Author Archive: Denny K Miu
Posts:
Jul 25th, 2007 | Denny K MiuIn the same spirit as Gigamon University and the Interop SpyNet Showcase, a vendor neutral Blog site, LoveMyTool, has been launch “dedicated to customer testimonials and expert reviews of their favorite ‘out-of-band’ network security and performance monitoring tools”.
Many of the contributors are also sponsors of InteropSpyNet, SpyNet Showcase and InteropLabs and as such, LoveMyTool is a logical extension if not an integral part of the greater Interop community.
Enjoy.
Denny K Miu
Gigamon Systems
Scott Haugdahl is the CTO of WildPackets (Booth #1966), a manufacturer of network and application assurance solutions and a sponsor of SpyNet Showcase. Today we have a chance to chat about his background and his vision for his company.
 |
| Interop SpyNet Showcase May 2007 |
SpyNet Showcase is the first event in the history of Interop where state-of-the-art equipment from all major network analysis vendors are racked together in one vendor-neutral location (outside of the NOC) and receive identical copies of show traffic, allowing individual sponsors to demonstrate live performance of their monitoring products at their own booths.
This year we have started a brand new feature which is the Interop SpyNet Showcase, a unique vendor-neutral booth (Booth #150, located next to iLabs) where any exhibitor can receive copy of live traffic from the NOC in order to showcase their best-of-breed solutions for out-of-band security and performance monitoring. SpyNet Showcase complements the InteropSpyNet which continues to be an integral part of InteropNet (NY 2006 and LV 2006).
The following are product podcasts by a few Showcase sponsors.
- FireEye (Booth #1106) - Crimeware Eradication
- NetScout (Booth #549) - nGenius Application Fabric Monitor
- Network General (Booth #531) - Sniffer Technology
- Network Instruments (Booth #1275) - Retrospective Analysis
- WildPackets (Booth #1966) - Network and Application Assurance
These and other podcasts are available at the Gigamon University PowerCast Series.
Denny K Miu
Gigamon Systems
Part 1: SpyNet Showcase
Part 2: Spy vs Spy
Part 3: SpyNet and Entrepreneur (J. Scott Haugdahl of WildPackets)
Douglas Smith is the Co-Founder and President of Network Instruments (Booth #355), a manufacturer of network monitoring solutions. Here’s an interview with Smith.
Kenny Frerichs is the CEO of Network Physics (Booth #455), a manufacturer of application performance management systems. I sat down with him to get more information about his company and what they have planned for the show.
SpyNet is a COMMUNITY.
Engineers working for competing vendors come together twice a year to build SpyNet, which arguably is the World’s largest temporary out-of-band passive monitoring network, in order to support InteropNet (the network) and Interop (the venue). Collaboration trumps competition since the greater good is for everyone to have an equal opportunity to showcase their best-of-breed products.
Customers demand best-of-breed products — no single vendor can cover all aspects of passive network monitoring which range from VoIP, IPTV, security, intrusion detection, access control, compliance, application performance, web experience, network discovery, troubleshooting, optimization, forensics and deep packet inspection, etc.
Since September 11th, passive network monitoring has become a growth industry, judging by the increasing number of monitoring vendors exhibiting at Interop. In this SpyNet Blog, we shall showcase product presentations by four Interop participants which for years have been sponsors of InteropNet, InteropLabs and other Interop events.
Note: these video presentations are encoded in Enhanced Podcast format which requires the installation of QuickTime. If you do not wish to install QuickTime (which is available free for Windows), you can listen to the audio portion and download the PDF.
Recent poll shows that a majority of Americans have accepted the current altered state of reality as the “New Norm”. Many Americans also mourned that after five years, causalities unfortunately have included erosion on our personal liberty, presumption of innocence, willingness to engage in open dialog for fear of being incriminated as unpatriotic and most importantly, the lost of our collective will to mandate adequate “checks and balances” between our branches of government.
The world of networking has changed as well.
I dropped by the warehouse late Friday afternoon and found Padre working alone packing up equipment and Val laboring inside her cubicle trying to catch up on emails. Brian has just left for the airport (without any liquids, I hope) and Glenn is taking a few hours off after two non-stop weeks.
On the way home, I started to think.
These people are crazy. To say that they are tribal warriors is too simplistic of a compliment. I understand dedication and I understand professionalism. But seeing Val returning to work so soon and her complete determination to not let the team down was too emotional for me. So I suspect there is something more.
I am a startup guy. I really like building companies and selling sh*t that I don’t have. I enjoy meeting smart people with high integrity and principled work ethnics, and finding ways to align everyone’s interest so that we can take an improbable dream and turn it into something real. In the process hopefully make some money and bring some constructive changes to our World.
Like Padre, Val, Glenn, Brian and the rest of the gang, I can’t explain why I do what I do neither except to say that I personally have accepted it as a disease. I do know that I truly enjoy the process of building. But I also know that it is a therapy. I suspect all crazy people do what they do because it is their way of maintaining sanity by picking and choosing an environment where they can exert some control over an even crazier World that is increasingly beyond their control.
