1. SHARKFEST '08 | Foothill College | March 31 - April 2, 2008 Non-Intrusive Out-of-Band Network Monitoring Utilizing a Data-Access Switch April 1, 2008 Patrick P. Leong CTO | Gigamon Systems LLC SHARKFEST '08 Foothill College March 31 - April 2, 2008

2. SHARKFEST '08 | Foothill College | March 31 - April 2, 2008 Agenda Recent changes in the network monitoring Issues with traditional network tapping Data Access Network (DAN) Functions of a Data-Access Switch Example applications Summary Q & A

3. SHARKFEST '08 | Foothill College | March 31 - April 2, 2008 Recent Changes in Network Monitoring 9/11 spawned new security and lawful intercept requirements Enron spawned new auditing and monitoring laws New tools optimize E-commerce and internet applications VoIP and media convergence make the network more strategic Network is more valuable; Downtime is unacceptable

4. SHARKFEST '08 | Foothill College | March 31 - April 2, 2008 Result: Proliferation of Tools New SOX compliance transaction monitors --- Keep your boss out of jail! IDS Sensors detect external hacker attacks NAC Appliance protects networks from inside --- From your own people! Forensic recorders capture events and how the network being used! Configuration monitoring tools watch over network resources Application and Network troubleshooting

5. SHARKFEST '08 | Foothill College | March 31 - April 2, 2008 Proliferation Causes Contention for Span Ports Security and IT Engineers seen here “Negotiating” Over a SPAN Port

6. SHARKFEST '08 | Foothill College | March 31 - April 2, 2008 Other Issues Packets belonging to the same flow may go through multiple parallel links e.g. Etherchannel Difficulty in monitoring asynchronously routed mesh topologies The tool cannot keep up with the incoming bandwidth --- many tools are software based e.g. Wireshark

7. SHARKFEST '08 | Foothill College | March 31 - April 2, 2008 Solution? Data-Access Network (DAN)

8. SHARKFEST '08 | Foothill College | March 31 - April 2, 2008 What’s a DAN? It’s a out-of-band monitoring network! Includes Passive Tools like: Sensors, Probes, Monitors, Recorders, Analyzers, and Access Switching

9. SHARKFEST '08 | Foothill College | March 31 - April 2, 2008 Example of a DAN

10. SHARKFEST '08 | Foothill College | March 31 - April 2, 2008 What’s new? A new “Best Practice” Part of the network infrastructure Facilitates instrumentation of a network Enterprise or Telco What’s new is how data is fed to the tools By a Data-Access Switch Unobtrusive to the primary network

11. SHARKFEST '08 | Foothill College | March 31 - April 2, 2008 What problems do DANs solve? Too Many Power Tools? Not Enough Sockets? ? ? ? ?

12. SHARKFEST '08 | Foothill College | March 31 - April 2, 2008 For Power Tools, use a Power Strip

13. SHARKFEST '08 | Foothill College | March 31 - April 2, 2008 Too Many Monitoring Tools? Not Enough Span Ports? ? ? ? ?

14. SHARKFEST '08 | Foothill College | March 31 - April 2, 2008 For Sensors/Monitors/Analyzers, Use a Data Access Switch One Span port serves Many tools

15. SHARKFEST '08 | Foothill College | March 31 - April 2, 2008 Monitoring a Mesh Network?

16. SHARKFEST '08 | Foothill College | March 31 - April 2, 2008 If we deploy one tool per span port --- Lots of Hardware and Expensive !!!

17. SHARKFEST '08 | Foothill College | March 31 - April 2, 2008 Better to Distribute Connections with a DAN Aggregate and filter flows to consolidated tools

18. SHARKFEST '08 | Foothill College | March 31 - April 2, 2008 DAN is out-of-band “Data Socket” Part of the Reliable Network Infrastructure Plug-in multiple out-of-band tools – any tool to any data Unobtrusive tool changes – never touch the network Do moves, adds, changes at any convenient time Eliminates RSPAN Performance Monitor Security IDS Transaction Auditor Forensic Recorder Protocol Analyzer Switch Storage Area Network Switch Server Farm Consolidated Tool Farm Config Monitor “Data Socket”

19. SHARKFEST '08 | Foothill College | March 31 - April 2, 2008 DAN Solves Access Problems By Aggregating many links to any tool Multicasting any link to many tools Filtering data to map packets to tools Saving $$ Cap Ex and Op Ex budget$ Any to Any Any to Many Many to Any Bit-Mask Filtering

20. SHARKFEST '08 | Foothill College | March 31 - April 2, 2008 Example application: Telco Core

21. SHARKFEST '08 | Foothill College | March 31 - April 2, 2008 Example application: Telco Edge

22. SHARKFEST '08 | Foothill College | March 31 - April 2, 2008 Example Application: 10G Monitoring

23. SHARKFEST '08 | Foothill College | March 31 - April 2, 2008 Summary A Data-Access Switch forms a Data-Access Network that: Provides non-intrusive, out-of-band network monitoring Resolves the insufficient span ports issue Reduces the number of tools deployed Can intelligently spread the network traffic to various tools Reduces the load of a particular tool via intelligent hardware-based filtering Provides a “Big Pipe” view of the mesh network