Tech Bytes

The following is a transcript of the audio you can listen to in the player above.

Welcome to Briefings In Brief, an audio digest of IT news and information from the Packet Pushers, including vendor briefings, industry research, and commentary.

I’m Ethan Banks, it’s March 8, 2019, and here’s what’s happening. I had a briefing with Instana a few weeks ago.

Old School APM

The Instana folks reached out to me, because as a guest on the CloudCast earlier this year, I lamented that there are no application performance monitoring tools that correlate infrastructure with app performance in the cloud native era. Instana thought that wasn’t quite fair, and wanted to walk me through what they could do.

What is Instana, then? Maybe it’s key to look at what Instana is not. Instana is not old-school application performance management or APM. Many of the Instana folks came from that world, but traditional APM tools function most effectively with infrastructure that’s static. That is, you build out a network and servers and storage, and it’s likely to sit there for years. Applications aren’t likely to change much, either, with only occasional releases.

In that sort of environment, you can set up monitoring, and it works fine for a long time. You can build dependency trees, knowing they aren’t going to change much. And, you can keep up with the tweaks needed to the monitoring as infrastructure slowly evolves or new apps are rolled out.

Cloud Native Monitoring Challenges

Cloud native applications are not like this. Instead of a few large apps, you have many small apps (microservices) talking to each other to deliver a larger app to the business. These microservices are built programmatically, probably spun up by an orchestrator, and there’s a decent chance that orchestrator is Kubernetes.

And why is all of this happening? Because instead of quarterly or even annual software releases, application updates are being released all the time. Small changes are deployed to minimize risk, and done in a way that can be rolled back if there are problems. Therefore, new app instances are being spun up constantly. That means there’s new infrastructure to be monitored…constantly. No human can keep up with this infrastructure consumption model.

This is why old-school APM products don’t work effectively in a cloud-native environment.

Meet Instana

Enter Instana. Instana is modern, automated application performance management. How do they do this? An agent sits on a host or in a container, and performs continuous real-time discovery and monitoring of all components. “But wait,” you say. “I have to install an agent? That doesn’t sound very automatic.” Right. Agent installation can be automated, too–when Kubernetes spins up a new instance, the Instana agent installs along with it.

What does this agent do? It monitors over 100 different technologies such as Docker, Java, Tomcat, Kafka, Cassandra, MongoDB, nodeJS, RabbitMQ, Lambda functions, and much more. The focus is on modern application stacks, and there’s a support matrix on Instana’s website.

One the agent is running, it starts discovery and data collection automatically. In the briefing, Instana showed me an agent installation. The agent then discovered Kubernetes and started monitoring a pod. That led to the discovery of Docker containers. Container monitoring led to discovery of processes. Monitoring processes led to discovery of JVM. That led to monitoring of Spring Boot App. And no human had to do anything to make all of that happen.

The data that is gathered by the agent is sent to a centralized spot for analysis, which is where the Instana magic happens. You get…

* Automatic distributed tracing. A user makes a request to an app,

Welcome to Tech Bytes, a short, sharp sponsored conversation about new products, emerging technologies, and all things IT.

Today we talk about the intersection of NetOps and SecOps and how network teams can help respond to security incidents and assist the security team.

VIAVI Solutions is our sponsor. Charles Thompson, Sr. Director, Product Management at VIAVI joins us for the conversation.

We discuss how network teams are now expected to assist in security investigations and forensics. Packet capture and analysis tools are essential as a source of truth to understand the scope of an incident, what happened, and what users, devices, or systems were impacted.

We also look at the notion of enriched flow records, which VIAVI can provide with its GigaFlow product, and how end user experience scoring can help remediate network performance and security problems.

Show Links:

VIAVI Solutions

Observer GigaFlow – VIAVI Solutions

Tech Bytes: How VIAVI Measures End User Experience To Improve Performance Management (Sponsored) – Packet Pushers

Leading Validation Authority puts Observer GigaStor to the Test in Latest Report – VIAVI Solutions

State Of The Network 2017 Infographic – VIAVI Solutions (PDF)

On today’s Tech Bytes, sponsored by ThousandEyes, we delve into the impacts of a 50-hour outage that CenturyLink suffered in December, 2018. We also discuss lessons everyone can take away from the incident.

