Tune Up Your Network for the New Year

www.wildpackets.com© WildPackets, Inc.

Jay BotelhoDirector of Product [email protected]

Tune Up Your Network For The New Year

© WildPackets, Inc. 2Network Tune-up

Agenda

• What to consider

• Resolve to develop baselines

• Common pitfalls

• The network battlefield

• Monitoring for life

• Troubleshooting as a last resort

• Company overview

• Product line overview


What To Consider


Know Your Network

• Traffic levels per segment

‒ Mbps? ‒ Packets per

second?‒ Packet size

distribution?

• Traffic types per segment

‒ Data?‒ VoIP?‒ Video?

• Baselines‒ Establish and re-establish‒ Use automated analysis to

identify anomalies


Statistics vs. Packets


Not All Flows Are Created Equal

Netflow sFlow OmniFlow Packets

• Developed by Cisco

• RFC 3176

• sFlow agents

• Developed by WildPackets

• RFC 1122

• Transit and terminated traffic

• Statistical sampling

• Higher speed networks

• Analysis of every packet AND payload

• Every packet recorded

• Detailed troubleshooting

• Detailed info for each flow

• Time-based sampling of interface counters

• Unrivaled info for each flow

• Layer 2 - 7

• Apdex, Latency, Reconstruction, …

• NO packets • NO packets • Links to packets • Packets with network forensics

• Sampled – not 100% accurate

• Sampled – not 100% accurate

• 100% accurate • 100% accurate


It’s All In The Packets

Packets contain vitalinformation not detectedby flow-based systems


Choices and Comprises

• Greater visibility

• Monitoring and troubleshooting

• Single solution

• Integrated, cost-effective

Overhead?Cost?

Packet-based


Key VoIP/Video Issues

CAMP IT Pinpointing the Problem 9

JitterLatency

Packet Loss


Be Specific

• Where to collect data?

• Real-time or post-capture analysis? Everywhere?

• What data to collect?

• Am I getting all the data I expect?


Resolve to Develop Baselines


Network Dashboard


VoIP Dashboard


Application Dashboard


A Bit More Precisely …Application Response Time


Archiving Your Results

• Packets files

• Formatted reports


Common Pitfalls


5 Most Common Networking Problems

• Cabling issues

• Connectivity problems‒ Configuration‒ Hardware malfunctions

• Excessive network collisions‒ Collisions are normal and expected‒ Early collisions – first 512 bits – recovery automatic (2 – 3 ms)‒ Late collisions – recovery 100x longer – eg. NIC stuck in TX

mode

• Software problem‒ DNS configuration‒ WINS configuration

• Duplicate IP addresses


The Network Battlefield


Data Impacts on VoIP


Network Traffic: Quantitative Analysis

• Most network engineers are concerned about the amount of traffic on their networks

‒ Utilization (percentage of bandwidth)‒ Throughput (bits or bytes per second)

• You also need to be concerned about individual utilization components

‒ How much bandwidth and throughput can be attributed to each application or process?

• Clarifies which application traffic may need to be tuned or controlled

‒ How well or poorly will the baseline (trended) behavior of each application interact with VoIP

• Don’t forget to also consider the reverse case – VoIP’s impact on existing applications


Key VoIP/Video Issues

CAMP IT Pinpointing the Problem 22

JitterLatency

Packet Loss


Network Traffic: Qualitative Analysis

• The quality of your network traffic is potentially more important than its quantity when it comes to VoIP

• Many traffic streams are “bursty” in nature‒ Burstiness my occur over long period of time, or may consist of

rapid, recurring traffic spikes‒ Prolonged rises in utilization may decrease the number of calls

that can occur simultaneously‒ Sharp spikes may cause very noticeable quality issues with

ongoing calls

• Your baseline monitoring should consider not only averages and long-term trends, but also the short-term peaks and dips that characterize your traffic flow


Assessing the Monster's Impact

• While traditional network applications are very tolerant of jitter, latency, and even some degree of packet loss, VoIP is very sensitive to these troubles

