Riverbed SteelCentral vs. Fluke Networks

Transcription

1 Riverbed SteelCentral vs. Fluke Networks BREADTH OF FUNCTIONALITY, DATA FIDELITY AND SCALE FLUKE CAN T MATCH All things performance management The performance management market covers a broad range of user audiences and corresponding technologies. Often boiled down to a few key silos, these typically include: Network mapping Show me everything on the network Service mapping Show me all the systems and their dependencies required to deliver a service Fault management Tell me if a node is up or down and what is its utilization Network management Tell me if the network is impacting application performance End-user experience Show what the user experiences interacting with the application Code internals Highlight within my application code where I am bottlenecking One strategic differentiation of Riverbed over Fluke Networks is our ability to address all of the above technologies within our portfolio. Only Riverbed can address all of the use cases and demands of IT in the performance management arena. The legacy approach of mixing performance tools from different venders simply continues the finger pointing cycle within IT, and leaves users and the business to suffer. Data Fidelity Both Riverbed and Fluke make claims about capturing 100% of the data, not topping the datasets collected and keeping that data for a long duration, however the headlines don t tell the entire story. SteelCentral operates at a higher fidelity showing 11 metrics per connection, while Fluke is only working with three, creating the obvious delta shown in Figure 1. By decomposing a connection across a greater number metrics, a problem can be pin pointed with greater accuracy and speed. Riverbed reports on connection setup, server response, data transfer, network RTT inbound, network RTT outbound, retransmisison delay, user response, connection failures, application turns, server reset rate, and packet payload size. Fluke only reports on application response, data transfer, and network round trip time. RIVERBED ADVANTAGES Broadest portfolio in the industry. Addresses all aspects of performance management Riverbed Performance Platform Riverbed delivers technology to diagnose problems as well as to cure them Understanding web page performance, not just object load times Visibility into Citrix, SDN and virtualized deployments Mobile device and cloud monitoring Leverages distributed packet capture with Steelhead appliances and host agents Line rate packet capture in the data center with storage >250TB Sponsor of Wireshark, building atop user's existing expertise Discovery and dependency mapping identifies all the services necessary to deliver an application Combines multiple flow and packet records for an accurate, single, end-toend view of traffic WAN optimization friendly, requiring no extra hardware or configuration for reporting R1.5

2 Figure 1. Fluke only reports on three metric per connection while Riverbed SteelCentral reports on 11, clearly providing greater granularity for faster diagnosis. Data Retention Retained data is always bumping up against capacity limits; however Riverbed offers three options to help the situation: Greater Raw Capacity Riverbed solutions offer up to 264TB of storage per appliance, while Fluke maxes out at 48TB Keep the most important data the longest Riverbed keeps critical alarm/forensic data even longer o Archive buffer is separate from main capture buffer o Ability to auto archive trace-clips based upon alert conditions o Ability to automatically filter/save a capture based on the time and associated IPs SAN offload Riverbed can store connection summary records (everything but the payload) on SAN for infinite duration. Capacity planning, anomalous events, trending and fault isolation can all be managed from this data set. Figure 2. SteelCentral AppResponse provides a separate archive buffer that enables you to keep critical alarm/forensic data longer. Speed How fast is your appliance vs. mine? Even a short question can have a lengthy answer. Speed as a metric can be applied against numerous dimensions in the performance management market. Speed writing packets to disk SteelCentral s largest appliance captures 100% of the packets at 10Gb/s, the same rate that Fluke offers. Speed doing real time packet analysis SteelCentral s largest appliance operates at 20Gb/s for real-time analysis, while at the same time maintaining the 10Gb/s stream to disk. Fluke does not offer similar real-time analysis capabilities, but in no case is working faster than 10Gb/s. Operational workflow speed - Speed accessing stored packets, manipulating large capture files or drilling down from dashboards to packets. These are all real world situations that matter tremendously to operations teams. Riverbed is deployed in the largest financials, government agencies, healthcare organizations, learning institutions and across more than 25,000 customers, precisely because workflow speed is so important. 2

