Watch the full OnDemand Webcast: http://bit.ly/wcappdistributed Corporate computing has crossed the threshold to highly distributed, and it doesn’t matter if your corporation has 50 or 50,000 employees. The reasons are many, including cloud usage, SAAS subscriptions, or just highly distributed enterprise networks and users. Have your network analysis capabilities evolved with your corporate computing infrastructure? Traditional network analysis and troubleshooting solutions were centralized, and back when all corporate computing assets were located in and routed through a central data center this approach worked well. But with more and more applications migrating from your data center to remote locations (cloud or otherwise), your ability to monitor, analyze and troubleshoot mission critical application performance is compromised by a centralized network analysis approach. It’s imperative that you also distribute your network analysis capabilities. More than that, you need to evolve from a "point and shoot" network troubleshooting approach to a distributed, 24x7 network monitoring approach. Distributing your network analysis capabilities and monitoring 24x7 allows you to respond to network issues before they become full blown problems and to analyze and troubleshoot issues proactively vs. reactively. Join us to examine the technologies and approaches to best deal with today’s highly distributed network applications. In this webcast, we will cover: Current trends in enterprise application distribution Key performance indicators when monitoring overall application performance Network analysis architectures for today’s distributed application environment Benefits of employing distributed, 24x7 solutions for application and network performance monitoring What you will learn: How to effectively use network analysis solutions for application performance monitoring How to deploy network analysis solutions to ensure adequate coverage of your network Why "point and shoot" network troubleshooting approaches are no longer enough

1. Your Applications Are Distributed
How About Your Network Analysis Solution?
Jay Botelho
Show us your tweets!
Use today’s webinar hashtag:
Director of Product Management
WildPackets #wp_distributed
jbotelho@wildpackets.com with any questions, comments, or feedback.
Follow me @jaybotelho Follow us @wildpackets
© WildPackets, Inc. www.wildpackets.com

2. Agenda
• Current Trends in Application Distribution
• Monitoring Application Performance
• Network Analysis Architecture in a Distributed World
• Network Analysis – Proactive vs. Reactive
• Using Network Analysis for Application Performance
Monitoring
• Company Overview
• Product Line Overview
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 2

3. Current Trends in Application
Distribution
© WildPackets, Inc. www.wildpackets.com

4. First, Back to Basics
• Cloud – it’s all the rage
‒ Public
‒ Private
‒ Hybrid
• ―… as a Service‖
‒ Software aaS
‒ Infrastructure aaS
‒ Platform aaS
• Application Service Providers
• Virtualization
• Grid computing
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 4

5. Let’s Focus
• Cloud – it’s all the rage
‒ Public
‒ Private
‒ Hybrid
• “… as a Service”
‒ Software aaS
‒ Infrastructure aaS
‒ Platform aaS
• Application Service Providers
• Virtualization
• Grid computing
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 5

6. Cloud Computing Characteristics1
• Providing applications to end users vs. just
computer cycles
• Scalability
• Elasticity – compute power grows and shrinks
• Simple, web-based provisioning
• Integration and ease-of-use
• Simple cost structure
• Worldwide data recovery
• Device independence
• Example – Hosted corporate email ala Google
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 6

7. ASPs vs. Cloud Computing
• Most ASP vendors were start-ups
‒ Limited resources
‒ Unknown pedigree
‒ Short life spans
‒ Flexible application choices
• Cloud computing vendors are big companies
‒ Resources for enormous data centers
‒ Vast amounts of storage
‒ Computing capacity to service millions of users
‒ Experience with large-scale web-based applications
‒ Google, Dell, Amazon, IBM, etc.
‒ Less application choice but more economy of scale
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 7

8. ―aaS‖ vs. Cloud Computing
• ―aaS‖
‒ Flexibility
‒ Little to no integration between services (stovepipes)
• Cloud Computing
‒ All applications 100% integrated on the Web
‒ No install, no IT, no human intervention by the vendor
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 8

