ARX vs Fluke TruView

Riverbed Vs. Fluke Networks Comparative Advice (ARX Vs. TruView) June 2013Fluke TruView Vs. Riverbed Performance Management ARX ‘High End’ Appliances SpecsTruView-4800TruView-5200TruView-6200ARX 4200ARX 5000ARX 6000 Monitor4 X 1Gbps 2 X 10Gbps 2 X 10Gbps 4 x 1Gbps 2 x 10Gbps 2 x 10G (Fiber) Throughput 4 Gbps5 Gbps10 Gbps~120,000 flows perminWrite to Disk 4GbpsLine-rate analysis: 3.5 to4Gbps~800,000 NetfFow recordper minWrite to Disk 4.5GbpsLine-rate analysis: 4 to6Gbps~2 million NetFlow recordsper minWrite to Disk 9-10GbpsLine-rate analysis: 6 to7Gbps Storage8 - 44 TB12 - 48 TB24 - 48 TB16TB29 TBUp to 125TB available withexpansion chassis48 TBExpands to 264TB Rack-Space2U - 4U2U - 4U2U - 4U4U (66cm depth)4U (66cm depth)5UARX 6000•Meets needs of large enterprise customers for faster processing / write to disk. •Double the size of ARX 5000✓ 2 x 10 GbE monitoring ports✓48 TB storage✓Dedicated solid state drive (SSD) storage for OS and DB✓ 5 Rack Units (RU)✓Power units: 2 minimum; 4 for redundancy•Double the performance✓9-10 Gbps packet write to disk✓9-10 Gbps packet analysis when dedicated to ASADedicated to ASA means no other modules, e.g., WTA, NetFlow, VoIP/video, DB ✓6-7 Gbps packet analysis in multi-app modeAll modules available•Similar specification, but 3xlonger storage availablewith ARX, plus separatelonger-term “anomaly”traffic buffer. STORAGE•5000 Series ARX stores26TB of rolling capturedata.•Expansion chassisgoes to 125TB.•TruView 6200 applianceholds 24TB of rollingcapture. Expansionchassis goes to 48TB.Fluke•The key factor with both devicesis that packet capture rate andreal-time data analysis rates aredifferent. ARX processes a muchwider range of metrics at up to6Gbps.•No directly comparative stats canbe found for TruView, but itshould be a consideration. DATA ANALYSISRATE(real-time metricsprocessing fromtraffic)•5000 Series ARX handlessustained traffic analysisrates of 4 to 6Gbpsdepending on packet sizes.•The 5000 handles bursts ofup to 20Gbps.•ARX 5000 offers a NetFlowanalysis rate of up to 2million TCP flows-per-minute.•TruView does not providea line-rate throughputvalue for analysis, butprovide a NetFlow figurewhich equates to approx120,000 flows-per-minute.Fluke•Automatic de-duplication means thatwhen IP conversations traversing 2different points in the network areboth fed to the same probe, the sameinformation is not double-counted.•For reports charting data usagevolumes, TruView would double-account data under thesecircumstances.PACKET DE-DUPLICATIONAll ARX modelsautomatically de-duplicatereceived packets to preventdouble-accounting.This de-duplication isstateful so that an ARX canmonitor either side of afirewall (which may altersequence numbers) and stillde-duplicate packetscorrectly.•TruView does not appearto offer packet orNetFlow record de-duplication features.Fluke•TruView captures ata faster rate thanARX,DATA CAPTURERATE•5000 Series handles4.5Gbps sustained.•TruView 6200 claims 10Gbps.Several tests have verified this,but primarily for “clean” disks.The capture performance whiledeleting older packets isunclear.FlukeCONFIGURATIONLogical IP GroupingAll ARX models can create “Business Groups” of anycombination of logical IP addresses so that individualdepartments/server clusters etc. can be reported against.TruView can group addresses into “Sites”, and then can group Sites into“Business Groups”. However, based on the “Visual Performance” manual,it appears that each site definition can only be defined in terms ofcomplete subnets. It does not seem possible to isolate individual officeswhich share the same subnet rangeTruView’s limitation in defining logical IP groups means thatit would not be possible to subdivide buildings or facultiesthat all share the same address range. This means thatper-faculty data usage analysis would not be possible.ANALYSISFluke ConsequencePacket Interrogation Aside from the normal IP filter &time-based packet extraction, ARXalso offers automated capturesbased on breached alert conditions.If an ARX alert is triggered, it willautomatically filter a capture basedon the time & associated IPs andsave that capture in a separateanalysis buffer. The capture can beaccessed directly from a link in thealert.ARX also performs these captureswhen an internal baseline alerttriggers.The analysis buffer is separate to themain capture buffer and sooverwrites at a much slower rate. TruView has a workflow for drillinginto packet traces based onperformance breaches, but it isextracted from the main file-store.There is no separate buffer conceptfor “interesting” captures.There is the potential for the capturefile contents to have aged out inTruView if troubleshooting activitiestake place too long after the alertcondition was raised.Monitored Metrics ARX holds a much wider range ofmetrics than TruView. These metricsoffer added visibility into issues suchas firewall blockages and worm-likebehaviour. TruView has the basics ofthroughput, latency, response time.The lesser set of TruView metricsmeans that troubleshooting &alerting occurs over a smaller rangeof issues.Response Time Analysis ComparisonConnection Setup – Low server resourceServer Response – Poor application performanceData TransferNetwork RTT (In) – LAN side latencyNetwork RTT (Out) – WAN side latencyRetrans Delay – Effects of packet loss on performanceApp ResponseData TransferNetwork RTTARX also includes for every IP address & Business Group:Connection Failures – Misconfigured firewall / ACL or crashed applicationApplication Turns – Gauge of how well an application will operate over WANsServer Reset Rate – Gauge of failing applicationPacket Payload size – Gauge of network efficiency of application communicationFluke ConsequenceApplication Response Time Analysis ARX & TruView have similar responsetime analysis graphs, but ARX will givedeeper insight into whether an issue isdue to server hardware or pureapplication performance.Similarly, the effects of packet loss onapplication response time are shown.Also, the de-duplication features of ARXhelp distinguish between a genuineretransmitted packet, and a SPAN-repeated packet to give more accurateresults.TruView only displays