Archive for the ‘Network visibility’ Category

2 down, 5 to go. Why everyone wants a piece of the layer 1 matrix switch market.

Interesting news in the tech media today that Ixia have purchased Anue Systems, an established player in the Layer 1 access switch market. Great news for the team at Anue, obviously and a good fit for Ixia given Anue’s background in T&M. This acquisition follows the news late last year that NetScout acquired Simea, another layer 1 switch.  So what’s going on, and why does everyone want a piece of the Layer 1 matrix switch market? From our perspective there are some obvious answers and some slightly less obvious answers that are worth exploring in a bit more detail.

EndaceVision in action

Over the past few weeks we’ve had a lot of interest in EndaceVision which has been great to see.  To help bring EndaceVision to life we’ve been recording a series of videos that show how the tool can be used to address real work issues and how EndaceVision transcends the traditional divide between NetOps and SecOps.

Below you’ll find a series of links to some of the most poplar use case videos along with a brief description of what each one does. If you have any use cases that you want to see us have a go at then please email enquiries@endace.com and we’ll see what we can do to oblige. If you come up with a good use case we’ll send you some Endace chotsky.

Using EndaceVision to investigate anomalous network behavior

http://www.youtube.com/watch?v=kKS3CqlRaW4

In this user submitted use case we show EndaceVision can be used to solve a mysterious network traffic spike that has been occurring on the network and then configure alarms to alert next time the issue occurs.

Using EndaceVision to investigate a poor video quality call

http://www.youtube.com/watch?v=F3K4gJnkkYQ

In this video we show how EndaceVision can be used to rapidly analyze an under-performing video conference call by selecting into the time range the event occurred, visualizing the event and then investigating the potential causes for its low quality.

Using EndaceVision to see and investigate web apps on a network

http://www.youtube.com/watch?v=lWtqHilArMY

In this video we use EndaceVision to investigate what web applications are running on the network by visualizing traffic broken down by application. We then apply filters for port 80 and 8080, allowing us to view all of the web applications. From here we filter on Mafia Wars and then switch view to source IP to see who was using accessing that particular application at that time.

Using EndaceVision to rapidly isolate packets of interest

http://www.youtube.com/watch?v=gbf1dJ9iiWw

In this video we use EndaceVision can be used to reduce a massive 10TB network traffic file to a 135MB selection containing only the packets associated with an RDP connection we were looking to investigate. From here we download the packets directly into Wireshark for a full decode which gives us the full story.

Using EndaceVision to apply alarm overlays

http://www.youtube.com/watch?v=IpqcivR10ZE

I In this video we show how preconfigured alarms can be used as an overlay and be applied to a bandwidth over time graph to spot anomalies within a network, and visualize how they correlate with other network events.

Using EndaceVision to Share and Collaborate on Network Events

http://www.youtube.com/watch?v=Ej5SyNrwuJ0

This video demonstrates the various ways to share and comment on a visualization of a network event between different members of a network operations team. EndaceVision’s flexible framework helps to streamline the workflow and get to the right information to the right person in real time.

 

Mean Time To Innocence

Question: A storage guy, a VDI guy, an application guy and a network guy all come together to deliver a complex end to end virtual desktop solution for a large public-sector customer and it doesn’t work. Who’s to blame?

Answer: The network guy, of course.

Sound familiar? If you work for a Managed Services Provider then there’s a better than average chance that you’ll have experienced this many times. In fact, anyone responsible for running any network will probably recognize the scenario. In a complex multi-vendor environment figuring out what’s wrong and who’s responsible is really really hard.

BYOD – where do you stand?

Steve Jobs never set out to penetrate the corporate market with his iPad, but the sheer portability and usability of the device, coupled with the lure of free fast and unmetered internet connectivity make the presence of employee–owned laptops, tablets and smartphones on the corporate LAN an almost inevitability. The poor guy responsible for enforcing corporate policy doesn’t stand a chance. Really, he doesn’t, and the faster organizations get their heads around the issue the better, as it could have far reaching impacts in the longer term.

