1 Update On Wireshark Gerald Combs Director, Open Source Projects May 24, 2012

2 ©2012 Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners. What’s happening on your network?

3 ©2012 Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners. Packet Analysis

4 ©2012 Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners. Wireshark alone doesn’t fully address the broader problem of network visibility.

5 ©2012 Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners. Challenge: Answer These Questions  How well is the network delivering our critical applications? How well did we do last week, month, quarter…?  Are we having problems delivering services? If yes, where? What caused them? How do we fix them?  How can we communicate results to business leaders?

6 ©2012 Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners. How Hard Can it Be?  Easy, right? Collect stats and dump to disk Analyze the performance database Look through the hay Find the needle

7 ©2012 Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners. © 2009 Riverbed Technology. Confidential. IMPORTANT NOTE: The roadmap is for information purposes only and is not a commitment, promise or legal obligation to deliver any new products, features or functionality. The development, release, and timing of any features or functionality described remains at Riverbed's sole discretion. Visibility You Want Flows Bits Now Then

8 ©2012 Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners. © 2009 Riverbed Technology. Confidential. IMPORTANT NOTE: The roadmap is for information purposes only and is not a commitment, promise or legal obligation to deliver any new products, features or functionality. The development, release, and timing of any features or functionality described remains at Riverbed's sole discretion. Visibility You Have Flows Bits Now Then

9 ©2012 Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners. Flow Overload  Some flow math… 500,000 flows / min x 200 bytes / flow stat x 1440 min/ day x 7 days / week = ~1 TB / week © 2009 Riverbed Technology. Confidential. IMPORTANT NOTE: The roadmap is for information purposes only and is not a commitment, promise or legal obligation to deliver any new products, features or functionality. The development, release, and timing of any features or functionality described remains at Riverbed's sole discretion.

10 ©2012 Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners. © 2009 Riverbed Technology. Confidential. IMPORTANT NOTE: The roadmap is for information purposes only and is not a commitment, promise or legal obligation to deliver any new products, features or functionality. The development, release, and timing of any features or functionality described remains at Riverbed's sole discretion. Packets Even Worse  Some packet math… 500 Mb/s x 3600 sec / hr x 24 hours / day x = ~5 TB / day

11 ©2012 Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners. + + WAN Remote Site Data Center Status Quo Flow Analyzer

12 ©2012 Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners. + + WAN Remote Site Data Center Status Quo Packet Analyzer Flow Analyzer

13 ©2012 Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners. + + WAN iP/F: Flow Plus Packets Single Logical Record Remote Site Data Center

14 ©2012 Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners. It’s Hard To Make Things Easy How Can We Make Network Visibility As Easy As This?

15 ©2012 Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners. It’s Hard To Make Things Easy How Can We Make Network Visibility As Easy As This?

16 ©2012 Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners. It’s Hard To Make Things Easy How Can We Make Network Visibility As Easy As This?

17 ©2012 Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners. It’s Hard To Make Things Easy How Can We Make Network Visibility As Easy As This?

18 ©2012 Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners. Where are we headed?

19 ©2012 Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners. pcap-ng  Annotations  Multiple interfaces  Enables cleverness

20 ©2012 Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners. Broader Goals  Visibility as a platform programmatic access to analytics customizable flow/packet processing logic iP/F REST layer  End users can then integrate across other IT systems customize monitoring for their environment build browser-based mashups that integrate with existing portals and applications

21 ©2012 Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners. + + WAN Example: Snort Integration Remote Site Data Center  When certain alerts are received from Snort, reach out to Shark appliances and create packet trace related to suspected threat 1. Hacker Attack 2. Snort Alert 3. Attack Packets Available for Analysis

22 ©2012 Riverbed Technology. All rights reserved. Riverbed and any Riverbed product or service name or logo used herein are trademarks of Riverbed Technology. All other trademarks used herein belong to their respective owners. The trademarks and logos displayed herein may not be used without the prior written consent of Riverbed Technology or their respective owners. Far Future  Look for bad answers.  Have fewer.