Thursday, October 6, 2016

Big Data Analytics for Your Network

The help desk just called. Users are reporting the wireless is down in your office, and nobody can get on the network. The wireless seems fine to you. You're connected. You ask a few people nearby, and they're connected too. You log into the WLC and don't see any problems. works fine. Maybe you should just turn the controller off and then back on again. That worked last time. No, that's a bad idea. It's the middle of the day and you actually need to troubleshoot it.

After a bit of troubleshooting, you determine the cause of the issue is not the wireless. The DHCP scope is exhausted. Users could connect, but they couldn't obtain an IP address. You shorten the lease time, expand the scope, and call it a day. While you're at it, you wonder if DHCP is the reason connecting has been taking longer than usual, so you fire up Wireshark.

Discover, offer, request, acknowledge. You remember that from a CCNA class half a lifetime ago. Looks good. Well, you think it looks good. It takes about 227 milliseconds from discover to offer. That's normal, right? You realize you're not sure what normal is. You don't know your baseline, and you have no idea how long DHCP should take from discover to offer or request to acknowledge. What about dot1x? Is the RADIUS server slowing things down? You really have no idea. It works. It's lunch time. Nobody is complaining - right now.

Ok, hopefully the way you run your network is nothing like this. However, let's face it: this is an exaggerated version of the reality that many deal with on a day to day basis. There is often little insight into the individual operations that contribute to network performance as a whole. "The wireless is down" could mean any number of things, many of which may be out of the purview of the team managing the wireless network. Troubleshooting is often a reactive process. Even when there is visibility into network operations and baselines are known, it can be difficult to determine if your "normal" is actually optimal.

I recently attended a presentation by Nyansa at Networking Field Day 12. Nyansa is a startup focusing on what they call Cloudsourced Network Analytics. Their goal is to go beyond providing visibility in the form of pretty graphs and actually provide actionable insight about how to improve the end user experience.

Nyansa takes a novel approach to analytics with a product called Voyance (for clairvoyance). Their VM-based "software crawler" ingests data from a SPAN port and performs deep packet analysis. The crawler can also read configuration data and other information from a wireless LAN controller (currently Cisco, Aruba, and Rucks are supported). Over time, Nyansa analyzes this data and baselines various operations on your network in order to let you know of possible problems when behavior deviates from your baseline. However, Nyansa goes deeper and focuses on user experience, not just individual network transactions. Nyansa aims to describe the quality of the end user experience in plain English and provide actionable insight about problems when they occur.

However, that's not the most interesting part of the product. The unique part of Voyance is the "Cloudsourced." Voyance takes anonymized metadata about the transactions on your network and ships them off to their cloud. Voyance then analyzes data from all of their customers in order to provide more valuable insight to each customer. Voyance also shows how your network compares to other networks of similar size in your vertical (education, manufacturing, etc). Perhaps your RADIUS server is running slowly compared to similar networks, but you never realized there was room for improvement. Maybe your wireless clients are more affected by congestion during peak hours than clients on similar networks, and you weren't aware this was a problem.

I have not yet had the opportunity to work with Voyance, so I'm not sure exactly how valuable these insights are in the current product. However, the concept of big data analytics for the network intrigues me. Right now, the primary focus of Voyance is wireless networks, but Nyansa is a startup that is rapidly adding features. I think there is great value in big data analytics, and I am very interested to see how Nyansa is able to correlate information and provide insight in ways we have not yet thought of.

Disclosure: I was a guest at Networking Field Day 12, and my airfare and accommodations were covered by Tech Field Day. Some vendors provided promotional swag such as t-shirts, backpacks, and stickers. However, there is no requirement for me to write about any of the presentations at Networking Field Day 12 or provide positive feedback about the technologies presented in any way. Any blog posts I write about Tech Field Day events I write because I am genuinely interested in the technologies.

No comments:

Post a Comment