Packet Design Combines Traffic Flow with Route Analytics to Offer a Foundation for Next-Generation Traffic Management

Packet Design Combines Traffic Flow with Route Analytics to Offer a Foundation for Next-Generation Traffic Management A White Paper Prepared for Packet Design, Inc. January 2006

Table of Contents Executive Summary...1 Market Trends...1 Packet Design s Route Analytics...2 Traffic Explorer s New Traffic Management Capabilities...3 Next Generation Traffic Management...4 The Traffic Explorer Architecture...5 EMA s Perspective...5 About Packet Design...6

Executive Summary As the enterprise management software market continues to evolve and mature, one of the most strategic changes in commercially available products has been the focus on optimizing an organization s Quality of Service (QoS) delivery. But, rather than continuing to monitor and optimize the underlying IT infrastructure on a siloed or component-by-component basis, efficiently addressing QoS objectives today requires a true end-to-end, cohesive monitoring capability. This is because more and more IT services and applications are becoming networked via IP technology, and increasingly sophisticated n-tier architectures are emerging to deliver the growing number and variety of services to an ever-expanding internal and external community of end users. To support QoS objectives cost-effectively, a next generation state of network management is coming. It is based on extending to new levels the basic functions of information gathering and proactive management. As they evolve, next-generation tools will make visible, in real-time, the precise data paths used by each service or application as well as the flow (traffic volume) of data over those paths. Secondly, the tools will be able to detect problems instantly so corrective actions targeted at optimization can be taken more efficiently. Next generation management tools will also perform what if and ifthen modeling to optimize network design and avoid future problems that can undermine QoS. The focus on traffic flow and route analytics lies at the heart of this next generation, because this is where problems can be traced to their true origin. For example, all system and network resources can be operating in the desired state, yet key business applications and networked services can be seriously underperforming. Each system and network component in an application ecosystem may seem to be functioning well, but mis-configurations of traffic paths, unstable routing or other logical errors not caught by the network management software can cause significant performance degradation. This can lead to significant issues not only in terms of network performance, but the performance of business applications dependent on the network. At the core of this strategic change is an inside-out approach to application and service management, which works equally well from both the enterprise and Service Provider (SP) perspectives. Rather than managing the enterprise network from a topologically siloed or linkby-link view, next generation capabilities help ensure optimum levels of application and service delivery by providing the ability to see actual traffic as it moves in real-time over the enterprise network. This combined knowledge of data paths and traffic flow also makes it possible to make IT resource adjustments instantly to avoid infrastructure problems, whatever and wherever they may be. In this white paper, Enterprise Management Associates (EMA) looks at the recently introduced Traffic ExplorerTM product from Packet Design, Inc., as an example of this inside-out approach. Traffic Explorer is the first IP network management system designed to integrate real-time routing information across a broad base of protocols with traffic-flow data, providing an end-to-end topology-aware view of network traffic. The software provides real-time and historical insights into actual service paths while capturing some of the traffic flows in the network. It then extends or projects those flows across all links affected using gained knowledge of how the network is routing each IP flow. This creates the potential to deliver significant improvements in monitoring, troubleshooting, planning and optimization of services and applications. It is particularly appealing for converged networks operated by both enterprise IT and SP, as well as for environments where applications must reach a broad and geographically dispersed set of users, customers and/or partners. After discussing relevant market trends in managed IT and SP services, this report examines the design concept and capabilities of Traffic Explorer in the context of EMA s specific next-generation requirements. EMA then provides an assessment of Packet Design s strengths, challenges and opportunities in its attempt to establish a significant market presence with its new offering. Market Trends The management software industry has grown extremely complex over its roughly 25-year existence. In the beginning, the task was to allow data center staff to manage mainframe resources beyond what proprietary core operating systems could provide. As distributed computing became commonplace by the mid-1980s, network monitoring and management capabilities joined existing sys-

