several branches or for several divisions. PacketShaper Reporting PacketShaper enables you to generate network and application reports that help you: -> Investigate and diagnose problems and evaluate service levels -> Monitor historical performance trends -> Notify administrators of critical performance factors -> Check on a configuration change or justify an equipment purchase -> Communicate network and application conditions to users PacketShaper measures hundreds of characteristics about your network traffic, creating an extensive collection of measurement data. These metrics form the basis of PacketShaper s reports. PacketShaper offers a variety of built-in reports, which are all accessible from a Web browser. And, because PacketShaper centralizes all reporting functions, you can compare, correlate and summarize behavior between appliances and by location. PacketShaper also stores measurement data on appliances for up to two months and for months or years if using IntelligenceCenter for central reporting. PacketShaper s metrics can also be incorporated into SNMP 6 < >

8 management platforms, NetFlow v5 collectors and third-party reporting tools, such as Concorde, InfoVista and Microsoft Excel. Reports include details on: -> Performance: How long application traffic spends in different portions of the network -> Utilization: Bandwidth usage by applications, locations and users -> Diagnosis: Information that helps to analyze or pinpoint a problem Response-time Measurement Response-time measurement (RTM) quantifies what has traditionally been subjective, anecdotal information about slow applications. It s not enough to measure availability and bandwidth usage because these figures don t reflect the user s perception of performance. RTM measures the actual user experience with a mechanism to compare actual and anticipated performance. PacketShaper s RTM features offer techniques to measure performance, troubleshoot sluggish response, set service-level goals and assess compliance. With RTM, you can: -> Track delay statistics for flexible traffic categories -> Measure response times for individual applications, hosts, subnets and any transaction-oriented TCP traffic class -> Break down each response-time measurement into network delay (time spent in transit) and server delay (time the server used to process the request) -> Identify users and servers with the slowest performance -> Set acceptability standards and track whether performance adheres to them -> Set the speed that divides good responses from bad (500 ms, for example), and set the percentage of transactions that should meet designated performance goals (95 percent, for example) -> View current and historical performance data in intuitive tables and graphs, in a management information base via an XML API or as raw data -> Integrate SNMP management tools and third-party reporting tools -> Quantify and validate performance to justify new equipment expenditures 7 < >

9 Measuring Response Times By monitoring all the traffic that passes through your network, PacketShaper provides a unique opportunity to accurately measure response times at a very low cost. Because PacketShaper already sees every packet, it can easily calculate the time traffic moves between a client and a server, the time used by the server and the time spent on either side of the PacketShaper. PacketShaper then notes response times as traffic passes. This simple approach provides rich data without network impact or overhead. PacketShaper s Response-time Advantages PacketShaper measures performance anywhere on the network, as long as it sees the traffic it is measuring. It can sit on the client side or on the server side of the topology. If the Internet separates the client and server, it does not matter on which side the PacketShaper is deployed. PacketShaper offers other considerable advantages when measuring response times, including: -> No application modifications -> No need for additional API calls or software wrappers around measured applications -> No desktop or server changes, or location restrictions -> No additional software loaded on client desktops or any server -> No artificial traffic overhead, router reconfiguration or topology changes needed PacketShaper does not create extraneous application requests merely to time their responses and does not issue pings. It can issue synthetic requests, if required, but calculates all response-time metrics without needing to generate artificial traffic. Bandwidth Utilization Reports Bandwidth is an expensive resource and prone to congestion. To help you manage your links effectively and conserve bandwidth, PacketShaper helps you assign a certain amount of bandwidth per link and prioritize applications, protocols and services. You can also see if critical applications have sufficient bandwidth access, or if the wrong applications have too much access. For example, do file transfers and print traffic monopolize your bandwidth while SAP and Oracle starve? 8 < >

10 PacketShaper also helps you determine if you are getting all the bandwidth you require. Could you support your critical applications with half or twothirds of the bandwidth you currently have, or if your applications were more effectively managed? PacketShaper can help you definitively answer those questions. Evaluating the Usage Tops PacketShaper offers a variety of mechanisms, including lists, tables, pie charts, line graphs, bar charts and voluminous raw data to track top consumers of bandwidth. Using this information, you can identify which applications, users, locations, and Web sites consume the most bandwidth. The Top 10 Classes graph provides a more detailed view. With the granular level of detail these charts provide, you can achieve valuable insight into application and network behavior. For example, you can: -> Examine the chattiest host IP pairs for traffic from a specific application, location or combination of the two -> Split the traffic from one remote location into its different application, service, or DSCP types, even if you didn t sub-classify traffic into its services as it passed -> List the busiest ports, the ports a specific application or host used, and spot potential port-scans -> Expose the top current or historical traffic contributors or recipients for a location or application 9 < >

11 PacketShaper puts these more detailed, per-flow metrics into flow detail records using the industry-standard NetFlow format. PacketShaper appliances serve as NetFlow emitters, automatically pushing data to remote systems, called collectors. The collectors interpret and incorporate the data into meaningful reports and other useful tools. Another feature, called host accounting, tracks historical usage levels for each IP address and offers statistics sums for each user, host list or subnet. If you export this data into a tool such as Microsoft Excel, you can sort the results, yielding top users or a fully ranked list of users from top to bottom. Using these features, you could, for example, retrieve usage figures for each department in an agency. Synthetic Transactions PacketShaper can also, at your discretion, initiate Web or other TCP communications at periodic intervals to verify the availability of critical hosts. This activity is similar to scheduled pings or SNMP polls, but includes these important capabilities: -> Detailed analyses of host behavior and response times apply to synthetic requests, enabling you to profile network and behavior over time. This information is much more helpful than knowing if a device simply responds to pings or not. -> Synthetic requests can determine if a service or application is running, not just if a server is responding. As a result, you get a more sophisticated assessment of availability. -> Distributed PacketShaper appliances can serve as local clearinghouses for availability information, forwarding situations of interest or concern to central locations via , SNMP traps or syslog messages, thus eliminating the need for long-distance polling by central management platforms. Sharing Reports: The End User Portal Sometimes network and application managers want to share PacketShaper reports with their own users. But they can t compromise security and privacy by giving everyone access to their PacketShaper data. In addition, they want to continually publish up-to-date reports in an accessible place and format. Using the portal feature, you can offer your end-users or subscribers customized Web pages with network and application status 10 < >