8 ways to improve your corporate network security

ZDNet published a great article yesterday talking about 8 ways to improve your corporate network security. This blog is extracted verbatim from the site. Given that we wrote it, we think this is justifiable. Our thanks to the team at ZDNet for supporting us.

Networks are getting faster, IT is migrating to the cloud, applications are sharing the web and people are bringing their own devices to work. These factors, coupled with the fact that the bad guys are playing a smarter game than they’ve ever played before, combine together to have a profound impact on the way that organizations must start behaving. If you are responsible for protecting a mission-critical network, here are eight things that you need to think about:

What’s your Time to Visibility?

Here at Endace we spend a lot of time helping all sorts of organizations solve really tough networking problems- the kind that make you pull your hair out and scream at your laptop. Our one mission in life is to reduce what we’ve dubbed the ‘time to visibility’ on network issues – whether that’s an outage, an application problem or an attack. Time to visibility is the amount of time, measured in minutes, it takes from someone (or something) reporting an issue to an engineer having the precise data that they need to resolve it conclusively. Stating the blindingly obvious, the shorter the time to visibility the more you can be do with the resources you’ve got. The concept isn’t rocket science, but it’s a metric missed by most vendors and a lot of organizations.

Damage control

If you work for a big organization there’s a better than average chance that your network security defenses are already breached somewhere. For organizations with valuable data this is the new reality. Organizations on the front foot are responding by investing in a wide range of IT tools to stop the bad guys getting inside in the first place, but they’re also investing in the tools to figure out what the bad guys who’ve already penetrated are doing. Network recording solutions have historically had a bad rap – ‘unreliable’ and ‘expensive’ are criticisms that have been leveled at the category, but the case for pervasive full packet capture is changing as fast as the technology that enables it.

Introducing EndaceVision : a brand new way to look at your network

At long last, after many months of testing and coding, we’re extremely excited to be to be able to announce the launch of EndaceVision the first 100% Endace created network visibility solution.

As followers of our story will know, for the last ten years we’ve been the platform-of-choice for organizations seeking to protect, monitor and measure their networks, but to date we have been reliant on software applications from third parties to deliver the application layer. For the first time EndaceVision breaks that third-party dependency and provides proven 100% accurate Endace network visibility all the way from the wire to the screen and back again, so it goes without saying that this is a big step for us. As hardware guys, the beauty of being able to write your own application is that you get to truly optimize every aspect of the application. EndaceVision leverages a unique blend of hardware and software processing to create the fastest, most accurate and most elegant architecture of any visibility solution today. Having the right solution architecture has always been important to us because EndaceVision, and the underlying visibility infrastructure that powers it, is designed specifically to meet the demands of 100Gbps networks, which is quite literally a whole different ball game.

How do you make monitoring and security apps scale to meet the demands of true 10Gbps throughput?

If the network monitoring (or network security system) that you’re working with is failing to show you everything that’s happening on the network the problem’s definitely the hardware, right?

Every expert worth their stripes knows that at a given network speed a NIC-based monitoring system will start to drop packets and as a result, the applications that they feed will start to go blind. But the reality is that software applications also have their own failure point beyond which they can’t process the packet flow – regardless of how accurate or complete the stream may or may not be. It turns out how your chosen software application is written has a profound impact on it’s performance at higher network speeds.

Full visibility into high-performance nets: Demand 100% packet capture

NWW published a great article yesterday talking about the need for 100% accurate packet capture. This blog is extracted verbatim from the article. Given that we wrote it, we think this is justifiable. Our thanks to John Dix at NWW for supporting us on it.

A new class of packet based network monitoring and recording solutions are emerging that enable companies running high-speed and ultra-high-speed networks to address the issue of network blindness, a condition that exposes organizations to a raft of operational, legal, compliance and reputational risks. With the cost of network downtime measured in millions of dollars per hour, knowing what’s going on inside the network isn’t just a nice to have, it’s critical.