9. Current Trends2
• 69% of US Internet users are using some form of
Internet-based computing (Pew Research Center)
• 40% of IT infrastructure purchases by early
technology adopters are ―as a service‖
• By 2013, 12% of world software market will be
Internet-based computing (Merrill Lynch)
• 78% of IT managers believe economic uncertainty
makes Cloud Computing more appealing (ScanSafe)
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 9

10. Does It Really Matter?
Forget what you call it – focus
on the changing network
management equation
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 10

11. Monitoring Application
Performance
© WildPackets, Inc. www.wildpackets.com

12. It’s All About The User
Application Response Time – The time it takes an
application to respond to a specific user request,
measured from the user’s perspective
3 Performance Levels of User Satisfaction
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 12

13. A Bit More Precisely …
Application Response Time =
Network Response Time + Transaction Response Time
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 13

14. Network Response Time
Network Response Time (R) ~
(payload/bandwidth) + [AppTurns*RTT]
• Network Response Time (R): Time between a user’s action and
the network’s response to that action
• Payload: Information content in bytes
• Bandwidth: Minimal link speed between client and server
• AppTurns: Number of interactions needed between the client
and server to provide a response to the user
• Round Trip Response Time (RTT): Propagation time for data
between the client and server
Adapted from Peter Sevcik and
Rebecca Wetzel of NetForecast
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 14

15. Other Network Response Time
Considerations
• NRT is dynamic, never a constant
• DNS response time is a common source of
performance issues
• Proxy servers – TCP connection is not end-to-end to
the server
• Multi-tier designs – network latency between each
tier
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 15

16. Transaction Response Time
Transaction Response Time (TRT) ~
Server Response Time (SRT) + Client Response Time (CRT)
• Server Response Time (SRT): Processing time required by the
server
• Client Response Time (CRT): Processing time required by the
client
Adapted from Peter Sevcik and
Rebecca Wetzel of NetForecast
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 16

17. Transaction Response Time Factors
• Server Latency: Time for the server to process a
request - memory, disk system, CPU, and usage
dependent
• Application Latency: Time for the application itself to
process the request – mostly software design
dependent
• Database Latency: Database design factors that
contribute to overall processing time – eg.
fragmentation, indexing, etc.
• Browser/Workstation Latency: The client side of the
equation
• Protocol Usage: Some protocols outperform others
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 17

18. It’s All About The User
3 Performance Levels of User Satisfaction
Application Response Time ~ (payload/bandwidth) +
[AppTurns*RTT] + SRT + CRT
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 18

19. Network Analysis Architecture in a
Distributed World
© WildPackets, Inc. www.wildpackets.com

20. Where To Look?
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 20

21. Different Approaches, Different Results
• Server-side or Client-side?
‒ Client side
• Closest to what the user sees
• Difficult to troubleshoot delays
• Monitoring equipment at all remote sites – expensive
‒ Server-side
• RTT harder to determine
• Consolidation of monitoring equipment
• Better able to assess server response time
• Active or Passive?
‒ Active
• Challenging to accurately simulate user traffic patterns
• Predictable
• Better for ongoing monitoring
‒ Passive
• Closer representation of the user experience
• Somewhat unpredictable
• Best for pre-deployment application profiling
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 21

22. Network Analysis Example
2. Data Recorder records IDS/IPS System
and aggregates data
throughout attack
3. Event logged, attack
partially tracked by IDS
Servers
1. Attack
bypasses firewall
4. Post event analysis reveals
attacker, method, damage!
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 22

23. The Cloud Changes Very Little
Cloud Provider
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 23

24. Network Analysis – Proactive vs.
Reactive
© WildPackets, Inc. www.wildpackets.com

25. Network Analysis: Not Just Reactive!
• Network analysis and troubleshooting has
traditionally been implemented only when there’s a
problem
• But proactive troubleshooting identifies troubles
when they are small and are having minimal impact!
• The concept is simple…
Proactive Reactive
Troubleshooting = Troubleshooting
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 25

26. Know Your Network
• Traffic levels per • Baselines
segment ‒ Establish and re-establish
‒ Mbps? ‒ Use Expert events for further
‒ Packets per classification
second?
‒ Packet size
distribution?
• Traffic level per
application
‒ Average rates
‒ Peak rates
‒ Weekly patterns
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 26