12 reports. Information such as TCP efficiency, application peak and average bandwidth rates, response times and other reports can be presented through customizable HTML templates. By delivering these detailed reports to end users and subscribers, you enable them to check their own status and reduce the volume of help-desk calls. Adaptive Response PacketShaper s adaptive response feature automatically monitors the network for particular conditions or performance factors, detects potential problems, notifies administrators if a problem is detected, and can take corrective actions that you prescribe. You decide what constitutes a problem, whether you want to be notified, conditions that warrant corrective actions and which actions are appropriate. PacketShaper offers many preconfigured conditions or you can define your own. Examples include: -> Send an SNMP alert to a central management system when retransmissions rise to occupy 15 percent of your network. -> Dedicate more bandwidth to SAP or boost SAP s MPLS service class whenever 10 percent or more of its transactions fail to respond within two seconds. -> Send yourself an whenever a new application appears on the network that claims more than eight percent of capacity. -> Temporarily or permanently contain and quarantine greedy users who consume an unfair portion of bandwidth. Monitor Conditions and Respond Automatically When PacketShaper monitors a situation of interest, an agent checks the condition and scrutinizes its status. Several groups of predefined agents include categories for the health of the network, applications and the appliance itself. Each adaptive response agent belongs to one of the following categories: -> Unit health agents monitor capacity and load on a PacketShaper. -> Network health agents monitor traffic efficiency and how much of a bandwidth partition is utilized. 11 < >

13 -> Application health agents monitor new network traffic and traffic that is classified into /default. -> Host agents detect hosts that use a disproportionate share of the link. -> Custom agents monitor the value of any PacketShaper metric to detect a variety of conditions for traffic classes, links and partitions. Because acceptable behavior on one network or unit might be considered unacceptable on another, you can customize each agent to reflect your own preferences. By tailoring an agent s definition, you can monitor precisely the condition you have in mind and respond in the way you prefer. Items you can specify include: -> Condition or metric to monitor Example: Check for individual hosts using unreasonable amounts of bandwidth -> Threshold that indicates a problem Example: Specify 12 percent as the percentage of capacity one host must use to be considered unreasonable -> Threshold that indicates a return to normalcy Example: Specify five percent as the maximum percentage of capacity each host can use and still be considered reasonable -> Frequency to check the metric or condition Example: Check host usage every two minutes -> Determine if notification is needed, and, if so, which method ( , a Syslog server message or an SNMP trap) Example: Yes, notification is needed. Send an to IT that explains the problem and includes the offending host s IP address -> Determine if automatic corrective actions are needed, and, if so, which actions Example: Yes, corrective actions are needed. Enter the offending IP address in a host list, and limit the bandwidth to these hosts. 12 < >

14 Results at a Glance Once you have configured automatic monitoring and response, PacketShaper provides an easy way to see the status and results at a glance. Adaptive response provides a color-coded summary to spot potential problems quickly. Five colored status indicators show the status of the five categories of agents. Green, yellow or red indicators reflect optimal, marginal or unacceptable levels of performance. When the mouse hovers over any colored indicator, a drilldown status display appears listing the status of each agent in the group with links to additional information. Blue Coat PacketShaper: Optimizing application performance with greater network visibility PacketShaper s visibility features help you optimize application performance across your federal network. Rather than simply collect data, PacketShaper s monitoring capabilities help you organize findings, synthesize conclusions and flag problems early to help manage your network more effectively. With PacketShaper, you can see all the applications on the network, what portion of network bandwidth they consume, how well they perform and where delays originate. As a result, PacketShaper enables you to: -> Automatically detect and classify hundreds of critical and recreational applications -> Identify top applications, users, servers, remote sites and Web destinations -> Analyze bandwidth usage, response times, the impact of configuration changes and sources of delay -> Track response times and break them into time spent on the network and server -> Set standards for service levels and track their compliance -> Monitor conditions of interest, and when thresholds are exceeded, automatically take action to correct, document and notify someone of the problem -> Measure, graph and export more than 100 metrics describing usage, availability, efficiency, response times, errors and diagnostics 13 < >

15 About Blue Coat Blue Coat is the technology leader in Application Delivery Networking (ADN). The ADN infrastructure provides the visibility, acceleration and security capabilities required to optimize and secure the flow of information to any user, on any network, anywhere. This application intelligence enables government agencies to tightly align network investments with mission requirements, speed decision-making and secure critical applications for long-term competitive advantage. To learn more, please visit us at 14 < >

16 Blue Coat Systems, Inc BCOAT Direct Fax Copyright 2010 Blue Coat Systems, Inc. All rights reserved worldwide. No part of this document may be reproduced by any means nor translated to any electronic medium without the written consent of Blue Coat Systems, Inc. Specifications are subject to change without notice. Information contained in this document is believed to be accurate and reliable, however, Blue Coat Systems, Inc. assumes no responsibility for its use. Blue Coat, ProxySG, PacketShaper, IntelligenceCenter and BlueTouch are registered trademarks of Blue Coat Systems, Inc. in the U.S. and worldwide. All other trademarks mentioned in this document are the property of their respective owners. v.wp_fedappvisibilitymon-v2-0110