So it is a choice. It is the only choice. And we all choose.
In any case, hotstage is over and summer is about to end. This is my fourth show and the level of “above-and-beyond” that I have witnessed here never ceases to amaze me and are much appreciated. I sincerely hope that even crazy people can now find time to enjoy their family, and most importantly, to take care of their health. There will be other Interops, but there is only one tomorrow (V, are you listening?).
Thanks, guys.
–Denny–
It is with great honor that we wrap up this series of Blogs with an interview with Neal Allen, TAC Level 3 Escalation Engineer at Fluke Networks, a long time veteran of InteropNet, both as a member of the NOC team and also a corporate sponsor.
Q: Neal, in this series of Blog, I try to trace back the steps of InteropNet and SpyNet and also the people who worked hard to make this event a reality. From the horse’s mouth, why did we need SpyNet to begin with? What was InteropNet like 10 years ago? I am going to truncate it to 10 years, if you don’t mind. I know you go back further than that.
A: In a twisted sense, the “old network” was much more fun. Yes, we were sometimes in the convention center for upwards of 20 hours per day for many days before the show opened, but it was so cutting edge we are still bleeding years later. There were times that the compile time stamp (not date) in the router code was some fifteen minutes before the show opened. It was an exciting time. The name of the show “Interop” was selected to portray the interoperability possible with the then generation of technology, which often didn’t play well with others. To accomplish this we usually had the development engineers from the various router and switch vendors sitting side by side with development platforms compiling new code all week to force the switches and routers to work together. Imagine the development engineers from 3COM, Wellfleet, Proteon, etc., all elbow-to-elbow trying to discover why the frame didn’t make it. This show single-handedly contributed significantly to the possibility for multi-vendor networks to operate.
But back to the Spy Network …
Because the show is distributed fairly widely over the convention center, and because we don’t have the luxury of telling the user to “just wait a few minutes”, we instituted the Spy Network to permit the NOC staff to have a media-level link to any part of the network. This was deployed using a parallel cable plant to avoid single-points-of-failure. In Telco terms, we didn’t have to roll a truck. This permitted us to see MAC layer errors and traffic from anywhere without leaving our comfy chairs in the NOC. At the time this was deployed it was pretty revolutionary. These days people set up management VLANs to accomplish similar things, but that does not provide the same level of access, and it goes through the same trunk links as the user traffic.
Of course, due to the nature of the network, there were as many as sixteen parallel networks to deal with, so Spy was in constant use and the biggest problem was determining which protocol was coming out of the link so that you connected the right analysis tool. We used the latest bleeding edge technology as the primary network transport, but always had one or two tried-and-true backup technologies just in case.
Q: That’s great stuff. So over the last ten years, what happened to networking and what happened to network troubleshooting and monitoring?
A: When I first started with the Interop network it could be described as large broadcast domains separated by a few routed connections. That made it very easy to diagnose with a traditional protocol analyzer. Today’s network is entirely switched, and is exceedingly difficult to monitor and troubleshoot. It isn’t good enough to monitor an uplink any longer. As with a typical corporate network we are now faced with having to determine where to start. Only we have a few Alpha or Beta products in exhibitor booths which may or may not be working correctly at this first unveiling, which the normal corporate network usually does not experience.
* Is it the client data?
* Is it routing?
* Is it a loop or alternate path between a VPN to the corporate network and the normal path out of our network?
* Is it traffic from another exhibit?
* Is it some form of virus or Internet based attack?
* Is it the network protection (authentication or firewalls) within our network?
* Is it marginal or faulty cable? Or over saturated wireless…
* Is it a marginal or failed hardware element in our network?
* Is it a Beta product which does not yet operate correctly, but is being introduced at the show?
and so on.
The current trends toward converged networks, and toward having more intelligent switching products, I am seeing a huge need for the diagnostic tool vendors to be even more creative than the product vendors in inventing a few new methods for monitoring the network and for unearthing increasingly more exotic problems. I am not sure what direction that will take, but the need is evident.
Q: Now the big question. What’s next for Spynet and monitoring? What do you see as the big breakthrough going forward?
A: This show has recently been using tapping technologies which are as complex as the switch/routers being monitored. That is a large step in the right direction, but it isn’t enough. I think we will have to get “inside” the switch/router itself and interact with the configured intelligence of the box itself in order to make the next leap forward in monitoring. However, we will still need to see the resulting data stream in and out to both double-check on the box, and to offer adequate monitoring, alerting, and protection.
The Spy Network is needed as much as ever before, perhaps more so. Otherwise how will you know when the switch itself becomes confused? But it will be partnering with “inside the box” monitoring and diagnostics sometime soon.
Thanks, Neal. You have been an inspiration for all of us. And I am sure I will see you again in New York.
Denny K Miu
Gigamon Systems
Part 1: InteropNet - Tribal Customs and Best Practices
Part 2: History of SpyNet (Son of LAN-Hopper)
Part 3: Interop*Spy*Net
Part 4: SpyNet and Network Physics
Part 5: SpyNet and Internap
Part 6: SpyNet and Neal Allen
