May 3rd, 2006 |
The following is an interview with one of the sponsors of the InteropNet, in particular, a sponsor of the SpyNet, John Harriman who is a Senior Director of Marketing at Network Physics.
Q: John, I understanding that this is the second year that Network Physics is sponsoring InteropNet or SpyNet, can you talk about what your product does and why it is important for InteropNet and how it is ultimately interesting for the attendees of Interop?
A: Network Physics provides application management for the network team. Our appliance discovers all applications running on the network, then identifies network issues as fast as the network engineer can move their mouse. Our primary product feature, NetSensory Insights (point-and-click action guides that encapsulate best practices for the particular monitoring task at hand), is designed to pinpoint the source of a problem and quickly troubleshoot response time issues. This is useful to the InteropNet NOC team to discover network issues before they effect the quality of the event. It is interesting to the attendees because it gives them a quick insight into Interop networking issues that could also show up on their own networks.
Q: So what kinds of traffic are you interested and how do you bring that information back to your booth so that it can be presented to a live audience?
A: The NetSensory appliance in the NOC captures all IP traffic, TCP and UDP, flowing through the network. Normally, our product sits passively on the network attached via SPAN or mirror port or tap (no agents, no SNMP, no polling, no synthetic transactions). In the case of the InteropNet, the Gigamon switch is performing aggregation, multicasting and load-sharing so that we can share the traffic with other sponsors. Once we capture the traffic, analysis is performed and resulting metric is accessed via a Java-based console on the network engineer’s laptop back at our booth.
Q: Is there any similarity between what goes on at the InteropNet and what goes on at your typical customers’ data centers?
A: Yes, Denny. Admittedly the InteropNet is a bit of an “anything goes” network and more ad hoc than a typical customer data center, but customer’s networks are not immune to the challenges that appear here at the show. Two examples come to mind:
Inappropriate use of Bit Torrent or similar P2P applications can consume unreasonable amounts of bandwidth, leading to the premature impression that the network requires an increase in bandwidth when all that’s really called for is an email to the manager of the vendor involved.
Another example involves worms. Last year at Interop our “Worm Hunt” Insight detected the Blaster worm. Just a few clicks identified the source: a single computer at one exhibitor’s booth - probably a road warrior bringing in an infected laptop. Because it detects behavior common to all worms, rather than pre-programmed signatures, the network engineer can use it to catch day-zero infections, see at a glance which computers are infected and which computers they’re trying to infect.
Thanks, John, and look forward to see you again in New York.
Denny K Miu
Gigamon Systems
Part 1: InteropNet - Tribal Customs and Best Practices
Part 2: History of SpyNet (Son of LAN-Hopper)
Part 3: Interop*Spy*Net
Part 4: SpyNet and Network Physics
Part 5: SpyNet and Internap
Part 6: SpyNet and Neal Allen
