Riverbed DATA SHEET
DATA SHEET: Continuous, high-speed packet capture, indexing, and storage Riverbed Cascade Shark appliance provides continuous, high-speed packet capture, indexing, and storage to ensure that packet-level information is always available for end-to-end performance monitoring and for granular, real-time and backin-time analysis. Deploy in three ways for maximum coverage dedicated appliance, virtualized software, or embedded functionality in Riverbed Steelhead WAN optimization products solutions allow organizations to:»» Accelerate application troubleshooting with fast retrieval and analysis of packet and transaction data»» Solve intermittent performance problems without having to recreate them»» Gain end-to-end visibility with continuous export of application-enhanced metrics to the Riverbed Cascade Profiler console»» Accommodate any monitoring requirement with flexible storage capacity options Overview Riverbed understands packet capture and analysis better than any other company. Three leading innovators in this field Steve McCanne, co-creator of TCPDUMP, Loris Degioanni, creator of WinPcap, and Gerald Combs, creator of Wireshark software continue the advancement of Riverbed application-aware network performance management (NPM) solutions that today s leading enterprise and government organizations rely upon for their IT performance needs. When business-critical applications fail, the impact can be serious. Today s IT operations and management teams need to be one step ahead with real-time, actionable information to identify and diagnose problems before the business is impacted. products not only alert on issues, but can also help diagnose where the problem is and what s causing it. products provide rich visibility and information about application and network performance to enable smarter decision-making and faster, easier problem diagnosis. products are typically deployed wherever detailed real-time and historical analysis is needed, such as within the data center, headquarters or key branch offices. They can be used as an integral part of the complete Cascade visibility solution or as a standalone troubleshooting solution. Comprehensive, application-aware NPM Businesses that need enterprise-wide visibility into network and application performance should turn to the Cascade applicationaware network performance management suite. The Cascade product family enables proactive monitoring and troubleshooting of application and network performance, automated discovery of applications and their dependencies, and delivers a consistent and reliable end-user experience. products are an integral component of the Cascade product family. They export summarized metrics derived from the packet data to the Cascade Profiler appliance for advanced behavioral analysis, monitoring, reporting, and alerting on application performance. Because the metrics from products are deduplicated and integrated with flow-based data from other sources and stored in the same logical record, IT operators can streamline the troubleshooting workflow and accelerate the triage process.
OPTIMIZED BRANCH Embedded functionality on Steelhead DATA CENTER Virtual Edition Steelhead NON-OPTIMIZED BRANCH WAN VXLAN Virtual Edition P Cascade Profiler Figure 1: products provide both packet capture and storage, and send application-enhanced metrics to Cascade Profiler appliances for centralized analysis, monitoring, reporting and alerting. The Cascade Pilot software analysis console provides direct access to packet-level details for back-in-time forensic analysis. products are available in three species: appliance, Virtual Edition software, and embedded Shark functionality on Steelhead WAN optimization products. Key benefits Whether deploying appliances, Virtual Edition, Steelhead appliances running embedded Cascade Shark functionality or any combination, the product family monitors and troubleshoots complex or intermittent performance and security-related problems, without having to transfer large files across the network. By continuously recording the packets traversing the network, rich troubleshooting details are always available when the IT staff needs them. As a result, the product family saves time and money by helping IT troubleshoot problems faster, minimizing the effect downtime has on business productivity by reducing or avoiding business-stopping slowdowns or outages. It also enhances IT productivity by avoiding lost time waiting for problems to reoccur. I am not sure how the folks at Riverbed are indexing their traces, but it is night and day faster than anyone else. I cannot begin to tell you how much time this saves especially when on a high pressure conference call with people breathing down your neck wanting to know what the problem is. Riverbed Cascade, keep it coming! Mike Canney, Principal Network Analyst, getpackets.com
DATA SHEET: species products deliver scalable, high-performance packet capture, rapid indexing, and long-term storage, enabling real-time and back-in-time forensic analysis and reporting of network and security events across physical and virtual environments. species passively and non-intrusively monitor key network links to provide greater visibility into network-based application traffic. The product family consists of three species: appliances, which provide dedicated, continuous packet capture at 1GbE and 10GbE line rates Virtual software, which provides simultaneous packet capture and flow export to monitor inter-vm within virtualized environments Embedded functionality on Steelhead appliances, which provides on-demand packet capture for remote site troubleshooting at no additional cost Continuous capture On-demand capture Packet indexing for fast analysis Flow export to Profiler Analysis by Cascade Pilot Monitor live traffic with views & watches Runs in virtual environment Cascade Shark appliances Cascade Shark Virtual Edition Embedded Shark on Steelhead ü ü - ü ü ü ü ü ü ü ü -* ü ü ü ü ü - - ü - Disk space 4TB to 32TB 50GB to 2TB 15GB to 119GB Supports real-time