tem management tools to provide IT managers, and now line of business users, an infrastructure-wide view of what had become a largely heterogeneous, multi-vendor computing environment. As a result, IT organizations began moving from a component-centric management to a more holistic model to gain a better understanding of how well the overall network was operating. More recently, the emphasis on business process optimization and application management has shifted the focus of both enterprise IT and the service provider community to examine new processes and tool sets to enable better collaboration within IT and better alignment between IT and the business it supports. The evolutionary pressures continue with the relentless move towards convergence of voice, data and multimedia around IP technology, Services-Oriented Architecture (SOA) and wide-scale deployment of web services. With the emergence of IP-based networks as the communications infrastructure of choice, information is now provided and delivered essentially as a suite of managed packet-based services, with a focus on application performance and availability. Given this environment, IT departments and SPs are gravely mistaken if they don t pay close, rigorous attention to monitoring and maintaining the optimum behavior of the underlying infrastructure the IP routes and traffic flows that make up the very blood stream of the business. These developments further create the need for nextgeneration capabilities tied to monitoring and managing traffic flow integrated with route analytics. EMA s research has shown that most IT organizations remain straddled with far too many tool sets with averages of as many as 50 separate brands, let alone products, in a single IT environment. In one recent instance, an EMA client audit unearthed 250 brands within a single IT organization, and the company, though global, was only a mid-tier enterprise in size. This perpetuates the siloed component-centric model, creating a fractured view of the computing environment. Innovation in the area of application flow management promises to help provide more complete visibility into application-to-infrastructure problems that can allow IT organizations to consolidate and simplify their management portfolios, while at the same time building more collaborative processes across IT silos. Within the area of flow-based management solutions, Packet Design is unique in combining route analytics with traffic management, and in so doing is embracing many of the tenets in EMA s next-generation approach by offering clear and distinctive advantages in knitting together separate management tasks into more integrated and efficient processes. Packet Design s Route Analytics Packet Design, Inc., established in 2003, has pioneered the field of route analytics for IP network management. Route analytics can listen to the network, without polling, in real-time, much as if it participated in the network as virtually another router in order to provide visibility into IP service paths across the network. Packet Design s Route ExplorerTM is part of a family of appliances that lets organizations gather network-wide information for use in network monitoring, planning, optimization, troubleshooting and maintenance. The company has established itself as a clear leader in the route analytics market, and is already managing IP networks in more than 100 enterprise deployments including financial, retail and pharmaceutical firms, some of the world s larger service providers, and in educational institutions, government and military agencies. Its success in large or complex network environments also brought Packet Design into an OEM relationship with Hewlett Packard s OpenView, which began in June 2004. In the course of the last two years, Packet Design has extended Route Explorer s protocol support to include OSPF (Open Shortest Path First), EIGRP (Enhanced Interior Gateway Routing Protocol), IS-IS (Intermediate System to Intermediate System) and BGP (Border Gateway Protocol) support. The visibility of route analytics provides three core benefits. First, it allows network administrators to diagnose layer 3 routing problems, such as interface flapping, imbalanced network exits, router adjacency loss, router configuration errors, and other routing protocol-related instabilities. Secondly, because of the accurate real-time awareness of IP application paths across the network, route analytics can serve as an effective orchestrator for infrastructure diagnostics as immediately relevant to the delivery of IP application services. This is because virtually any layer-2 problem will be reflected in layer- 3 as the network tries to route around the problem. Thirdly, route analytics is able to detect this change in