27. Using Network Analysis for
Application Performance
Monitoring
© WildPackets, Inc. www.wildpackets.com

28. User’s Perspective
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 28

29. Analyst’s Perspective
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 29

30. Application Performance Monitoring
Doesn’t Change in the Cloud
• All the same goals apply
‒ Monitoring/alarms
‒ Real-time analysis
‒ Post-capture analysis
‒ Network performance
‒ Application performance
‒ Service level assessments
• Only the implementation is different
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 30

31. A Case Study
• April, 2011 – Amazon’s EC2 Web Service outage
lasts nearly 24 hours and takes brand-name websites
down with it
• Highlights the need to ―design for failure‖
• Lessons:
‒ Monitoring remains highly valuable in the Cloud
‒ Cloud providers must do a better job of making service
uninterrupted to attract customers
‒ Determining when the interruption is in your network or from
your service provider
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 31

32. Getting It All In One Place
~ RTT
Payload
Turns
~ SRT, CRT
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 32

33. SRT, CRT Highly Variable
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 33

34. The Network Or The Application?
Possible Issues on the Network
Possible Issues with the Application
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 34

35. Expert Analysis Leads The Way
System or Application is at fault
Network may be at fault
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 35

36. What To Look For
• Primary events are anything related to ―slow‖
‒ Depending on what events we see, we will know who is at fault
• Typical application events:
‒ HTTP slow response time
‒ Oracle slow response time
‒ Inefficient client
• Typical network events:
‒ TCP SLOW segment recovery
‒ Slow retransmissions
‒ Slow acknowledgements
‒ Low throughput
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 36

37. Visual Expert Provides Proof
Two requests for data, two quick TCP Acks, but then a long delay
before the server sends the requested data
ACK fast = Network fast
Requests and Then the Data
Acks gets returned
much later
Data slow = System slow
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 37

38. Company Overview
© WildPackets, Inc. www.wildpackets.com

39. Corporate Background
• Experts in network monitoring, analysis, and troubleshooting
‒ Founded: 1990 / Headquarters: Walnut Creek, CA
‒ Offices throughout the US, EMEA, and APAC
• Our customers are leading edge organizations
‒ Mid-market, and enterprise lines of business
‒ Financial, manufacturing, ISPs, major federal agencies,
state and local governments, and universities
‒ Over 7,000 customers / 60+ countries / 80% of Fortune 1,000
• Award-winning solutions that improve network performance
‒ Internet Telephony, Network Magazine, Network Computing Awards
‒ United States Patent 5,787,253 issued July 28, 1998
• Different approach to maintaining availability of network services
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 39

40. Real-World Deployments
Education Financial Government
Health Care / Retail Telecom Technology
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 40

41. Product Line Overview
© WildPackets, Inc. www.wildpackets.com

42. Product Line Overview
OmniPeek/Compass
Enterprise Packet Capture, Decode and Analysis
• 10/100/1000 Ethernet, Wireless, WAN, 10G
• Portable capture and OmniEngine console
• VoIP analysis and call playback
Omnipliance / TimeLine
Distributed Enterprise Network Forensics
• Packet capture and real-time analysis
• Stream-to-disk for forensics analysis
• Integrated OmniAdapter network analysis cards
WatchPoint
Centralized Enterprise Network Monitoring Appliance
• Aggregation and graphical display of network data
• WildPackets OmniEngines
• NetFlow and sFlow
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 43

43. OmniPeek Network Analyzer
• OmniEngine Manager
– Connect and configure distributed OmniEngines/Omnipliances
• Comprehensive dashboards present network traffic in real-time
– Vital statistics and graphs display trends on network and application
performance
– Visual peer-map shows conversations and protocols
– Intuitive drill-down for root-cause analysis of performance bottlenecks
• Visual Expert diagnosis speeds problem resolution
– Packet and Payload visualizers provide business-centric views
• Automated analytics and problem detection 24/7
– Easily create filters, triggers, scripting, advanced alarms and alerts
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 44

