Performance Management for TAPs and NPBs

Performance Management for Taps and NPBs

In previous articles we reviewed the overall topic of management interfaces to Taps and NPBs and in subsequent chapters took a deep dive into the topics of Fault Management, Configuration Management and Software Management. In this chapter we will focus on Performance Management and its related topics. Subsequent chapters will cover other management topics including accounting, security and remote access.

Performance Management Requirements

Performance management for a network tap or packet broker (NPB) involves various processes, tools, and practices aimed at ensuring the efficient and effective operation of the NPB within a network infrastructure. A tap or network packet broker is a crucial component in network monitoring and security architectures, as it facilitates the optimized distribution of network traffic to monitoring and security tools. Here are the key aspects of performance management for a tap or network packet broker:

• Traffic Handling and Filtering:
  • Taps and NPBs need to handle high volumes of network traffic while ensuring minimal latency and packet loss. Performance management involves configuring the NPB to efficiently filter, aggregate, and distribute network packets based on specific criteria.
  • Filtering rules should be optimized to ensure that only relevant traffic is forwarded to monitoring and security tools, reducing the load on those tools and improving overall network visibility.
• Scalability:
  • Performance management includes planning for scalability to accommodate future growth in network traffic and the addition of new monitoring tools. This may involve selecting Taps and NPBs with modular designs or the ability to scale horizontally by adding more devices.
• Load Balancing:
  • Taps and NPBs distribute network traffic among multiple monitoring and security tools to prevent overload on any one tool. Load balancing algorithms should be configured and monitored to ensure even distribution and prevent bottlenecks.
• Monitoring and Reporting:
  • Performance management involves continuous monitoring of the NPB’s health, utilization, and the performance of connected tools. This monitoring can include metrics like CPU usage, memory utilization, and link status.
  • Reporting tools generate performance reports and alerts, helping network administrators identify any issues or bottlenecks in real-time.
• Redundancy and High Availability:
  • To ensure uninterrupted network visibility, NPBs often employ redundancy and high availability configurations. Performance management involves setting up failover mechanisms to switch traffic to backup NPBs if the primary device experiences issues.
• Quality of Service (QoS):
  • Performance management may involve implementing QoS policies to prioritize critical traffic over less important traffic. This helps ensure that monitoring and security tools receive the most relevant and timely data.
• Packet Slicing and Masking:
  • Taps and NPBs can perform packet manipulation tasks like packet slicing (removing parts of packets) or masking (anonymizing sensitive data). Effective configuration of these features is crucial for optimal performance and compliance. Packet slicing and masking enables more efficient use of the capacity of monitoring and security tools.
• Protocol Support:
  • Performance management involves ensuring that the NPB supports a wide range of network protocols, as different monitoring and security tools may require different protocols for effective operation.
• Tuning and Optimization:
  • Performance management includes ongoing tuning and optimization of the NPB’s configuration. This might involve adjusting filters, load balancing algorithms, or QoS settings based on changing network requirements.
• Capacity Planning:
  • To avoid performance degradation due to resource limitations, capacity planning is crucial. Network administrators must monitor and assess current usage patterns, understand the peak traffic rates and their frequency, and plan for future growth to ensure the NPB solution can handle current and anticipated peak traffic loads.

In summary, performance management for taps and network packet brokers involves a combination of configuration, monitoring, optimization, scalability planning, and security considerations to ensure that the NPB effectively handles network traffic and supports the smooth operation of monitoring and security tools.

Performance Management Interfaces

Here are some protocols and techniques commonly used for Tap and Packet Broker performance management:

• Simple Network Management Protocol (SNMP): SNMP is a widely used protocol for monitoring and managing network devices. It allows for the collection and organization of device statistics, such as CPU utilization, memory usage, network traffic, and more. SNMP agents on network devices provide information that SNMP managers can retrieve using SNMP requests.
• NetFlow and sFlow: NetFlow and sFlow are protocols used for collecting and analyzing network traffic data. They provide insights into traffic patterns, source and destination IP addresses, port usage, and more. This information is valuable for identifying bottlenecks, unusual activity, and optimizing network performance.
• Remote Monitoring (RMON): RMON extends SNMP capabilities by providing more detailed monitoring and reporting. RMON allows network administrators to collect data about individual device ports, traffic flows, and other performance metrics. This can help identify specific areas of concern in the network.
• IPFIX (IP Flow Information Export): IPFIX is an extension of NetFlow that standardizes the format of flow data records. It enables the export of flow data to external collectors for in-depth analysis. IPFIX is particularly useful for large networks and ISPs.
• Syslog: Syslog is a protocol for sending and receiving log messages within a network. Network devices can generate syslog messages for various events, errors, and warnings. Centralized syslog servers can aggregate and analyze these logs to identify performance issues and security threats.
• PCAP (Packet Captures) and Packet Analysis Tools: Tools like Wireshark or tcpdump allow network administrators to capture and analyze packets traversing the network. This can help diagnose performance problems, identify anomalies, and optimize network traffic.

Performance Management Best Practices

• Performance Baselines: Establishing performance baselines involves collecting and analyzing historical performance data to define normal network behavior. This helps in identifying deviations from the norm and diagnosing potential performance problems.
• Automated Monitoring and Alerting: Implementing automated monitoring tools can help identify performance degradation or failures in real-time and trigger alerts for timely intervention.

Tap and Network Packet Broker performance management is an ongoing process that requires a combination of protocols, tools, and best practices to ensure a reliable and efficient network infrastructure.