3 SNMP Granddaddy of network monitoring, SNMP still plays a vital role in fault management and isolation as well as network discovery. While just a small component in the SteelCentral portfolio, Riverbed leverages SNMP to the fullest with support for custom MIBs and workflows for network/topology discovery, system (PC, server, router, phone, UPS ) health and availability, router interface errors, IPSLA, selenium testing and more. Fluke however offers only basic SNMP functionality for 1) discover all the nodes on the network and 2) poll for basic health stats only. Citrix and VMware View Citrix or VMware, Riverbed has you covered. Riverbed offers a litany of technology support here that Fluke lacks. This includes the ability to stitch a thin client connection front to back across a Citrix sever, to extract out the Citrix user names, to break down each of the inner Citrix ICA or VMware PCoIP inner transport channels, and to examine Citrix s own real-time EUE metric which is part of the protocol. Fluke doesn t offer any of this. It s a Web page, how can you not know that? It s a simple concept. A web page is the combination of numerous web objects. Text, graphics and on-demand web content are each typically present numerous times across a given web page. Riverbed.com for example contains more than 20 web objects, all of which together represent the single home page. Fluke however does not understand the notion of a web page, and is only able to report on the network performance of individual objects. SteelCentral, however, understands both a page and its sub-objects. Performance can be reported and benchmarked at the page level, the way users experience it, while triage can quickly show which objects are performing poorly. Figure 3. Riverbed monitors a web page and its objects. Fluke can only monitor objects. It does not understand what a web page is. The user crossed a proxy Proxies for both inbound and outbound access to websites are a de facto component of today s network. But a hidden pain of proxies is that they remove the originating users IP# and replace it with their own. SteelCentral can dig into the HTTP header, read the X-Forwardfor (XFF) field to determine the originating IP# and restore that visibility that would otherwise be lost. Fluke lacks any similar capability. SSL Decryption If you were to make a list of the most prominent protocols on the network, HTTPS (HTTP traffic that is SSL encrypted) would certainly be in the top 5, if not the top 2. Riverbed, with the appropriate encryption keys and password permissions, supports decrypting and monitoring of SSL encrypted traffic, while Fluke does not. Fluke may point buyers to external hardware decryptors, however these leave sensitive data in the clear both on the network and stored on disk in the capture appliance. Not only is this not a best practice, but it is a violation of numerous industry and government regulations, including the PCI DSS (credit card regulations) and HIPAA (healthcare regulations). 3

4 Superior workflow Lots of data and metrics are great for white paper fodder, but turning them into operational value can be challenging. Riverbed offers numerous operational integrations and workflows that let engineers get to the root of a problem faster and with less senior resources. Switch port discovery - SteelCentral integrates with switches to show which physical port a client or server is plugged into. This data is presented alongside IP addresses and application names, reducing operator burden and speeding time to resolution. Fluke has no similar integrations, and places the burden on operators to determine the relationships between network interfaces and key business-level entities like servers. Mapping > Analytics > Dashboard Monitoring tools tend to fail not because they don t work, but because they aren t monitoring the right things and/or have not kept current with changes to the deployment. SteelCentral delivers a unique workflow that guides operators through discovering a service, configuring its monitoring and then populating the results on a dashboard. By creating this closed loop workflow operators can easily maintain the SteelCentral system to a level not possible with Fluke. A service mapping wizard ensures complete coverage - Successful management of application delivery depends on understanding all the critical service dependencies. SteelCentral uses its whole-network understanding to identify and plot dependency relationships among the many elements that support the delivery of complex scalable enterprise applications. Its dependency information is based on real-time data collected from the running infrastructure, without any need for additional instrumentation, scanning, or agents. Fluke has neither automated nor manual service discovery capabilities. Fluke will often mention network mapping, however this layer-2 node discovery is not at all the same as SteelCentral s layer-7 service dependency map. An end-to-end data model ensures accurate understanding - The starting point for assessing end-user experience is having a single accurate record for each conversation across the network, both client/server and server/server. SteelCentral builds this end-to-end model based on gathered flow data (NetFlow, IPFIX, Sflow ) correlated and de-duplicated across all flow sources and annotated with information gathered from limited, strategically placed capture appliances, providing performance metrics, layer-7 application identification, TCP health, and optimization data. In contrast, Fluke doesn t understand how to reconcile or de-duplicate different versions of the same conversation as reported by different devices. This creates an inferior data set, leading to sub-par monitoring. Behavioral analytics enable scale - Behavioral analytics are a key technology for enabling operationally realistic and cost-effective monitoring. Removing the labor-intensive and continual process of manually baselining performance metrics make analytics more accurate and less time consuming than the legacy approach of thresholds. SteelCentral uses a wizard to help users discover and map a service, and then with a few mouse clicks deploys analytics to monitor each WAN and LAN circuit, as well as server connectivity. Dozens of analytics monitoring network round trip time, bandwidth utilization, resets, retransmits and more can be configured and operational in minutes. More than just a feature, analytics are embedded in the workflow of SteelCentral and have been for over a decade. Fluke lays claim to some baselining capability, however with an inferior data set as input, and no automated workflow to discover services and then configure analytics to them, users risk excessive false positives, and worse, false negatives. Software Defined Networks SDN is transforming how network connectivity is provisioned and how traffic flows across those networks. While short time to value and cost savings is driving rapid adoption, legacy monitoring tools such as those from Fluke are unable to offer troubleshooting help. SteelCentral is at the forefront of these technologies, and understands VMware s VXLAN and NSX-enhanced flow data, as well as how to properly parse VXLAN and NSX-encapsulated traffic on the wire. Fluke simply doesn t have a solution here. Data correlation When troubleshooting we are often not sure what we are looking for, but we know it when we see it. Troubleshooters are keenly aware of the importance of separating cause from effect. It is for just this reason that engineers examine multiple data points before drawing a conclusion. To aid this workflow Riverbed allows a single graph to correlate and combine any metrics and groups them to assist with troubleshooting. Fluke, on the other hand, only offers limited out-of-the-box graphing capability, and requires operators to generate multiple reports and combine them side by side to spot correlated data. 4