• Levels of jitter, latency, and packet loss that would be easily tolerated on a data network can be devastating on a converged VoIP network

• Pre- and post-deployment network assessments are critical‒ You must understand your network’s ability to accommodate VoIP

• Current latency, jitter, and packet loss• QoS capabilities• Current bandwidth utilization (is there any room for VoIP)

‒ You must maintain a constant vigil after deployment to watch for imminent troubles


The Impact of "Just One More Call"

• Although a network link may be able to support a number of concurrent calls, one additional call is often enough to cause quality problems…

x1113

x2111

x1112

x1111

1st Call

2nd Call

3rd Callx2112

x2113

Example: The WAN can support 2 simultaneous calls. What happens when a third call is attempted???

Example: The WAN can support 2 simultaneous calls. What happens when a third call is attempted???

Call #3 Causes Poor Quality for ALL Calls


Monitoring For Life


Changing Methods - Data Recorders

IDS/IPS System

Servers

Post-incident

Real-time


Strategy for Monitoring 10G Ethernet

Other

All set - our mirroring sol'n converts 10G to 1G

All set - tools already support 10G

Can't afford upgrading tools to 10G

Want to keep 1G tools as long as possible

Our tools don't support 10G

0% 10% 20% 30% 40% 50%

4.1%

14.4%

21.9%

21.9%

32.9%

41.1%

Which of the following apply to your strategy for monitoring 10G segments? (Select all that apply)

SOURCE: Benchmarking Network and Security Operations: Tools, Processes, and Enabling Technologies Study, 2009, Enterprise Management Associates. n=124


10Gig Network Analysis Workflow

At 10Gig – 24x7 Is EssentialIdentify Key Analysis Pts

Deploy 24x7 Monitoring

Alarms/Alerts

Problem?

Rewind Data Analyze

Tune if Necessary

NO

YES


Troubleshooting As A Last Resort


Network Recording,Real-Time Statistics, Forensics Search

Company and Product Line Overview

• Display TimeLine Graph during capture-to-disk

‒ Utilization (Mbits/s)

‒ Packets/s‒ unicast/

multicast/broadcast

‒ Packet sizes‒ VLAN/MPLS‒ Protocols


A Picture is Worth a 1000 Words

• A graph of latency, jitter, or packet loss can speak volumes about network health, either for proactive or reactive troubleshooting

• Overlaying this graph with a graph of utilization or total throughput can reveal even more about the causes of VoIP troubles


Analyst’s Perspective


Visual Expert Provides ProofTwo requests for data, two quick TCP Acks, but then a long delay

before the server sends the requested data

Requests and Acks

Then the Data gets returned much later

ACK fast = Network fast

Data slow = System slow


Company Overview


Corporate Background

• Experts in network monitoring, analysis, and troubleshooting‒ Founded: 1990 / Headquarters: Walnut Creek, CA‒ Offices throughout the US, EMEA, and APAC

• Our customers are leading edge organizations‒ Mid-market, and enterprise lines of business‒ Financial, manufacturing, ISPs, major federal agencies,

state and local governments, and universities‒ Over 7,000 customers / 60+ countries / 80% of Fortune 1,000

• Award-winning solutions that improve network performance‒ Internet Telephony, Network Magazine, Network Computing Awards‒ United States Patent 5,787,253 issued July 28, 1998

• Different approach to maintaining availability of network services


What We Do

• Provide network visibility and intelligence …‒ WatchPoint, OmniPeek, OmniEngines

• Expert systems – we find the problems for you• Superior drill-down capability – trouble-shoot from anywhere• Flexible, customizable, extensible – leverage your investment

‒ Professional services, training, best practices

• For all network segments …‒ Data center to desktop to remote office‒ LAN, WAN, Wireless …‒ HTTP, Email, Database, VoIP, Video …