Our guest is Ameet Naik, Technical Marketing Manager for ThousandEyes.

We discuss:

* The underlying causes of the outage

* Services affected

* Why network visibility is esssential

* The importance of ISP redundancy

* Why management networks are critical in an age of automation and DevOps

Show Links:

ThousandEyes

Lessons from the CenturyLink Outage – ThousandEyes Blog

Ameet Naik on Twitter

Drew Conry-Murray & Ethan Banks were briefed by SnapRoute co-founders Adam Casella and Glenn Sullivan in February 2019. After a year plus of post-launch quiet, SnapRoute has re-emerged with a new focus and energy centered around a shiny new whitebox network operating system called CN-NOS.

In this briefing summary, we consider the following questions.

* Where has SnapRoute been for over a year?

* What is the new CN-NOS offering? (Hint: Kubernetes inside, and not just a plugin!)

* What sorts of customers are likely to be interested in the new CN-NOS?

* Where in the data center does it make sense to run?

* What chipsets are supported on what platforms?

* How do you buy SnapRoute CN-NOS?

Listen to our thoughts in the web audio player above, or subscribe to the Packet Pushers Briefings In Brief in your favorite podcast listening app. The Packet Pushers Network can be found on iTunes, Spotify, Google Play, and most other podcast directories.

It strikes me as unusual for Cisco to make social activist statements around privacy laws as a company (1). What would be Cisco’s motivation to call for social justice publicly.  Logically there must be reasons. 

To start, Cisco is calling on the U.S. government to develop a US federal privacy law that assures customers their data is protected. The American system should not just look to solve for today’s privacy discussions around monetization of customer data; it should aim to solve for the complex privacy needs of a world where tens of billions of devices are connected to the internet.

Its a great thing that Cisco is adding to the debate on privacy. The lack of direction from government and social forums is astonishing as tech companies eg. Facebook make huge profits by exploiting the lack of controls. 

As Cisco becomes a data company by operating cloud services and holding large amounts of personal and corporate data, its business has new risks to face. 

Woke marketingHaving your brand associated with social activism can be a winner. (2)Legal Clarity

Cisco has a number of products that collect large amounts of customer and corporate data. For example, Cloudcenter has complete visibility of customers business, Cisco’s WiFi Analytics are tracking people through retail spaces. Cisco licensing collects more than just asset data. Intersight has so much data it can make recommendations on configuration and operations. 

If the law is unclear, Cisco could face legal risks 

Law EnforcementsWe have examples of law enforcement using data from smart assistants, fitness monitor and watches. It seems likely that law enforcement will use data from cloud services when pursuing financial crimes. Divergent LawsToday, Europe is leading in privacy policy and US companies are generally not welcome to influence the process and profits might be reduced. Further, if privacy laws vary widely between countries then it may become difficult and expensive to maintain compliance.ChinaLots of noise about Chinese companies and industrial espionage. Privacy laws could be useful for better protections and prosecutions

I would note that most of these reasons would apply to many US companies operating globally. 

The EtherealMind View

Making a public statement calling for privacy is nice. Free, ineffective and makes good marketing. What we should be looking is genuine action to demonstrate commitment. 

Resources and Notes

Cisco Calls for Privacy to be Considered a Human Right | The Network : https://newsroom.cisco.com/press-release-content?type=webcontent&articleId=1965781

* I recognise that John Chambers did some community stuff to reduce boredom but it wasn’t aligned with Cisco.* When Nike make the ad with a controversial sports person (Kapernick) they appealed to their customers. 

The following is a transcript of the audio podcast you can listen to in the player above.

Welcome to Briefings In Brief, an audio digest of IT news and information from the Packet Pushers, including vendor briefings, industry research, and commentary.

