Untitled Document
In today's IT-driven organizations, network performance is key to providing
excellent customer experiences, driving business process efficiencies, growing
revenue, and maintaining competitive advantage. Network administrators charged
with keeping networks responsive to the needs of both internal and external
customers rely on network monitoring tools for a continuous stream of information
to baseline and assess the network's health. These tools enable administrators
to ensure high application availability and good response times, enforce network
usage policies, and measure the impact of network upgrades.
Most network monitoring tools are task-specific, high-performance software
packages running on PC or server hardware. Network administrators can choose
from an array of monitoring tools ranging from open-source host-based software
tools to sophisticated hardware appliances and platforms. Proprietary boxes
sold as "appliances" may consist internally of standard hardware components
running proprietary software, often based on the Linux operating system. The
performance of these tools is determined by the speeds of the processors and
memory buses, and the size of the memory utilized both for caching and for buffering
packets from the network. The performance of the network interface cards (NICs)
is obviously critical, too, for monitoring high-bandwidth 10 Gbps and faster
network links. More advanced tools help alleviate these bottlenecks by adding
more processors and more dedicated buffers, typically using standard integrated
circuit (IC) components on custom-designed boards with proprietary architectures.
The highest performing tools go one step further, using custom-designed application-specific
integrated circuits (ASICs).
When faced with monitoring tools that are reaching their performance capacity,
several avenues of remediation exist. If the monitoring tool runs on standard
hardware, upgrading it with additional memory or faster NICs and processors
may be a quick and relatively inexpensive fix. Also, the vendor may have newer
software releases that provide faster throughput and newer features that satisfy
a particular situation. In many cases, two monitoring tools can run alongside
each other, doubling the amount of data that can be captured. For example, one
tool can process the TCP traffic while another one handles ICMP and UDP packets;
or each tool can capture flows from different IP address pairs. This approach
has the advantage of having no learning curve, because users already know how
to operate the equipment. In addition, it provides redundancy in case one tool
breaks, and the tools can be deployed separately when they aren't needed together.
On the downside, this approach may not fit into the budget or architecture.
It may also create issues around seeing an integrated view of the traces from
both the tools.
-1-