traffic (VoIP) ü ü - Table 1: Comparing the capabilities of the various species. *CascadeFlow export is performed by Steelhead appliance itself, not embedded Shark functionality. is a dedicated, continuous packet capture appliance capable of sustained line-rate, multi-gigabit per second recording, and storage of network traffic using high-performance 1Gb or10gb ethernet and/or 1Gb or 10GB fiber capture cards. appliances are available in five models: the entry-level CSK 1100, the mid-range CSK 2100 and 2200, and the high-end CSK 3100 and 3200. Size Appliances Storage NIC Slots CSK 1100 1U 4TB 1 CSK 2100 2U 8TB 2 CSK 2200 2U 16TB 2 CSK 3100 3U 16TB 2 CSK 3200 3U 32TB 2 Capture Cards 2-port 1GbE card, 4-port 1GbE card, or 4-port 1Gb SFP card Any combination of 4-port 1GbE card, 4-port 1Gb SFP or 2-port 10Gb SFP+ card Up to 2 NICs per system Table 2: appliances are available in a variety of models for deployment flexibility. Virtual Edition -VE is a software version of that has been virtualized to run on VMware ESXi environments. It taps into the virtual switch in an ESX hypervisor to monitor the performance of all inter-vm traffic. -VE software is unique in that it can simultaneously send summarized data to the Cascade Profiler appliance console for analysis and reporting and continuously capture, index, and store full packet data on the local server or on a storage area network (SAN) for back-intime analysis with Cascade Pilot software. -VE software can also be used to build your own packet capture appliance. Leverage any virtualized server running VMware ESXi such as an existing virtualized branch office server or a Cisco SRE blade on a Cisco Integrated Services Router (ISR G2) to gain cost-effective remote visibility. Monitor branch LAN traffic by spanning from the switch to the physical NIC on the server in addition to monitoring intra-server (VM-to-VM) traffic.
With -VE software, IT operations teams can restore visibility in their virtualized environments and benefit from: Continuous monitoring of interactions between virtualized applications within the same physical host Accurate, end-user experience metrics enabled by response time measurement Deep, retrospective analysis of server interactions using stored packets Baseline virtual environment traffic analysis to identify abnormal changes in performance Monitoring for security threats Because we capture and store all the traffic moving through our two primary data centers, we always have the information available whenever an application team reports an issue. When this happens, we go straight to Cascade to determine if anything abnormal was happening at the time. Cascade helps us quickly determine if it s a network, server or third-party issue. Network engineer, BlueCrest Capital Management Virtual Edition VSK-00050 VSK-00200 VSK-00400 Packet Storage Up to 50GB Up to 1TB Up to2tb Hypervisor VMware vsphere 4.1, 5.0 vcpu 2 Memory System Disk Space 2GB 30GB Capture Ports Up to 4 Cascade Pilot software is used to schedule and initiate ondemand capture jobs on the Steelhead appliances. Packet data is indexed and stored directly on the Steelhead appliance. Just as with the appliance, traffic is analyzed directly on the remote Steelhead appliance using Cascade Pilot software as the management and analysis console so that large trace files do not need to be transferred across the network. Trace files automatically appear in Cascade Pilot software under the appropriate Steelhead probe and TCPDUMP folder. Access to embedded is password protected so that only users with TCPDUMP permission on the Steelhead appliance can access the packet capture functionality. Management Ports 2 Table 3: Virtual software is licensed according to required storage space. Steelhead appliances with embedded functionality Steelhead products running RiOS 7.0 include functionality at no additional cost, enabling them to function as remote probes without affecting core WAN optimization capabilities. IT operations teams can leverage Steelhead appliances for remote site troubleshooting of the optimized WAN as well as local LAN, without having to deploy a dedicated probe or dispatch a technician.
DATA SHEET: Unique capabilities Some of the advantages that products provide over other packet capture and analysis solutions include: Multi-gigabit per second ethernet traffic capture appliances include Shark Packet Recorder, which is capable of continuous, reliable recording of multi-gigabit per second network traffic to disk. It s a customized dump-to-disk utility based on the 1GbE and 10GbE capture cards and a specially designed RAID-enhanced packet storage system. Business P2P Web Citrix Email VoIP Backup SSL SAP 192.168.1/2 172.16.1/24 172.16.2/24 10.10.10/24 Capture jobs SAP Business Apps 10.10.10/24 Retention time 30 days 5 days 5 days Distributed analysis Cascade Pilot software analyzes trace files directly on remote products, eliminating the need to export large trace files across the network for local analysis. Only the results of the analysis (called views ) are sent to Cascade Pilot software. Once the data has been refined and the packets of interest identified using the software, only that small subset of packets need be sent over the network to Wireshark for decoding. Distributed analysis also means that when the network is experiencing issues, Cascade is not part of the problem. Smart packet indexing Packet metadata, called microflows, provides efficient real-time indexing of packets. It enables users to quickly search terabytes of data and provides a seamless transition between flow-based information in Cascade Profiler and packet-level information in. Smart indexing of packets accelerates troubleshooting, reducing the time it takes to identify and diagnose complex performance issues. Selective recording The option to record all or just a portion of the packet payload is important for meeting compliance with many regulatory initiates, such as HIPAA or PCI DSS; it can also extend the amount of packet data that can be stored and the length of