Is it the app or the network?
The question asked many times by NetOps, SecOps, management, everyone, anyone! On the surface, this should be a simple question to answer, but up until now, it's been a challenge to get a concise human answer. In our latest release, IBM SevOne Network Performance Management (NPM) v6.6 introduces application awareness and enrichment, exciting new functionality that enables us to quickly and easily answer once and for all 'What is happening on my network?'. I'll dive into this in more detail later, but first, let’s understand the business drivers around application-aware monitoring and the current monitoring challenges and gaps that legacy tools present.
Arghh Apps!
Apps! Oh my word, so why are we starting with apps? I thought IBM provided a Network Performance Management solution. But if you think about it, from the moment you wake up, if you're like me, you grab your phone, check your e-mail, check the weather, look at the sports scores, check the news and your socials – all apps! Apps are app-solutly the center of our modern lives at work and at home.
Whether you're the technical genius providing the app service or the busy consumer, you need the network those applications are running on to be at peak performance. In a world where slow is the new down, your network performance solution needs to answer the question, what apps are being used? And more importantly, how are they performing?
Keeping you connected to the applications making your and my life a lot easier is why I'm excited to introduce our latest release. Not only are we continually working towards helping you better understand what’s happening on the network, but IBM SevOne NPM is further evolving to an application-centric, hybrid cloud, network observability product.
But what's wrong with my current tools?
You might be thinking, Hey Rupert, I already have lots of tooling that tell me what is happening on my network, don't I? You probably do, but let's take a look at the pros and cons of two of the most common network traffic monitoring solutions – probes (TAPs and SPANs) and NetFlow (v5/v9, IPFIX, sFlow, cFlow) and see where IBM SevOne NPM is raising the bar.
Probes (SPANs, TAPs, packet brokers, deep packet inspection)
Network probes have always been the 'gold' standard for network monitoring - usually deployed at various pinch points in the network, you would deploy either a network tap inline or some form of SPAN or port mirroring. This deployment would take a one for one copy of the network packet and send it to another server or hardware appliance for decoding and monitoring purposes.
Typically, these devices would be large appliances with many terabytes (TB) of storage, recording 24x7, consuming vast quantities of rack space and energy, and sometimes costing as much as a sports car! The high cost and environmental requirements mean that these solutions are typically confined to a central data center location. Recently more flexibility has been possible with network packet brokers or matrix switches, extending the tentacles of monitoring to a wider part of the data center.
Entering from stage left, the cloud. Now, what's happening with your data center? We are on the march to a hybrid cloud world where workloads, connectivity, and applications are no longer confined to four walls. These legacy probes are just not compatible with this evolution.
NetFlow (v5/v9, IPFIX, sFlow, cFlow etc.)
If probes are the 'gold' solution, then NetFlow is the 'silver' option; potentially more accessible and cheaper to deploy, NetFlow utilizes existing routers and has them export a 'flow,' a record of each conversation passing through that device. These records can vary in content but, at minimum, are typically referred to as a 5-tuple - source IP address, destination IP address, source port, destination port and protocol such as TCP, UDP, and ICMP, etc.
So now we have an 'audit log' of conversations on our network - I should be able to tell what’s happening, right? Well, the downside to all of this is that it's still just a bunch of IP addresses and a lot of HTTPS traffic on port 443. But everything runs on HTTPS these days, so what’s happening under the hood? With context, it's easier to tell if that conversation is business critical applications like Office365, Webex and Zoom or network bandwidth hogs like Netflix. How do I get to the next level of detail?
How does IBM SevOne NPM v6.6 help me understand what is happening on my network?
Our latest release introduces a great new feature - automatic SaaS application identification, enrichment, and grouping for NetFlow traffic. For the first time, SevOne NPM can qualify traffic beyond ports and protocols, helping you understand if it's Dropbox, Disney or Discord using bandwidth on your network.
We can then take the NetFlow that you’re sending to IBM SevOne NPM today and enrich it with application names and categories sourced from our proprietary database of nearly 5000 SaaS-based applications and infrastructure information. This categorization allows you to understand not only which application but the purpose of that application. Answering the question, is the traffic on my network related to infrastructure, storage or collaboration tools, for example? Or is it Social Networks?
SevOne NPM can also enrich with the network autonomous system (
This feature ships enabled as standard with our 6.6 release; no configuration is necessary, no TAPs, no SPANs, no deep packet inspection, no router changes - simple!
Finally, while we know a lot about internet applications, IBM SevOne NPM respects your privacy and doesn't have access to your private or internal applications; however, we have made this feature user extensible - you can add your application definitions to your local system, and we will enrich your reports with both the internet-based apps and your local apps providing an in-depth view of your network. Of course, there’s an API for this too!
I, along with the whole team are very proud to have worked on this feature and we hope it's power and simplicity will help you shine a light on what applications are in use on your network today.
This approach is, of course, a first step on our application-centricity journey - we have many more plans in this area, so continue to stay tuned and speak to your account team to learn more about this and the other great features in IBM SevOne NPM v6.6.
Want to build with us? Let us know what features you’re hoping to see in the future and drop us an
========================
Rupert Gregory
Principal Product Manager, IBM SevOne NPM
========================