real-time (versus the delay in polling-based systems) and then inform the polling system as to exactly where the change occurred so that it can immediately launch a deeper analysis on the likely failed devices. This approach is much faster than traditional signature-based root cause analysis, which can take several polling cycles to determine a cause. When used in conjunction with problem analysis and event correlation, route analytics can provide a superior system for geographically isolating problems across the service path and then prioritizing diagnostic activity in accordance with where the problem has surfaced. This capability has been well demonstrated in Packet Design s OEM relationship with HP OpenView in which Route Explorer technology is used to automate the diagnostic capabilities associated with HP OpenView Network Node Manager. In addition, Route Explorer provides if-then and what if capabilities which are useful for more effective troubleshooting given persistent routing problems. For example, with these capabilities, customers can perform failure analysis (e.g., what happens if this link or router fails?), as well as maintenance planning and validation, where changes on the model can be tested beforehand and then validated afterwards to confirm that the network is operating as expected. With Traffic Explorer, Packet Design has built on Route Explorer by offering the first IP network management system to integrate multi-protocol, real-time routing information with traffic-flow data. This capability can provide a topology-aware view of network traffic as projected across virtually every link in the full network infrastructure. This delivers significant improvements in monitoring, planning and optimization through an artful combination of enabling technologies that position Packet Design as a distinctive innovator in next-generation traffic management. Traffic Explorer s New Traffic Management Capabilities Packet Design s Traffic Explorer extends the capabilities of Route Explorer by capturing flow-based IP application traffic information through integration with Cisco s NetFlow. It will later support IETF standard traffic types, including sflow and IP Flow Information Export (IPFIX). Traditionally, NetFlow is used to capture traffic volumes across specific network links, which can be used for capacity planning and network traffic engineering. Because NetFlow can also identify flows based on source and destination, it can also be used to support service accounting and chargeback, especially when supported by added parameters for identifying specific application traffic, such as server IP address, or packet-based identification. It can also provide insights into security related issues when application traffic is coming from unexpected or non-approved sources, or when there is inappropriate in-house application usage (e.g. downloading Kazaa from the Internet). Packet Design extends NetFlow-based capabilities by combining them with Traffic Explorer s core route analytics capabilities so that flow volume over one link can be accurately mapped across the full infrastructure. This is possible because Traffic Explorer already has the actual path of the routed traffic to calculate the direction of the flow. In other words, Traffic Explorer can accurately project the path of a given flow thanks to its strengths in route analytics. This unique and elegant approach to flow-based traffic management enables Traffic Explorer to capture the complete picture of traffic across complex networked infrastructures including those involving multiple protocols and peering points. As a result, IT managers gain a more intelligible and actionable understanding of what s going on across the full network system, without resorting to the Russian roulette of guessing which link to monitor and which link to leave unattended. This more comprehensive view, when combined with if-then capabilities for assessing changes in routing options, also reveals design tradeoffs that qualitatively were not visible before. To achieve this deeper understanding of network behavior, Traffic Explorer uses technology that integrates route and flow data to deliver a real-time model of the running network. Applications of this technology include: Traffic monitoring and analysis, based on route analytics integrated with traffic flow. The gathered information is sufficiently comprehensive so that, by monitoring as few as 10 key links, Traffic Explorer can accurately portray how all traffic flows across every link on the network.

