Network performance monitoring & the appl layer

The Big Picture: Network performance monitoring is evolving along with the rest of the datacenter.Network performance monitoring is moving up into the application layer because the need is there to see how the application affects the network and vice versa. This short 7 min video w/Savvius discusses what’s new with them, network performance monitoring and where it’s headed in the future.

Mike Matchett:                  Hi. I'm Mike Matchett with Small World Big Data. Today, I'm going to talk a little bit about network performance monitoring, something that has been around for a long time in many different forms. Lately, we're seeing lots of different kinds of performance monitoring move up into the application layer, whether you start from the virtual machines or containers or whatever else everyone wants to know really how that relates to applications.

                                                      We're now seeing network performance monitoring, that the network IT engineering guys also now being able to look at performance from a more application perspective. To talk to us today about that, I've got Jay Botelho, who's the head of product from Savvius. Welcome Jay.

Jay Botelho:                          Thanks, Mike. Glad to be here.

Mike Matchett:                  So, Savvius has been around for actually a long time, right? This is the new iteration of a network performance company that's got roots.

Jay Botelho:                          Absolutely true. 20 years, a long evolution originally from protocol analysis, now all the way up to high speed network performance monitoring and application monitoring.

Mike Matchett:                  Right. We talked previously, and you were showing me stuff about these racked appliances that can handle 20 gigabytes per second of network packet capture and deep packet inspection, all this cool stuff, but we want to talk today about what's new in something you call Spotlight that brings that analytical edge to that. You're not just wanting network engineers today to dive down and actually look at packet by packets. There's far too many packets today, I would say. Right? Packets are big data, and you don't just want to look at each one of them anymore. You want to do something smarter. So, what does Spotlight topically bring us to if you're a network engineer?

Jay Botelho:                          Right. What Spotlight does is it really becomes the guidance to know and if you even need to look at packets. Just what you were saying, we hear it all the time now from customers, right? They don't want to have to look at packets. Even though they're network engineers, just don't want to have to do it. Some of the other guys don't even know what to do with it, honestly. It's kind of surprising. What Spotlight does is it [inaudible 00:02:14] on deep packet inspection, but it looks for critical fault areas on the network, like bad application latency, bad network latency, bad TCP quality, bad VOIP quality.

                                                      It'll isolate, out of that 20 gigabytes per second you were talking about, it'll isolate individual flows that represent the worst in terms of that key metric. So, a little graph where you're going to see 16 bars charts, and each on is a flow. Even if you had a million there, it's going to pick out the 16 worst ones out of a million or 2 million.

Mike Matchett:                  That flows a conversation between two end points that you define to be part of your application in terms of protocol and port and server, right? That's-

Jay Botelho:                          Correct, correct. Yeah.

Mike Matchett:                  So, you can [crosstalk 00:02:55]-

Jay Botelho:                          Yeah.

Mike Matchett:                  Right. So, really, we're talking about how do we process and handle a large amount of volume of data and bring it to a dashboard, kind of a nice looking dashboard where you can say, "Okay. One quick view, I can see half a dozen things, six things." What are those things tell me when I look at that?

Jay Botelho:                          They're going to tell you one your network right now, or whatever part of the network you decide to focus on ... Let's say it's on the whole network, it's going to tell you what conversations right now have the worst application latency, which ones have the worst network latency, which ones have the worst VOIP quality, which one has the worst TCP quality, which ones have the worst overall conversation quality. Then, we throw in a utilization graph because everyone loves utilization.

Mike Matchett:                  You've got to have utilization, even though we talked as performance experts, utilization have some really strange correlations with whether there's a problem or not. You've got to have utilization because that's a baseline for understand. So, you've got this out there. This is version 2.0. 2.0 brings that application perspective to something you've been doing.

Jay Botelho:                          That's correct. There were two main things to 2.0. Before it was just a five topic perspective, so it was port protocol, server, address, that kind of thing. Now, we've added the ability to actually identify at a packets level whether there's SAS traffic like Office 365, or GoToMeeting, or Salesforce, as well as allow customers to define their own applications. So, they can define something specific to them that's port protocol server related, and then see their own applications as well.

                                                      We allow the dashboards to be customizable. Version 1.0 had a limitation in the since of you were fixed to the dashboards that were there. Now, you can configure those six panels performance monitoring anyway you want to to see any part of the network and any combination networks and applications, et cetera.

Mike Matchett:                  I mean you really can create a filter now, if I can get this right, where I can say, "This is my boss's exchange traffic in his email." So, I can actually look at that in specific, and if he complains about it, I can know whether he's really right or not about the network, right?

Jay Botelho:                          Absolutely true.

Mike Matchett:                  Yeah.

Jay Botelho:                          [inaudible 00:05:11] use case, yes.

Mike Matchett:                  Yeah. So, just in the last minute or so, what are some common things that people are looking at today? What are you finding that people come back to you and say, "Hey, this is really great because I was able to look at this?"

Jay Botelho:                          Well, one of the things that you mentioned are the filters because sometimes you just want to see that something maybe isn't there. Maybe you want to make sure there's no FUV traffic, or you can build a filter because something isn't zero day. What were the characteristics of a particular threat are? And you can see if it's on your network or not. That's one of the key things.

                                                      Another one is, kind of like you were saying, maybe not looking all the time through your boss's network. One of the great things about Spotlight is you can pivot from a view of the whole network to a view of one person's IP address with simply typing in the address. So, you type in the address of that executive, and now you immediate see all the network conversations just they're having.

                                                      So, that ability as well has been huge. And lastly, we don't want everybody to have to look at packets. The thing that people love about this is it's all in one appliance where we're doing this analysis and saving the packets that generated that traffic. So, if a network engineer needs to go deeper to figure out the root cause analysis, they click a button, and they can bring the packets into a protocol analyzer that represent just the flow that's representing the problem. So, they can instantly dive in and get to the details.

Mike Matchett:                  Right. That's huge. It's not just performance, but it's security. And these [inaudible 00:06:37] security are kind of at the edges of difficulty sometimes where you're looking at things to really get your hands around because they're not necessarily linear with utilization as we talked about. It's not a fault or an error, necessarily. You've got to look at the latency. You've got to look at some more complicated things. So, this is really interesting. Any place where people should specifically go to find more information about what you've got here in Spotlight 2.0 and Savvius?

Jay Botelho:                          Sure. Just www.savvius, S-A-V-V-I-U-S, .com/spotlight, just as it sounds.

Mike Matchett:                  All right. Well, thank you, Jay for being here today. I appreciate it.

Jay Botelho:                          Thanks, Mike. I appreciate it, too. Enjoyed talking to you.

Mike Matchett:                  All right. We'll be back. Again, thank you for watching. Let me know if there's anything specifically you want to see. Otherwise, come back next time and I'm sure we're going to hear more from Savvius at some point on what they're 3.0 is going to bring us. So, take care. Bye.