With the introduction of Savvius Insight, our new mini appliance for edge networks, a new type of ROI has emerged for customers who also have Omnipliance in their datacenters. This is because Savvius Insight creates more capture points that can be used to take advantage of the Multi-Segment Analysis (MSA) features of these powerful devices.

image002

First of all, with a single Savvius Insight device, or any other Savvius Capture Engine, 2-way latency can be measured on an on-going basis. 2-way latency, or response time, is the amount of time it takes for a request to be sent by a client, and a response to be returned by the server. However, the response time is not just the time it takes to return a TCP ACK, known as network response time, it is the amount of time it takes to return a response with application data in it. This can also be referred to as a transaction. From these measurements reports and alerts can be generated. Alerts come in the form of the many different built-in Expert Events, as well as the ability to define custom alerts based on response time summary statistics. Response times and response time alerts are very powerful features in Savvius products.

image006

Reports can also be generated which contain the response times of flows and applications, as well as the alerts generated based on exceeding the response time thresholds configured by the user. And this is an important point about response time alerts. They are generated by experts which can be configured to match the expected behavior of a particular network.  Reports can also be configured to write at specific intervals, and for those customers using the Splunk integration, which is built into Savvius Insight, even more alerts can be defined and generated in Splunk. Other reporting solutions can be used to generate alerts on events output into reports as well.

image007

And now we get to the ROI that happens when Savvius Insight and Omnipliances are used together to perform Multi-Segment Analysis, also known as MSA. Savvius MSA is different than most other vendors’ solutions for measuring one-way latency between the edges and the data center. Savvius MSA is primarily different because it is passive, rather than active. Instead of generating network traffic, Savvius MSA is passive, and monitors and measures the real traffic that actually has the problem, not some other traffic that is used to measure latency along the same path. And because Savvius Capture Engines can capture the traffic at any point in the path, any number of Savvius MSA capture points can be placed in the path, working together in a synergistic way to provide greater granularity and insight into where the latency is occurring. And finally, because Savvius Capture Engines capture actual network packets, Omnipeek can be used to drill down to the actual packets, and use all of the analysis available on Omnipeek to troubleshoot and solve the problem. Once again, achieving the fastest mean-time-to-resolution (MTTR) possible.

image008

Savvius MSA has always been available in Savvius’ larger Omnipliances, but because MSA requires at least two capture points to work, it has not been that accessible to Omnipliance customers. But now, with the release of Savvius Insight, MSA becomes much more affordable and accessible to our customers who already have Omnipliances in their data centers. By deploying inexpensive Savvius Insight devices inline at the edges, and even along the path between critical network components, Savvius MSA can be used to gain greater visibility, and granularity, into the network latency of individual packets of flows going in both directions.

How MSA works is that OmniPeek is used to display flows captured on a particular Savvius Capture Engine. The user chooses a flow from the Expert View, and selects Multi-Segment Analysis. A dialog then appears asking which other Capture Engines to include in the analysis. Once the Capture Engines are selected, the Capture Engines will all perform a forensic search to find the packets in the flow. The resulting packets will then be brought back to the OmniPeek Console, where the 1 way latency analysis will be performed, and displayed to the user.

Although the Savvius MSA feature is a manual work flow, and thus not a continuous operation, the may be a way to automate it that we have just not thought of yet. However, there is also a hybrid approach which takes advantage of the Splunk Integration. This approach consists of filtering for certain “pulse” packets at each capture point. These could be pings or any other easily identifiable packets that travel between any two capture points on the network path that is to be measured. When these packets are captured, an event is generated with a timestamp and sent to a centralized Splunk Server. Dashboards can then be used in Splunk to associate the events generated by the same packets from the different capture engines, calculate the time it took for the packet to get from one capture engine to the next (the latency), and display the latency to the user, or generate an alert.

It is important to emphasize that the accuracy of any 1-way latency measurement is very dependent on the synchronization of the clocks on the Capture Engines involved. Clock synchronization is not relevant to 2-way latency since the same machine is used to capture and analyze the request and the response. There are numerous ways to synchronize clocks on these devices, as well as integrations with packet brokers that can provide packets with timestamps.

So there you have it. Although Savvius Insight is an amazingly little device on its own, especially for only $1,500, when used with Omnipliances for MSA, a whole new level of network insight can be achieved. To learn more about Savvius Insight, check out the Savvius Insight product page.

 

Written by Chris Bloom, Savvius Technology Evangelist