I’m Ethan Banks, it’s February 7, 2019, and here’s what’s happening. I had a briefing with Plixer today.

Plixer Scrutinizer, Flow Records, And Context

Plixer is in the world of flow record analysis, solving issues for both network and security operations folks. “Oh, so they’re a netflow collector?” Yes, that’s how Plixer started back in 1999, but there’s much more to the story than just collection of flow records now that they’ve got nearly 20 years of software development under their belt.

Plixer’s Scrutinizer platform doesn’t simply collect netflow records. Rather, Plixer grabs all sorts of flow records, including netflow, sflow, IPFIX, and more. How much more? Thousands. Plixer has made a point to integrate with several different industry vendors to be able to parse not just the standard flow records, but also many of the proprietary record types that are out there, for example, from Gigamon and Ixia.

The big idea is to, as a first step, collect a bunch of records from a bunch of sources–all the sources you have on your network. Collection is good and needful, but the real issue (and one we’ve been harping on in the Packet Pushers world) is how that data is interpreted. Records aren’t interesting by themselves. Context is. Software that collects flow records and parses through them so that you have transactional context up and down the stack is what operations folks need. You don’t have the bandwidth to be providing context yourself.

And that’s the next step Scrutinizer takes–providing context to help you make sense of all the flow records being collected from the network. Ahhhh…”Scrutinizer” – I see why they called it that now. While a standard netflow record might give you 12 data points (IP address, ports, and so on), Plixer with all of the integrations they’ve done with other platforms, can tap into as many as 5,000 data points around a transaction.

Plixer describes it as a “massively contextual database” containing L2-L7 information. The context stitches together all of the data you might care about when troubleshooting a problem or performing a forensic investigation. Metadata like application, user name, jitter, latency, SSL cert details, geo IP location, etc. are all examples of elements Plixer understands to help clarify what’s really going on and why.

The FlowPro Network Probe For Those Hard-To-Reach Network Segments

Flow records from sources all over your network including the funky proprietary ones are good, but what if you’ve got some dark spots on your network? Areas where the network equipment in play doesn’t have good flow information to send to Plixer Scrutinizer?

Plixer has announced the FlowPro network probe to shine some light on these dark areas. Available both as hardware and virtual appliances, FlowPro observes network packets via SPAN or ERSPAN and can, based on its observations, create and export flow records to Scrutinizer. But that’s not all that FlowPro can do. There’s a bunch of analytical capability baked into the tool.

For example, Plixer described rich DNS security functionality to me. FlowPro can inspect DNS via domain reputation checking, look and inspect for DNS tunneling, monitor queries for A and AAAA records, note hits on “whatismyip.com”, and then detect behavior indicating that malware folks are trying to get paid based on lookups against the public IP address of a compromised host. All of that work is done locally on the FlowPro, with anomalous events kicked up to Scrutinizer.

The virtual FlowPro runs on VMware, KVM, or Hyper-V. The hardwa…

On today’s sponsored Tech Bytes episode we explore Nubeva Prisms, a public-cloud packet broker.

With Nubeva Prisms you can get packet-level visibility into AWS and Azure (with GCP soon to come). Prisms acquires, processes, and distributes packets to your analyers, performance monitors, and security tools whether those tools reside in the cloud or on premises.

We discuss how Prisms work, their packet processing capabilities, and their performance impact on cloud resources. Our guests are Steve Perkins, CRO and Head of Product; and Erik Freeland, Director of Customer Success.

Show Links:

Nubeva

Nubeva blog

Nubeva on Twitter

Nubeva on LinkedIn

Erik Freeland on Twitter

Welcome to Tech Bytes, a short, sharp sponsored conversation on new ideas and ongoing issues in IT. Our sponsor today is Comstor, and we’re going to talk about Cisco’s Smart Net Total Care.

Our guests are Richard Everard, who works for Cisco as Director of UKI Service Sales; and Tom Saunders, who works for Comstor as Cisco Services & Software Sales Lead EMEA.

