Network Monitoring Gets Pervasive

Network Monitoring is a term that can encompass both active and passive monitoring systems that handle anything from intrusion detection to Internet and protocol analysis, network troubleshooting, application performance ratings, access control, Sarbanes-Oxley, deep packet inspection, VoIP analysis, IPTV service assurance, and on and on. In terms of IP Communications, a great deal of ‘network monitoring’ has to do with maintaining a high Quality of Service (QoS) — checking for packet traffic congestion on the network along with any accompanying physical infrastructure problems.

Just as the line between testing and monitoring has blurred, so too has the boundary between monitoring and general network management. Monitoring is now a vital part of various wellknown management systems, such as the Alcatel 5620 Network Manager and Service Aware Manager. The Alcatel 5620 SAM Assurance (SAM-A) and Alcatel 5620 SAM Provisioning (SAMP) modules ease fault detection and proactive diagnosis, and simplify the introduction of Ethernet or IP services by a service provider by furnishing enhanced service provisioning and assurance capabilities.

The august HP OpenView (being rebranded as HP Software) is another extensive portfolio of network and systems management products, of which keeping tabs on the network itself is important. IBM’s Tivoli NetView is a monitor program that provides real-time monitoring of network health, displays network topologies, and gathers performance data. For example, you can run an active test over any server on the network supported by SNMP. Tivoli NetView measures availability and provides fault isolation for problem control and management in mission critical environments.

At Computer Associates (quote - news - alert) (http://www.ca.com), Brian Gollaher, Product Manager for CA’s Network Product Line, says, “One of our goals here at CA is the move from what’s called today ‘Insight’ or manually looking at network systems, servers, applications and reporting on what they’re doing, to ‘automation’. In other words, taking actual corrective action and rebalancing system resources appropriately. We have a product that we just introduced that’s a virtual environment manager, called Virtual Platform Management, which allows us to monitor virtual servers and reallocate resources appropriately, based on the load generated by the applications. We view this as CA’s first step into actual automation, or doing more than Insight. All of our products will be capable of doing this, but it will take a year or so for us to bring that about.”

“As for network monitoring and management,” says Gollaher, “we have an overriding vision at CA called EITM [Enterprise IT Management]. It consists of unifying, simplifying and securing the network across the enterprise. What we’ve done is to enable all of our products suites to work together: storage, security the networks and such, to exchange information so that one can manage the network resources, look at the applications and services that are running on the network and pull it all together at the business process level.”

Gollaher elaborates: “The whole vision is to combine networks, systems, applications and storage, rolling it all up into the services that run on the network, and then look at them from a business process point of view. That’s the CA overriding vision. We hear more and more from our customers — especially large enterprises, service providers and such — who say, ‘I don’t want a bunch of point products in my organization that manage a switch and a router over here, and a server over there. I don’t offer servers anymore, and I don’t offer networks per se; I offer services to my users and I run my business based on processes. I want alignment of all my expenses — whether they concern system services, networking, or whatever — to match my business processes’. That’s what our customers have been telling us, and that’s the dominant CA EITM vision.”

“More specifically, in talking about network monitoring and management, obviously we want to be able to report the health of the network, as it aligns to a business process,” explains Gollaher. “That’s done through service availability management. So let’s take voice as a service. You have a set of resources — it might be a Cisco Call Manager, a Unity server, the switches and routers on the network. There might be DNS, DHCP or even DFTP servers for configuration. All of these components are required to offer a voice service. We can certainly do both fault and performance management on all of these devices from a CA perspective, through products such as eHealth, a performance management system that is SNMP-based and that polls switches, routers, systems, servers and puts the statistics in a database and follows long-term trends. In terms of voice, eHealth can actually look at QoS queues on router interfaces, and it can look at the different classes of traffic and spot deviations from the norm. If you have Class 5 voice traffic, you can see what percentage of the resources on that interface are going to real-time traffic, and see whether there are any packet discards on the queues because of too much traffic. eHealth even does some application management.”

“Basically, our products can go in, examine the performance of the devices, collect metrics and such,” says Gollaher. “But where we take things a step further is through our Spectrum Service Manager. We have service models that take into account all of the components I mentioned. For example, Cisco Call Manager, DNS servers, switches and routers in network are all critical to run voice as a service.”

“A number of our larger customers are looking at voice service from an SLA perspective,” says Gollaher. “The IT departments are guaranteeing the users a certain service level, whether they be internal customers or, in the case NSPs, from an external customer perspective. Our Spectrum Service Manager can look at various metrics, from MOS scores, acceptable phone registrations, acceptable caller availability stats, and so forth. All of these metrics are fed into the service model. In the case of the components themselves, any legacy trunks, PRIs, T1s and such on gateways or any IP trunks are queried to see if they are available. If there’s an outage, is it one that can affect service? For example, if you lose a Call Manager but there’s a redundant one in the cluster and the phones re-register, that’s not a service-affecting outage, though it’s certainly a fault that needs to be corrected in the network, but it doesn’t go against the SLA if there’s sufficient redundancy built into the network.”