44. Omnipliance Network Recorders
• Captures and analyzes all network traffic 24x7
– Runs our OmniEngine software probe
– Generates vital statistics on network and application performance
– Intuitive root-cause analysis of performance bottlenecks
• Expert analysis speeds problem resolution
– Fault analysis, statistical analysis, and independent notification
• Multiple Issue Digital Forensics
– Real-time and post capture data mining for compliance and troubleshooting
• Intelligent data transport
– Network data analyzed locally
– Detailed analysis passed to OmniPeek on demand
– Summary statistics sent to WatchPoint for long term trending and reporting
– Efficient use of network bandwidth
• User-Extensible Platform
– Plug-in architecture and SDK
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 45

45. Omnipliance Network Recorders
Price/performance solutions for every application
Portable Edge Core
Ruggedized Small Networks Datacenter Workhorse
Troubleshooting Remote Offices Easily Expandable
Aluminum chassis / 17” LCD 1U rack mountable chassis 3U rack mountable chassis
Quad-Core Xeon 2.5GHz Quad-Core Intel Xeon Two Quad-Core Intel Xeon
X3460 2.80Ghz E5530 2.4Ghz
4GB RAM 4GB RAM 6GB RAM
2 PCI-E Slots 2 PCI-E Slots 4 PCI-E Slots
2 Built-in Ethernet Ports 2 Built-in Ethernet Ports 2 Built-in Ethernet Ports
500GB and 2.5TB SATA 1TB SATA storage capacity 2TB SATA storage capacity
storage capacity
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 46

46. TimeLine
• Fastest network recording and real-time statistical
display — simultaneously
‒ 11.7Gbps sustained capture with zero packet loss
‒ Network statistics display in TimeLine visualization format
• Rapid, intuitive forensics search and retrieval
‒ Historical network traffic analysis and quick data rewinding
‒ Several pre-defined forensics search templates making
searches easy and fast
• A natural extension to the WildPackets product line
• Turnkey bundled solution
‒ Appliance + OmniEngine, OmniAdapter, OmniPeek Connect
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 47

47. TimeLine
For the most demanding network analysis tasks
TimeLine
10g Network Forensics
3U rack mountable chassis
Two Quad-Core Intel Xeon 5560 2.8Ghz
18GB RAM
4 PCI-E Slots
2 Built-in Ethernet Ports
8/16/32TB SATA storage capacity
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 48

48. WatchPoint
Centralized Monitoring for Distributed Enterprise Networks
• High-level, aggregated
view of all network
segments
– Monitor per campus, per
region, per country
• Wide range of network
data
– NetFlow, sFlow, OmniFlow
• Web-based, customizable
network dashboards
• Flexible detailed reports
• Omnipliances must be
configured for continuous
capture
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 49

49. WildPackets Key Differentiators
• Visual Expert Intelligence with Intuitive Drill-down
– Let computer do the hard work, and return results, real-time
– Packet / Payload Visualizers are faster than packet-per-packet diagnostics
– Experts and analytics can be memorized and automated
• Automated Capture Analytics
– Filters, triggers, scripting and advanced alarming system combine to provide
automated network problem detection 24x7
• Multiple Issue Network Forensics
– Can be tracked by one or more people simultaneously
– Real-time or post capture
• User-Extensible Platform
– Plug-in architecture and SDK
• Aggregated Network Views and Reporting
– NetFlow, sFlow, and OmniFlow
Your Applications Are Distributed – How About Your Network Analysis? © WildPackets, Inc. 50

50. Q&A
Show us your tweets!
Use today’s webinar hashtag: Follow us on SlideShare!
Check out today’s slides on SlideShare
#wp_distributed www.slideshare.net/wildpackets
with any questions, comments, or feedback.
Follow us @wildpackets
© WildPackets, Inc. www.wildpackets.com

51. Thank You!
WildPackets, Inc.
1340 Treat Boulevard, Suite 500
Walnut Creek, CA 94597
(925) 937-3200
© WildPackets, Inc. www.wildpackets.com