Capacity planning, network planning and optimization. Because of the breadth of infrastructure awareness, including a full understanding of the routed topology and because of the native ifthen capability for examining tradeoffs engineers can explore routing changes in lieu of costly link upgrades to solve congestion problems. Traffic Explorer also supports a spreadsheet capability to examine expected traffic requirements across a matrix s schema. Peering, transit analysis and planning. Collectively, these capabilities deliver a significant return on investment to service providers since they help them to optimize peering traffic with other service providers that otherwise may be costing additional millions of dollars each month. This area can also support enterprises seeking to optimize partnership ecosystems and/or branch offices dependent on multiple-service-provider WAN connectivity. Traffic Explorer s if-then capabilities can also provide strong value in planning by letting users examine the impact of failures on anticipated traffic flows and volumes. This can also be a powerful preventive technique, since engineers can make sure that failures do not cause congestion due to re-routing of traffic. Similarly, this capability enables more effective maintenance and change validation to show that, for instance, a configuration change actually provided the benefits expected. Traffic Explorer s capabilities can also support network usage accounting. IT managers are able to define services based on source and destination addresses and port numbers. Next Generation Traffic Management The requirements for greater efficiency and accuracy in the face of accelerating infrastructure and service complexity are driving towards next-generation solution requirements in management software. EMA has analyzed and assessed these next-generation requirements in fault, performance and capacity planning or optimization. EMA s next-generation criteria are as follows: Cross-domain analysis, so that interdependencies between network, systems and/or applications can be understood dynamically and in real-time and historically. ** Cross-domain inventory and topology to capture a view of application/service ecosystems as they affect the full infrastructure. * Model-based analysis, so that complex interrelationships can be captured and shared effectively in a multi-dimensional mode. Support for application flows to capture insight into usage, performance, volume, security-related anomalies and consumption patterns. ** Support for route analytics for true accuracy in IP application paths, layer 3 fault diagnostics, and orchestration for diagnostics and performance issues across the infrastructure. ** Integrated fault and performance management for flexible navigation. * Integration with configuration management insights and systems. Support for Web Services and Service-Oriented Architecture designs. If-then analytic capabilities to help assess optimal designs from a performance and capacity perspective. ** Active management to accelerate and actually improve application performance. Advanced QoS capabilities to assess response time for critical response application services in both observed and synthetic mode. EMA requires next-generation fault and/or performance solutions to meet 3-4 of the above criteria by 2007. Packet Design s new capabilities address six (single asterisk) of the above criteria and fully satisfy four of the criteria (double asterisk). Moreover, route analytics is itself a required foundation for other management systems to evolve towards a next-generation model. Packet Design s traffic management capabilities therefore not only meet next-generation requirements for performance and fault management, but become a foundational resource for other management investments as well.

The Traffic Explorer Architecture The Traffic Explorer architecture depends upon a three-tier architecture [see Figure 1]. Traffic is captured in Flow Recorders, analyzed in the Flow Analyzer and finally modeled in the Modeling Engine. This aggregate works directly with Route Explorer, which provides the routed network topology to enable correlation of routed paths with flows and volumes. Figure 1: The Traffic Explorer Architecture Flow Analyzers are aggregation points for Flow Recorders, generating and updating traffic reports such as link utilization, traffic distribution and peering and issuing traffic alerts, such as utilization thresholds exceeded and route changes affecting traffic. The Flow Analyzers aggregate and compute flows across the topology, and then monitor how traffic changes as routing changes. Historical traffic flow and routing data are stored in a database for analysis, diagnosis and planning. The Modeling Engine enables user interaction for custom queries to analyze, troubleshoot and perform if-then analysis. More specifically, the Traffic Explorer appliances work with Route Explorer to collect flow data with Flow Recorders at key points where traffic enters the network. These are typically data centers, Internet gateways and selected remote locations for enterprises, and key peering points and customer POPs for service providers. Traffic flows are then aggregated by source/destination address and projected across the network based on how the network would actually route each flow. Packet Design is targeting Traffic Explorer at network engineers, traffic planners, service planners and other operational personnel at both enterprise and service provider markets. The common use of IP technology to deliver converged services to end users essentially places enterprise IT and service providers in the same position of being judged by quality of services provided. Service providers, however, have the additional task of monitoring peering relationships with other SPs. The capabilities of Traffic Explorer make tracking, monitoring and measuring actual traffic flows across the network threshold far more accurate and precise. EMA s Perspective Packet Design pioneered the concept of IP route analytics with Route Explorer, and has become the clear market leader in this area. With Traffic Explorer, it has added the vital capability of monitoring and managing actual traffic flows across all network-wide links. This provides a consolidated, comprehensive view of network activity over all links, providing topology-aware traffic analysis that shows the impact of routing changes or failures on network wide traffic flows. This correlation of traffic data with routing information enables more accurate network planning and impact analysis of changes to the service portfolio. The realtime nature of its if-then capabilities also makes Traffic Explorer uniquely supportive of production level optimization, replacing the simulated modeled snap shots used by other vendors with dynamic network topologies and traffic flows on the actual as-running environment. Taken in its entirety, Traffic Explorer represents an extraordinary combination of capabilities that are not likely to be equaled or easily imitated soon. Ease of deployment and administration are other distinctive features in Packet Design s value proposition. Once Traffic Explorer is installed, it automatically discovers the network and begins recording. Any network design changes will be automatically recorded and flagged to the user. However, there are some limitations in the product today. Traffic Explorer does not yet have a sophisticated capability for identifying individual application flows. It depends on NetFlow port assignments, which are often dynamic and hence unreliable. This is an area for poten-