time it is available for analysis. Multiple capture jobs The ability to perform multiple, separate capture jobs on a species enables IT staff to dedicate different amounts of storage to each job to flexibly extend storage time for critical applications. For example, one capture job could dedicate a certain amount of the storage on a Cascade Shark appliance to recording a few days worth of traffic, retaining the entire packet header and payload for a business-critical CRM application. Meanwhile, a second capture job could use the remaining storage to store a week s worth of all other traffic, recording only the packet header. Precision time stamping appliances can adopt the precision time stamps from network tap aggregators for greater accuracy and for coordinated time stamping across the network and with other monitoring tools in a customer s environment. Precision time stamping is critical for low-latency Network Traffic Figure 2: and Virtual appliances can simultaneously record multiple capture jobs. Each job can capture specified traffic, selectively record the header and/or payload information, and store the data for varying amounts of time, as determined by the amount of storage dedicated to the job. trading environments or other time-sensitive applications and provides better accuracy for multi-segment analysis. Supported network taps include: Gigamon SMT-436 GigaSMART blade for the GigaVue-2404 cpackets cpacket cvu & ctap families (with Precision Timing module option) VSS Monitoring Distributed Traffic Capture Series system diagnostics Provides disk status, SNMP polling, and email alerting on device, disk, and management interface health, letting you know immediately in the rare event of a system problem. Sophisticated packet analysis with Cascade Pilot Cascade Pilot software is designed to seamlessly and securely connect with one or more remote products to enable rapid and simplified analysis of long-duration packet data. All of the features of Cascade Pilot are available in the distributed environment, including an extensive collection of views, drill-down analysis, retrospective visualization and analysis of long-duration traffic statistics, a flexible trigger-alerting mechanism, and simplified, professional report generation. Once connected, the interaction between Cascade Pilot software and products appear as if it were local. Wireshark integration Wireshark, the leading open source protocol analyzer, can be used to analyze trace files recorded by any product. Tight integration and seamless hand off from Cascade Pilot to Wireshark streamlines troubleshooting and takes advantage of the network staff s expertise with Wireshark without having to learn yet another approach.
Key features Mix 1GbE and 10GbE interfaces on the same appliance Modular and extensive storage options range from 4TB to 32TB Real-time microsecond alerting and microburst views for fine-grained analysis Ability to adopt precision time stamps from network tap aggregators. Supported network taps include: -- Gigamon SMT-436 GigaSMART blade for the GigaVue-2404 -- cpackets cpacket cvu & ctap families (with Precision Timing module option) -- VSS Monitoring Distributed Traffic Capture Series Capable of multiple concurrent capture jobs, each capable of sustained line-rate recording and flexible storage time for critical applications Smart file indexing accelerates packet analysis by up to 10,000x Uses a custom file system optimized for time-based queries Selective recording of all or a portion of the packets extends the amount of data that can be recorded and the length of time it is available for analysis Multi-terabyte packet recordings are represented as a single virtual file in Cascade Pilot to streamline in-depth analysis and traffic visualization Virtual Edition Monitors and troubleshoots virtual traffic on VMware ESXi host Storage options range from 50GB to 2TB Capable of multiple concurrent capture jobs, each capable of sustained line-rate recording and flexible storage time for critical applications Smart file indexing accelerates packet analysis by up to 10,000x Uses custom file system optimized for time-based queries Selective recording of all or a portion of the packets extends the amount of data that can be recorded and the length of time it is available for analysis Multi-terabyte packet recordings are represented as a single virtual file in Cascade Pilot to streamline in-depth analysis and traffic visualization Embedded on Steelhead On-demand packet capture and indexing Storage options range from 15GB to 119GB Requirement, Cascade Pilot 3.0 or later Smart file indexing accelerates packet analysis by up to 10,000x Selective recording of all or a portion of the packets extends the amount of data that can be recorded and the length of time it is available for analysis Requirement, RiOS 7.0 or later
About Riverbed Riverbed delivers performance for the globally connected enterprise. With Riverbed, enterprises can successfully and intelligently implement strategic initiatives such as virtualization, consolidation, cloud computing, and disaster recovery without fear of compromising performance. By giving enterprises the platform they need to understand, optimize and consolidate their IT, Riverbed helps enterprises to build a fast, fluid and dynamic IT architecture that aligns with the business needs of the organization. Additional information about Riverbed (NASDAQ: RVBD) is available at www.riverbed.com. 2005, 2006, 2007, 2008, 2009, 2011 Riverbed Technology 199 Fremont Street San Francisco, CA 94105 Tel: +1 415 247 8800 Fax: +1 415 247 8801 www.riverbed.com Riverbed Technology Ltd. One Thames Valley Wokingham Road, Level 2 Bracknell RG42 1NG United Kingdom Tel: +44 1344 401900 Riverbed Technology Pte. Ltd. 391A Orchard Road #22-06/10 Ngee Ann City Tower A Singapore 238873 Tel: +65 6508-7400 Riverbed Technology K.K. Shiba-Koen Plaza Building 9F 3-6-9, Shiba, Minato-ku Tokyo, Japan 105-0014 Tel: +81 3 5419 1990 2012 Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners. DS-CS10152012