5 Figure 4. Riverbed provides a single graph showing combined metrics, making it easier to draw conclusions about cause and effect. Fluke is unable to combine arbitrary data sets and is forced to draw multiple graphs. Capture packets anyplace Sometimes being instrumented in the data center isn t the right place. Sometimes you need to see the packets as the end user or the server is seeing them. Numerous situations demand this from performance problems to security forensics. Servers and end users - SteelCentral has capture agents available for PC, Mac and *NIX systems. These agents can be remotely controlled to stop and start captures, and the data can be encrypted and transmitted back to HQ for analysis. Riverbed Steelhead appliances - Users no longer need to purchase expensive dedicated hardware to perform packet capture outside the datacenter; rather they can leverage their existing Riverbed SteelHead WAN optimization investments for both real-time visibility and packet capture. Fluke lacks flexibility in how and where it captures packets. Third-party website monitoring It is increasingly common for production websites to be hosted at a third-party facility, but management still expects timely business and performance metrics. This is yet another area where Fluke leaves users without a solution. SteelCentral, however, leverages JavaScript injection to provide end-to-end performance metrics regardless of where the solution is hosted. This technology breaks down performance across the connection, enabling fast problem isolation. Riverbed s vision and technology lead doesn t stop here While this paper has discussed some of the technological advances that Riverbed SteelCentral has over Fluke Networks in the area of network-based performance management, it only scratches the surface of solutions Riverbed offers across the performance management spectrum. Other complementary SteelCentral products address the unique needs of: End-user experience management Network modeling and simulation What-if analysis Expert system diagnostics Voice and video monitoring Application code analysis and transaction tracing and more 5

6 Riverbed SteelCentral uniquely detects and fixes problems before end users notice Riverbed SteelCentral Performance Management is the only performance management suite that combines enterprise-class end-user, application and network performance management in one solution. Riverbed delivers visibility, analytics and insight empowering companies to detect and fix application performance issues before end users notice a problem, call the help desk to complain, or jump to another Web site out of frustration. Riverbed SteelCentral drastically reduces the time and effort required to develop, deploy and ensure application performance. Its solutions are leveraged throughout today's rapid application lifecycles and across IT operations and development teams, providing a centralized and common solution to maximize efficiency, performance and productivity in today s application driven world. Riverbed SteelCentral is a key element of the Riverbed Application Performance Platform Riverbed SteelCentral is part of the Riverbed Application Performance Platform, the most complete platform for location-independent computing. The Riverbed Application Performance Platform is a set of integrated solutions that give companies the flexibility to host applications and data in the locations that best serve the business while ensuring the flawless delivery of those apps to better leverage global resources, radically reducing the cost of running their business and maximizing employee productivity. Companies running on the Riverbed Application Performance Platform ensure applications perform as expected, data is always available when needed, and performance issues are detected and fixed before end users even notice. About Riverbed Riverbed Technology is the leader in Application Performance Infrastructure, delivering the most complete platform for location-independent computing. Location-independent computing turns location and distance into a competitive advantage by giving IT the flexibility to host applications and data in the most optimal locations while ensuring applications perform as expected, data is always available when needed, and performance issues are detected and fixed before end users notice. Riverbed s 24,000+ customers include 97% of the Fortune 100 and 95% of the Forbes Global 100. Learn more at Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners. 6