data transfer time,“application response” and latency valuesfor its troubleshooting graphs. Theeffects of packet loss are not shown(though the percentage packet loss valuesare available).The richer metrics of the ARX ResponseTime Composition chart provides greaterinsight into understanding the cause of aperformance problem. (3 metrics vs. 7)Web Page Analysis The ARX Web Transaction Analysiscapability automatically detects & tracksthe performance of complete web pages& associate page objects. HTTPSencrypted web sites can also be analysedreal-time if the key is provided.User account information is also gatheredfrom URL structure, cookies & session IDsto help determine who exactly isexperiencing performance issues. TruView monitors & reports on individualweb page objects, but does not correlatethese into an overall page performancevalue.There is no obvious method of decryptingHTTPS in TruView.TruView does not appear to support useraccount tracking.The apparent lack of HTTPS support maypreclude some web apps from beingmonitored by TruView.ARX provides better insight by alsoproviding overall page load times.ARX’s ability to track usernames meansmore accurate & focussedtroubleshooting.Fluke ConsequenceData Correlation ARX can, on a single graph,correlate any combination ofmetrics & business groups toassist in troubleshooting. TruView is restricted to certainkinds of graphs (e.g. applicationperformance, network) whichhave to be shown next to eachother to correlate. The metricscannot be mixed.The limited methods ofcombining metrics for analysismeans that the troubleshootingcapability is reduced in thisarea.Data Interrogation ARX can drill into BusinessGroups to show individualapplications, IPs, connectedGroups and all the associatedmetrics.Similarly, interrogation canbegin from a specificapplication, IP address orsubnet range. TruView has some drill-down &Site-to-Site connectivity drill-down, but it is nowhere near ascomprehensive as ARX.For determining issues withinisolated groups or individualIPs, TruView will not be able topresent the informationrequired to the same depth andgranularity as ARX.Fluke ConsequenceSNMP Monitoring ARX does not monitor SNMP bydefault, but there is additionalsoftware (App Sensor Xpert)which integrates to providedetailed SNMP metrics ofservers & network devices,including Cisco IP-SLA metrics. Fluke has similar SNMP pollingcapability.Both solutions can offer acombined traffic flow & SNMP-based analysis of the network,though Fluke offers thecapability in a single device.ANALYSISARX can report on any combination of metrics, applications & Business Groups it has observed.TruView has a custom reporting capability, but they are limited in comparison by the fewer number of metrics, and the lower granularity of business group’s definition. There are also fewer reporting templateformats available.Customisable Reports TruView cannot produce faculty data usage charts with the same flexibility as ARX, which means the exact output format required might not be possible.ARX itself has a limited range of web dashboarding capability, however the “Riverbed Performance Management Web Dashboards”product (free of charge) has a customisable webview which can present ARX data in a variety offormats from Charts to Dials toRed/Amber/Green status lights for BusinessGroups and/or applications.Output from separate appliances can becombined into a single pane, merging the data.Output from other OPNET products can also bebrought into dashboards if required.Dashboards are role-based, so different viewscan be created for different users.Dashboard segments can have their URLs mailedto other people for specific analysis.TruView has a goodrange of webdashboarding capability.RPM WebDashboardsSimilar dashboardappearance can be achievedusing both toolsets, though itis not clear if TruView cancombine the output ofmultiple appliances like theRPM Web Dashboardscapability, or “blend” datafrom disparate sources toform a single average.ADDITIONAL FUNCTIONALITYTruView has a spread of capability in these areas,but do not provide the same level of detail. Theproduct roadmap is unclear.Riverbed provide several additional modules for specific analysis e.g. Citrix, SQL, internal VMware &soon Video. The TruView solution may not be able to keep pacewith the troubleshooting requirements of new technologies implemented overtime.Wider APM Community (Notes/Publications)OPNET were marked as outright leaders in the August 2012 Gartner Magic Quadrant. Fluke were not listed in any capacity.[TruView] “Installation can be somewhat complex. However, that complexity correlates directly to the complexity of the network to which a Visual TruView appliance is being connected”. SHU’s appliance connection points will be practically identical, but t he IP address grouping configuration of the monitored elements will be very difficult with very difficult to define within the TruView limitations.Visual TruView captures all traffic on the network and captures all the correlating information, allowing any "conversation" to be rebuilt, analyzed and measured. However, capturing and storing that much information takes speedy hardware and significant storage capabilities, which ultimately dictates which appliance to use or if multiple appliances are needed. There is also another consideration here: The sheer volume of data being captured introduces analytical complexities that are well beyond most platforms.Fluke Networks ANPM solution limitations:• Per end users, reporting could be improved. In particular, there is a desire to be able to automatically generate reports a ll with the same views.• End users also would like to see more automated correlation of metrics of different types and from different ANPM andsupporting sources.+R iverbed P erformance ManagementOPNETWORK focuses on advancing the state of application and network performance management.It is the largest event of its kind, attracting thought leaders from industry, government, and academic communities from all over the world. OPNETWORK 2013 will be held August 26-29 at the The Ronald Reagan Building, Washington, D.C./opnetwork2013/Thank YouExtra - RPM Dashboards。