Retrospective network analysis has proven to be an irreplaceable networking tool, but analysis solutions are often costly and cumbersome and are stuck at headquarters while remote and branch offices suffer.
Network Instruments may have addressed this problem with the release of its first portable network analysis tool, the GigaStor Portable, a self-contained luggable box that can go pretty much anywhere for on-the-fly spot analysis of the network, applications and security forensics.
Designed for troubleshooting the network, the portable GigaStor uses the same retrospective network analysis as fixed GigaStor models. According to Charles Thompson, manager of sales engineering at Network Instruments, GigaStor Portable can be deployed to any remote location to collect and save up to week's worth of packet-level data, which it can decode, analyze and display. Using time-based navigation, network operations can sift through data, find the incident and see a detailed packet-level view before, during or after problems arose.
Thompson compared it to a networked version of TiVo, meaning it captures data as it traverses the network; then administrators can go back and find where a problem occurred. Typical troubleshooting involves learning of the problem, waiting for it to happen again or trying to re-create it, capturing packets, analyzing the problem, and finally solving it. GigaStor, conversely, allows users to go back to the occurrence of the problem, skipping several steps in the process, which Thompson said "reduces the mean time to resolution."
In a recent report, Steve Steinke, senior analyst with The 451 Group, wrote: "Network, applications and server fault and performance problems are most difficult to solve when they are intermittent. An accessible repository of network traffic allows users to dial in the range of time when a problem occurred, not unlike the way a TiVo allows instant replay."
Steinke said service providers and companies with distributed networks would benefit from a portable retrospective analysis solution, especially when troubleshooting intermittent problems. A service provider could bring the box to different sites to determine what is causing problems without having to invest in a rack-mounted unit.
The ability to go back in time to smoke out an issue trumps typical network analyzers, which usually require someone to keep watching in hopes that the event will occur again.
"A typical port analyzer doesn't have the horsepower to handle all of that data," Steinke said.
Thompson said GigaStor Portable, which starts at just under $US27,000, can store 1.5 terabytes of data and analyzes traffic across various network topologies, such as gigabit, 10 gigE, WAN and fiber channel. It contains Network Instruments' Observer Suite and GigaStor technology and includes all required cabling, a dual-processor Windows XP Pro x64 system, a 15-inch active matrix display, a keyboard and a trackpad.
Although Network Instruments faces tough competition in the retrospective analysis arena -- from the likes of Network General and Wildpackets -- Steinke said he has yet to hear of another company offering a truly portable solution. He added, however, that others may not be far behind.
"It's a very competitive group of companies there," he said. "You generally see them leapfrogging each other with different features."
Service provider NEC has been using four GigaStor Portable units for customer site surveys and capacity planning. According to Ivan McDuffie, the company's manager of network engineering, NEC has so far used the portable GigaStor for five or six surveys.
Typically, McDuffie said, he would go to a customer site and run a network assessment to determine a baseline. With the old gear, though, there wasn't enough disk space to provide an ample amount of information -- roughly two or three days' worth of data was stored -- and that information would have to be returned to a lab for analysis.
GigaStor Portable, on the other hand, traps roughly a week's worth of data from several interfaces.
"Our old equipment didn't have enough disk space for a true assessment," McDuffie said. "[GigaStor Portable] monitors up to eight interfaces at any one time. We can leave it out there for a full week and capture a full cycle of the network and make judgments based on that."
The ability to go back in time, he said, lets NEC engineers determine network peak times for a client and return to the time when a problem occurred.
"If the problem happened on a Monday and this is Wednesday, we can go back," he said, adding that it does take a little interaction between engineers and the client to pinpoint when problems arose. The ability to isolate problems by time also helps McDuffie and his team present concrete data to the client.
"It's flexible for network assessments," he said, "and cuts down on our time at the customer site and the time spent finding and solving the problems."