“Same thing with switches and routers,” says Gollaher. “If you lose a router, you lose an interface on the router. Does that affect the service or not? All of this information is rolled up into the service model, so that we can look at voice on the network as a service. It’s a bit like Web Services. We’re starting to look at SLAs for Web Services and Service-Oriented Architectures. When we were at the latest VoiceCon we got into discussions about voice services built on that same architecture. And certainly from CA’s view, managing the network, the servers, the systems, the applications — including voice — from an SLA perspective makes a lot of sense, because that’s ultimately how it’s viewed by customers. Certainly from our Spectrum Console, for example, we can detect that a Call Manager server is down or that a network switch or router is down, and of course that needs to be repaired, but it’s becoming more and more critical to identify whether that fault is affecting the voice service or not. After all, there are types of router failures that will take down a branch office, and there are router failures that won’t actually take down anything. The technology needs to identify the most critical events, hence our focus on service availability for voice.”

“CA is pretty well positioned in that we have voice management products that can manage the Avaya, Cisco and Nortel voice switching and messaging systems,” says Gollaher. “We can manage large numbers of servers, and we have application management and network management products.”

“Also, MPLS services are becoming more and more prevalent,” says Gollaher. “We have MPLS management capability in Spectrum, again from the fault management perspective, and for performance management in our eHealth product. We can monitor MPLS networks and look at service quality there as well. So monitoring is a major component of what we do.”

Taking the Burden off of SOHOs

Advanced monitoring techniques can now also come into play in the provisioning process, where it can have a major impact on those home and SOHO users who want to acquire and maintain broadband and IP Communications services, but ironically find themselves needing more technical expertise than their enterprise brethren.

David Sayag, Founder and VP of Marketing of Enure Networks (news - alert) (http://www.enure.com) says, “When you look over the history of access networks by service providers, be they MSOs or telcos, you see that around 1999 or 2000, when DOCSIS devices really got going, and then over the next three to five years, there was a lot of investment around building billing and operations support systems (BSS and OSS) in an attempt to automate the life cycle of services in the access and core network. In the past everything was done manually, but today most of the work of provisioning, fault management and quality assurance is being done quite automatically. The access part of the network now has quite good uptime, too.”

“The problem is that the home, which is a very important segment of the network, is being handled completely differently,” says Sayag. “It’s still a highly manual process, with users reading manuals and calling up a contact center. We expect the home user to do something and the possibly non-technical call center representative to do something. It’s all quite different from the automated BSS and OSS systems for access and core networks.”

“Our new mission is to fully automate the service and experience for both the end user and the home user,” says Sayag. “By ‘home user’ I mean small businesses, SOHOs and so on. The user should simply pay for and enjoy the services. We shouldn’t force them to become technicians and understand how the whole network operates.”

Founded in 2003, Ensure Networks is now out to fully automate the operation and provisioning of home/SOHO broadband services, including high speed Internet, triple and quadruple play and IPTV. Their technology enables service providers to improve the availability and reliability of home broadband services, so they can focus on selling and delivering products and services rather than just waste time maintaining and supporting their networks.

“We have a deep knowledge of networks,” says Sayag, “as well as BSS, OSS and the way networks can and should be managed. We’ve patented a technology that, instead of reacting to problems and symptoms after they appear and anger the user, it monitors and keeps the home environment in optimal working order, eliminating user frustration.”

The Enure True Information & Control (TIC) System concentrator server collects non-private networkrelated data on the home network environment and on the root causes of problems and their solutions, allowing tight service provider control. The TIC System assembles a comprehensive, aggregated picture of everything that’s occurring on all customers’ home/SOHO networks.

“We believe strongly that users should not be involved in most home network operations and maintenance,” says Sayag. “Our idea is to remove all of the technical barriers that are related to setting up and operating a home network. By ‘home network’ I mean any IP service and associated device that runs in the home, including home gateways, PCs, modems, set-top boxes, and so on. When you look at the home, if you can provide a solution that understands the entire network in the home, then you can bring value to the table, because many aspects of the network are things that depend on each other. For example, both VoIP and IPTV services depend on the home gateway and broadband connection. So the idea is to come up with a solution that handles the home network end-to-end, and enables services to be installed and automatically detects and fixes problems.”

Freebies

Open source/free software enthusiasts out there (or those of you with a thin wallet) should take a look at Pandora FMS (Free Monitoring System). Pandora can watch just about any system and application, and it can reveal to you the status of any system element. Pandora can detect a kaput network interface, a website defacement, a memory leak in a server app, or the latest change in your favorite stock on Wall Street. It can monitor any TCP/IP service, along with routers, switches, load balancers, operating systems, applications or printers. Pandora can even send you an SMS message when your systems fails.

Pandora runs on nearly any operating system, with specific agents for each platform gathering data and sending it to a server. Specific agents have been built for GNU/Linux, AIX, Solaris, HP-UX, BSD/IPSO, and Windows 2000, XP and 2003. SNMP is used for collecting data and for receiving traps.

Mainstream Monitoring

In an age when networks are so dynamic that they change on a minuteby- minute basis, monitoring will be the key to successful network management and keeping users happy. Although we’re still pretty far away from achieving self-healing networks, we can eliminate the primitive and unacceptably lengthy ‘react-to-a-user-complaint’ cycle of monitoring and repair.

Richard Grigonis is Executive Editor of TMC’s IP Communications Group.