October 11, 2007

A time machine for your network

Network Instruments' GigaStor appliance combines complete traffic capture, deep analysis, and even session playback, making an effective if expensive tool for solving network performance and security problems

When it comes time to dissect a network problem, whether the problem is related to security or performance, a deep look into all the network activity surrounding the incident can be critical to resolving the issue. An intrusion detection system, with its rules for capturing problematic network events, can be of some help, but for real problem diagnosis or forensics, you need more. Network Instruments' GigaStor is designed to meet that need with full traffic capture that extends backward to hours or days. This "keep it all" capability makes the GigaStor a valuable addition to any network for which high performance, security, or regulatory compliance are critical issues. When you need to investigate a network slowdown, a security breach, or anything else that happened on your network, if you know when it happened, then GigaStor can take you there.

 


Click for larger view.
GigaStor is, essentially, a large box of great storage capacity (from 4TB to 48TB) with high-speed network interfaces on the outside and the capability to rapidly move data between NIC and disk within. I tested a "small" version of the GigaStor, with 8TB of storage, four Gigabit Interface Converters, and three 10/100/1000Base-T interfaces, and the IO necessary to reach the device, all packaged in a 6U box. All the hardware would be much less useful without software to analyze the data gathered, and Network Instruments does not disappoint: GigaStor includes the company's Observer software (version 12 in this case), which serves as your window into the GigaStor's stored information. In addition to providing analysis from GigaStor, Observer can gather data from multiple GigaStor appliances and perform correlated analysis across all the instances. Network Instruments recommended that we run Observer on a Windows XP or Windows Server 2003 system, with a minimum 2GHz processor and at least 2GB RAM. Our test platform met or exceeded all the recommended specifications.

 

Interestingly, Observer isn't the only piece of the GigaStor solution that runs on Windows. Whereas most network and security appliances use Linux as the embedded OS, the GigaStor sits on Windows XP 64. When I asked why Network Instruments chose Windows XP 64 as the platform, I was told that it had to do with their developers' experience -- an absolutely valid reason for reaching a decision. In our testing, we had no issues with the device, no concerns about performance, and no problems with the operating system. I give you this information because it's unusual -- not because it was a problem.

The roughest part of installing the GigaStor was picking up the box to install in the rack. After the hard disks were installed in the chassis and various cables plugged in, I moved straight to software setup. I began by discovering the network devices. For the GigaStor system this is a passive activity performed by listening to network traffic, not scanning ports. This is a good thing if you aren't the Tripwire jockey for your network. After I built an accurate description of our test network, I began to set up filters for the activities and the criteria I wanted to set for alarms. The Observer software allows you to include or exclude traffic based on packet type, addresses, address pairs, traffic level, behavioral rules, and most other factors that can reasonably be considered for this kind of task.

Remember that time at 23:49?

Test Center Scorecard
20%20%20%15%15%10%
Network Instruments GigaStor899988
8.6
Very Good
Close

On Twitter now

Network monitoring and management

Powered by Twitter

White Paper

D2D Virtual Tape Library Replication Primer

This whitepaper explains the terminology and concepts behind Data Replication technologies and establishes some sizing rules through worked examples. Learn the new paradigm in disaster tolerance—protect data anywhere.

Download now »

White Paper

An Alternative to Virtualization for Datacenter Cost Savings

Server virtualization is a popular option for dealing with mounting datacenter costs. Another equally promising approach is the use of an Application Delivery Controller. Citrix NetScaler provides a low-cost way for organizations to reduce their server count and accrue cost savings from a reduction in space, cooling, power and personnel.

Download now »

White Paper

Why Your Firewall, VPN, and IEEE 802.11i Aren't Enough to Protect Your Network

The emergence of WLANs has created a new breed of security threats to enterprise networks.

Included in HP ProCurve WLAN solutions is security technology that alleviates threats from WLANs through:
* Monitoring wireless activity inside and out of the enterprise
* Classifying WLAN transmissions into harmful and harmless
* Preventing transmissions that pose a security threat to the enterprise network
* Locating participating devices for physical remediation

Download now »

White Paper

Bringing the Edge to the Data Center

Effectively address data protection challenges, implementing solutions that help store and protect business–critical data while cutting costs and improving efficiency and reliability.

Download now »

Sign up to receive InfoWorld Resource Alerts

Subscribe to the Technology: Networking Newsletter

The one-stop resource center for IT professionals.

©1994-2009 Infoworld, Inc.