33 Flows, Sessions and DPI Much confusion around the definitions of APM and NPM Terms such flows, sessions and DPI used interchangeably Same terms mean different things to different vendors Over 100 vendors in this space offering polling, flow monitoring, packet capture, agent based and DPI solutions. Hard to compare “apples to apples”. At the end of the day, what do customers want? How well are the applications being delivered to the end users?
44 Introducing …… Application Aware Network Performance Management Meet the needs of network engineers as well providing business relevant application views Provide application level performance information from a network perspective Agentless, appliance based solutions Complementary to network packet broking (NPB) tools Net Optics market leaders in provision of complementary AANPM and NPB solutions Other AANPM criteria (ref Gartner) include Flow Based (NetFlow, IPFIX) capability, dashboards, threshold alarming, VoIP and application awareness
55 Drilling down, NPM Layer 4 (TCP/UDP Information) Layer 3 (IP Information) Traditional NPM tools. NetFlow based products, freeware tools such as nTop. Common attributes across all flows
66 Drilling down, Beyond NPM, toward AANPM Layer 4 (TCP/UDP Information) Layer 3 (IP Information) Traditional NPM tools. NetFlow based products, freeware tools such as nTop. Common attributes across all flows Port 80 URL Download Time Client Browser Type Basic AANPM. Analysis of a single application (HTTP). Dependent on DPI (Payload inspection) Application specific metrics HTTP
77 Drilling down, Full AANPM, Spyke Layer 4 (TCP/UDP Information) Layer 3 (IP Information) Traditional NPM tools. NetFlow based products, freeware tools such as nTop. Common attributes across all flows URL Download Time Client Browser Type Basic AANPM. Analysis of a single application (HTTP). Dependent on DPI (Payload inspection) Application specific metrics HTTP Email SMTP Attachment Name To Address From Address Hotmail Yahoo POP3VoIP Caller ID Jitter MOS DNS Query Response Code RTT Application aware metrics. Business relevant information Coverage across many applications Reliant on complex DPI techniques Major differentiator for Spyke.
88 Customer Pain Points Real time views (5 second updates) Historical views Key performance indicators (top talkers, latency, conversations) Application drill downs Technical and business level reports I need to monitor the availability and performance of the network and applications using it
99 Customer Pain Points View network usage by application Session reports showing application detail Geographic representation of traffic and application flows Long term capacity planning and trending reports I need to understand how clients and applications are using the network
10 Customer Pain Points I need to monitor the quality of my organisations VoIP calls. View all VoIP calls across network Summary tables showing call details Drill down to specific call metrics Caller/callee ID Originating subnet Start time and duration MOS and Jitter (RTP dependent)
11 Common objections: Spyke v Open Source Wireshark Excellent packet analyser Highly technical point solution Can be used in conjunction with Spyke No continuous capture option No business layer reporting No historical data + + + nTop Flow based analysis (NPM) Some extensions (e.g. latency and voice) Limited historical reporting Limited scalability Rudimentary reporting capability Paessler PRTG Flow based analysis (NPM) Very nice user interface Good point solution Not strictly speaking Open Source Limited scalability Nagios SNMP management platform No direct competition to Spyke
12 Common Objections: Danaher/Fluke 12 OptiView NetFlow Tracker Simple flow based NPM solution NetFlow/sFlow/IPFIX only No deep packet inspection Ex Crannog product Visual Performance Manager Multi tiered approach using passive appliances Network performance Appliance (NPM) Application performance Appliance (DPI) Good VoIP monitoring, limited support for other applications ClearSight Analyzer Powerful packet capture and analysis Technical troubleshooting tool Can be complementary to Spyke and appTap
13 Common Objections: Solarwinds 13 Network Performance Monitor -Simple SNMP polling engine - No flow based capability - No DPI capability Orion Network Traffic Analyser -Simple flow based NPM solution - NetFlow, sFlow, IPFI - No DPI capability VoIP & Network Quality Manager - Utilises Cisco SLA for synthetic transactions - Leverages call data records from Cisco CallManager - Limited multi vendor support -No DPI capability
14 Common Objections: NetScout 14 nGenius Performance Manager nGenius Voice/Video Manager nGenius Enterprise Intelligence nGenius Trading Intelligence InfiniStream Packet Analysis nGenius Performance Manager for Flows nGenius Packet Flow Switch Very comprehensive coverage across packet analysis, NPM and AANPM Very complex product set Could be considered the ‘Rolls Royce” of monitoring Level of integration between acquired products still needs work Possibility to use Spyke/appTap to feed flow data to existing NetScout installations Competitive advantage … price.
15 When to hold and when to fold …. The customer already has WAN optimization deployed. E.g. Riverbed, Juniper, Blue Coat, Expand WAN Optimization products produce similar statistical data Normally limited with respect to historical reporting Normally limited with respect to reporting functionality WAN optimization vendors aggressively moving into NPM market Spyke win not impossible, but the level of overlap is high which makes for a tough sale. 15
16 When to hold and when to fold …. 16 The customer already has enterprise wide performance management deployed. E.g. NetScout, Compuware, Fluke, HP Determine the level of statistical information, often it is only SNMP based. Are all the remote sites completely covered? Can we deploy appTap for full remote site coverage? Option to work with the existing tools – Trojan Horse approach. Spyke win not impossible, focus on complementary features rather than trying to unseat incumbent vendor.
17 Value Proposition at a Glance 17 Others High cost Complex (steep learning curve) Point solutions Limited DPI NetFlow only Typically NPM based Spyke Low cost Easy to use Comprehensive analysis across voice and data True DPI NetFlow compatible True AANPM
18 A small glimpse into the future …. Continued consolidation of NPB and NPM markets NetScout acquiring Simena Danaher with VSS and Fluke Prediction : Continued acquisition of NPM vendors by NPB vendors Existing customers already inquiring about NPM features on existing Net Optics switching platforms Future bandwidth requirements will mandate that NPM will need to be done in silicon not software Net Optics is the most advanced vendor in this space and is well placed to continue to be the market leader 18