• To …‒ Network engineers; IT Management; Developers


Real-World Deployments

Education

Health Care / Retail

Financial

Telecom

Government

Technology

http://www.fbiband.com/

http://www.dea.gov/


Product Line Overview


Product OfferingsSoftware and Turnkey Appliances

• Enterprise Monitoring and Reporting‒ WatchPoint Server‒ OmniFlow, NetFlow, and sFlow Collectors

• Network Probes & Recorders‒ Omnipliance Network Recorders – Edge, Core‒ TimeLine Network Recorder‒ OmniAdapter Analysis Cards

• Distributed Analysis Software‒ OmniPeek – Enterprise, Professional, Basic, Connect‒ OmniEngine – Enterprise, Desktop, OmniVirtual

• Portable Solutions‒ OmniPeek software‒ Omnipliance Portable


WatchPointCentralized Monitoring for Distributed Enterprise Networks

• High-level, aggregated view of all network segments

‒ Monitor per campus, per region, per country

• Wide range of network data‒ NetFlow, sFlow, OmniFlow,

SNMP

• Web-based, customizable network dashboards

• Flexible and detailed reports



Omnipliance Network Recorders

• Captures and analyzes all network traffic at the source 24x7‒ Runs our OmniEngine intelligent probe software‒ Generates vital statistics on network and application performance‒ Intuitive root-cause analysis of performance bottlenecks

• Intelligent data transport‒ Network data analyzed locally‒ Detailed analysis passed to OmniPeek on demand‒ Summary statistics sent to WatchPoint for long term trending and

reporting‒ Efficient use of network bandwidth

• Expert analysis speeds problem resolution‒ Fault analysis, statistical analysis, and independent notification

• Multiple Issue Digital Forensics‒ Real-time and post capture data mining for compliance and

troubleshooting


TimeLine Network Recorder11.7Gbps Sustained Capture

• Fastest network recording and real-time statistical display — simultaneously

‒ Network statistics display in TimeLine visualization format

• Rapid, intuitive forensics search and retrieval‒ Historical network traffic analysis and quick data rewinding‒ Several pre-defined forensics search templates making

searches easy and fast

• A natural extension to the WildPackets product line

• Turnkey bundled solution


Omnipliance Network RecordersPrice/performance solutions for every application

Portable Edge Core TimeLineRuggedized

TroubleshootingSmall Networks / Remote Offices

Regional Offices /Small Datacenter

DatacenterWorkhorse

Chassis 1U 3U 3U

Memory 2 GB / 8 GB 4 GB / 8 GB 6 GB / 24 GB 18 GB / 24 GB

Expansion 1 PCI-E / 2 PCI-X 1 PCI-E or 1 PCI-X 4 PCI-E 4 PCI-E

Storage 500 GB / 2.5 TB 1 TB 8 TB 8 TB / 16 TB / 32 TB


OmniPeek Network Analyzer

• OmniEngine Manager‒ Connect and configure distributed OmniEngines/Omnipliances

• Comprehensive dashboards present network traffic in real-time‒ Vital statistics and graphs display trends on network and application

performance‒ Visual peer-map shows conversations and protocols‒ Intuitive drill-down for root-cause analysis of performance bottlenecks

• Visual Expert diagnosis speeds problem resolution‒ Packet and Payload visualizers provide business-centric views

• Automated analytics and problem detection 24/7‒ Easily create filters, triggers, scripting, advanced alarms and alerts


Key Differentiators

• High-level network monitoring to root-cause analysis

• Single solution for today’s converged networks‒ Wired, Wireless, 1GB, 10GB, VoIP, Video, TelePresence, IPTV

• Reduce and even eliminate network downtime‒ Automated monitoring 24x7‒ Speedy resolution of network bottlenecks

• Improve network and application performance

• Uniquely Extensible Platform – tailored to your needs

‒ Plug-ins and APIs for integration and customization


Thank You!

WildPackets, Inc.1340 Treat Boulevard, Suite 500Walnut Creek, CA 94597(925) 937-3200