We discuss what goes into Smart Net Total Care and the different options available. We also examine the Collector software that can help organizations get a handle on Cisco software licenses, updates, and bug fixes.

Show Links:

Comstor

Cisco Smart Net Total Care – Cisco Systems

Support for Smart Net Total Care (SNTC) Supported Collectors – Cisco Systems

 

The following is a transcript of the audio file you can listen to in the player above.

Welcome to Briefings In Brief, an audio digest of IT news and information from the Packet Pushers, including vendor briefings, industry research, and commentary.

I’m Ethan Banks, it’s January 14, 2019, and here’s what’s happening. I had a briefing with Aporeto in December 2018.

Aporeto is a security startup. “Oooh, another security startup?!?” you might say, rolling your eyes dismissively. I wouldn’t roll my eyes, as I believe there’s something very interesting here. The Aporeto solution has an eye to modern infrastructure security’s future, and not the past.

A Microsegmented Context

Before I explain Aporeto, I need to explain microsegmentation. In a nutshell, microsegmentation is centralized management of whitelists applied on a workload by workload basis. Filtering at the workload gives you the “micro” and the whitelisting gives you the “segmentation.” Writing individualized workload whitelists and maintaining them would be too hard for a human to do, especially at scale, and therefore solutions like Cisco Tetration, Illumio, and VMware NSX handle this for you.

Each of the solutions I just mentioned all do what they do differently under the hood, but the end result is roughly the same. A small whitelist pushed to or very close to a workload, segments that workload from every other workload, the big idea being to keep malware out, or at least prevent malware from spreading, as well as help prevent data leaks. It’s a divide and contain strategy using central management and a policy engine to deploy at scale.

There is more we can talk about here, because it’s possible to bolt on higher level scanning and so forth depending on the microsegmentation solution, but none of that changes my point that microsegmentation is merely an evolution of the same old firewall filtering we’ve all been doing for decades in one form or another.

Is Network-Based Microsegmentation The Proper Security Approach?

Microsegmentation assumes that the network is where security should be applied. And that’s fair enough. Assuming a defense-in-depth strategy, the network is one part of the security paradigm at least. Should sticking filter lists into highly distributed firewalls be the primary security for a modern, cloud-based application with diverse workloads, though?

Aporeto argues, “No.” Aporeto sees workload security not as a network problem. If you view the network as an increasingly complex transport, which it is especially when considering hybrid and multi-cloud architectures and orchestration platforms, then securing workloads is a security problem of its own, not one to dump onto the network infrastructure in the Aporeto view.

Introducing Aporeto

Aporeto is an identity-based security solution. I don’t only mean user identity. I also mean workload identity. That is, when using Aporeto, workloads can only talk to each other when their identity is authenticated by fingerprint and authorized by policy.

Aporeto decouples the network infrastructure from security on the assumptions that the network is distributed and probably not wholly managed by a given organization, that workloads are ephemeral, that all actions should be authorized, and that security lifecycle should be decoupled from the application lifecycle.

I just said many words there, so let me give you a more concise focal point. Aporeto is an identity and access management security solution that expects essentially nothing of developers and little of operators to provide deep, context-aware security for workloads no matter if they are hosted locally or in the public cloud, and it does it in a form-factor agnostic way.

Hosts, containers, processes, functions, and users all get a unique cryptographic identifier …

Today’s Tech Bytes, sponsored by Silver Peak, discusses how SD-WAN can give you more leverage over your MPLS providers and improve performance for users.

Our guest is Bruce Jarrett, Infrastructure Team Lead and Network Architect, at Gentherm, a global developer of thermal management technologies such as heated car seats.

Gentherm has 20 facilities in 13 countries—includes business offices, R&D, manufacturing, and distribution.

Bruce describes how SD-WAN let the company roll out fast, high-performing broadband connections to supplement the company’s traditional MPLS deployment, while also improving user experience.

We also discuss how features such the controller-based architecture and zero-touch provisioning streamlined global deployments for Bruce’s three-person networking team.