Niksun appliance brings TiVo-like abilities to enterprise networks

It’s one thing to implement a network protocol analyzer on a segment to determine traffic patterns and utilization; it’s quite another to perform these functions and to capture and store every bit seen on the wire.

Niksun’s NetVCR 2005 does exactly this, thanks to its embedded database. Think of it as a protocol analyzer that never forgets.

Niksun’s product line consists of several integrated components that perform various duties related to network forensics, security, monitoring, and reporting. NetVCR is available as a stand-alone or integrated solution; I tested it as it would be deployed in stand-alone fashion on an enterprise network.

Rare flexibility

The NetVCR is built on a Supermicro server chassis, with dual 2.8GHz P4 Xeon CPUs, 2GB of RAM, and a configurable storage layout. My review unit came with 530GB of storage in a RAID5 SCSI array.

The server runs FreeBSD with a custom kernel. Console interaction with the device is limited to the initial setup, as the solution is completely Web-driven.

Configuring the unit was very simple; an initialization script -- accessed via a standard KVM or serial connection -- handles all network parameters and prepares the box for deployment. Following that, all access to the appliance is through a Java application served up via the Web.

The only problem I had was that the default log-in specified in the manual didn’t match the appliance, but an e-mail to Niksun got me the correct log-in, as well as a pointer to a custom executable in the OS that resets the Web password. There is no relation between the Unix passwd file and the Web front end.

The NetVCR is available with a wide variety of network interfaces, including 10/100 copper Ethernet, gigabit copper or fiber Ethernet, HSSI (High-Speed Serial Interface), ATM, Packet over SONet, T1, T3, OC3, OC12, and more, including multilink PPP, ISL (Inter-Switch Link), and 802.1q support. With such a wide range of interfaces, the NetVCR solution can be placed on almost any type of network, anywhere in the datacenter.

That kind of flexibility is rare and very valuable. My review unit came with a gigabit fiber monitoring interface, and I placed the NetVCR on a gigabit fiber port on a Dell PowerConnect 5524 gigabit switch. I then mirrored all ports on that switch to that fiber port. This isn’t the ideal placement, but I didn’t have a full-duplex gigabit fiber network tap to use. (In a production environment, use of a full-duplex tap is recommended.)

Nevertheless, I immediately saw network flows appear on the NetVCR Web interface. The interface is driven via a Java applet and is a good blend of function and style without being too cluttered. That said, there are a lot of functions available, and initial navigation through the interface is slightly daunting. After you get comfortable with the GUI presentation, however, it’s easy to get to the data you need.

Delving into data

As data comes across the wire, the NetVCR catalogs and organizes the packets into the internal database. This database is proprietary to Niksun and uses as much of the available space on the appliance as possible. NetVCR sees data sets within the Web interface as interfaces, whether physical interfaces or time segments of captured data. This convention allows for easy data mining within the appliance and is simple to manage.