IT Jobs
Network monitors head for the high ground
They've lost the low ground to open source, but can they take and hold onto the heights instead?
By Bryan Betts, Techworld | Techworld
Published: 01:00 GMT, 18 November 05
The lure of open source is strong, and it's starting to be felt by the traditional network monitoring and analysis companies - but they are finding ways to fight back, according to Janice Spampinato, VP international at WildPackets.
"Packet analysis tools are very much a commodity now," she says. "Ethereal and the like has taken the legs off the portable market, so thank goodness we decided to go for the distributed market."
In her view, companies such as WildPackets still have an important edge, not least because they have R&D money to invest: "The free tool expands the network analysis market, and it keeps us honest. They now do voice too, so it keeps us developing the right things that people want to see in our products.
"A centralised way to make sense of your network is important right now," she argues. "There is still something to be said for presentation and expert analysis - there's still things a commercial product can offer. Every day we ask ourselves how much attention should we pay to the portable market, when people don't want to pay for it anymore. I think people will still spend money for security and forensics, but you have to be nimble to stay ahead."
She adds that companies such as hers need to move fast in order to stay ahead. For example, she says WildPackets has exposed its APIs, so as well as working through the console, you could write a short Perl script to generate specific reports, say.
"We have come from the portable market, I would say that's holding steady although open source tools such as Ethereal have taken a slice," she says. "We've taken lessons from that and set up a developers' community to share information, for example if someone writes a new decoder. We are already moving to Linux for our sensors, it would make sense to do a Linux version of OmniPeek too."
The real edge lies in looking for new applications though, typically those that sit on top of basic network monitoring - most notably forensics and application performance monitoring.
"We do full seven-layer analysis, not just the upper layers. Ethereal is an engineer's tool with no real expert system for troubleshooting - it's not for people new to network analysis," Spampinato says.
"We are also looking into forensics - we have a view of the network internally, so we can see who did what, how the breach occurred and why," she says. "Existing solutions can't do that, for example an IDS or antivirus program can't do root cause analysis, and if a threat gets past them, they don't know about it."
"And we're now looking at video over IP too. I'm always surprised by the latency in some markets, by the way, for example Asia-Pacific is way ahead on IPv6 and video, while the EU has been behind, except on voice."
The ability to do visualisations is becoming increasingly important, not least because as data volumes rise, it is just not feasible for a human to trawl through gigabytes of data. However, an expert program running on a computer can reconstruct the datastream, spot patterns and then present the result in graphic form.
"We started developing on the Mac for a reason - because it had a GUI," Spampinato explains. "You can have expert analysis behind that, but the presentation is still important. For example, we have the first version of a network manager's dashboard, with a proactive vision of where your problems are, coming in the first quarter of 2006."
WildPackets developed a product some years ago called Skyline Satellite, she adds. "It gave a view of the network over time, it never sold because it had a limited market but now it's technology we need, because of forensics.
"But we are moving away from looking at the bits in packets towards application performance - if your application runs over the network, that's where to look first, it's where the uncertainty is. So if the network is application-aware, that makes our life easier."
.gif)
SANs tuned for virtualisation
Add your commentComments