tial enhancements, as it would enable more applicationspecific visibility as well as network optimization more directly sensitive to individual application needs and application priorities. Another limitation is that the first release of Traffic Explorer does not have an API covering the traffic data that would allow integration with other management tools. It does, however, incorporate the API from Route Explorer for route data and, also like Route Explorer, Traffic Explorer will have standard fault management integration points like syslogs and traps for alerts. However, these limitations are modest and should be viewed primarily as opportunities for functional and market growth. As an initial package, Traffic Explorer is an impressive combination of multi-dimensional value and functional elegance. As such, it already captures a significant number of criteria that EMA has determined are central for next-generation fault, performance and optimization, a market that in itself is becoming more fluid and polymorphic in nature. Packet Design s role as an innovator has two dimensions a leader in offering one of the fundamental enabling capabilities for next-generation management (route analytics), and a leader in offering effective management solutions for troubleshooting and optimizing large, complex networks with Traffic Explorer. This should position it well as a provider of solutions for network planners and engineers short term, and for a broader technical and executive constituency longer term. It should also position Packet Design well as a building block for accelerating next-generation functionality across multiple types and brands of management investments. How the IT management marketplace adjusts and assimilates Packet Design s innovation will be in itself one of the more interesting dynamics to watch over the coming year, and will be a non-trivial factor in shaping how nextgeneration designs evolve in support of managing and optimizing the full infrastructure in support of critical IT business services. About Packet Design Packet Design, Inc. develops and markets network solutions that leverage the distributed intelligence of the Internet Protocol (IP) to enhance the reliability, efficiency and predictability of IP networks. Packet Design s unique IP routing analysis solutions enable unprecedented visibility, analysis and diagnosis of an enterprise or service provider s IP network, improving network availability and performance while reducing operating costs and delivering a strong ROI. The company was spun out in March 2003 from Packet Design, LLC, the fourth networking startup of entrepreneurs Judy Estrin and Bill Carrico. The Estrin-Carrico team had previously founded Bridge Communications, Network Computing Devices and Precept Software; and Estrin served as chief technology officer at Cisco Systems from 1998 to 2000. Packet Design, Inc., has raised $24 million in private funding from Advanced Technology Ventures, Mayfield Fund, Allegis Capital, Masthead Venture Partners and parent company Packet Design, LLC.

About Enterprise Management Associates, Inc. Enterprise Management Associates, Inc. is the fastest-growing analyst firm focused on the management software and services market. EMA brings strategic insights to both vendors and IT professionals seeking to leverage areas of growth across e-business, network, systems, and application management. Enterprise Management Associates vision and insights draw from its ongoing research and the perspectives of an experienced team with diverse, real-world backgrounds in the IT, service provider, ISV, and publishing communities, and is frequently requested to share their observations at management forums worldwide. Corporate Headquarters: Enterprise Management Associates 2585 Central Avenue, Suite 100 Boulder, CO 80301, U.S.A. This report in whole or in part may not be duplicated, reproduced, stored in a retrieval system, or retransmitted without prior written permission of Enterprise Management Associates, Inc. All opinions and estimates herein constitute our judgement as of this date and are subject to change without notice. Product names mentioned herein may be trademarks and/or registered trademarks of their respective companies. Phone: 303.543.9500 Fax: 303.543.7687 info@enterprisemanagement.com www.enterprisemanagement.com 1047.031506