Andy Huckridge

Which server is the data coming from?

An issue in the Network Monitoring / Network Management world that’s often not fully understood, nor corrected after aggregation has been introduced upstream of the network TAPs on input side of analytic tools is that of losing Link Layer Visibility.

So there you are, you’ve just bought an expensive analytic tool and you want to get more coverage of your network links, say to a few other local network segments – after you realise the tool’s not running at its full capacity, you buy an aggregator to place between your network segments and your analytic tool. Guess what, you’ve lost Link Layer Visibility… You’ve lost critical information about the nature of the data you’re trying to monitor and / or analyse.

What are the real network ramifications of losing Link Layer Visibility? You don’t know which network segment your tool is looking at, or what your tool does when looking at multiple different network segments, tool results are not correct and you start losing packets because there are now collisions introduced at the ingress, again by the aggregator, due to the characteristics of bursty traffic. In fact – it’s worse than that. Sessions are now mixed together and your analytic tool may not be able to differentiate between one session and another – from packets arriving on one port and packets arriving on a different port.

There’s nothing wrong with adding an aggregator – or with aggregation, that’s fine, but next time you’re in need – take a look at the VSS Monitoring line of products which preserve or restore Link Layer Visibility when lost, through advanced features such as the following:

• Port & Time stamping
• High data burst buffer
• Microburst detection
• Session aware load balancing

Multiply that with the industry’s only true Mesh deployment architecture, as opposed to the far less reliable Hub & Spoke approach – and not only do you benefit from seeing multiple network segments with the same, or with multiple different tools, but you also get much more resilient monitoring with a network wide view that self-learns, self-heals and never loses a packet!

What’s the upshot?

Only by preserving Link Layer Visibility can you guarantee you’ll be able to find and process the packet that will lead to getting the network back up again. Using an aggregator that doesn’t preserve Link Layer Visibility will help to conceal the problem that is keeping your network down, hide the packet at issue and impede a resolution.