Riverbed & Mazu, Bluecoat & Lancope, Lenny & Squiggy.

By Steve Harriman

Last Tuesday, Riverbed, known primarily for Steelhead, its WAN optimization controller (WOC), acquired Mazu, known primarily for its network behavior analysis detection (NBAD) tool Mazu Profiler. Riverbed said that they’re planning to integrate Mazu’s technology into their own products.  Similarly, Blue Coat, another WAN Optimization vendor, announced earlier today that they are going to partner with Lancope, another NBAD vendor, for much the same reason.

Before the acquisition, both Mazu and Lancope had been retooling their messaging – moving from a security focus to a more of a network performance monitoring focus in an attempt to appeal to a much broader market. In the long term, it’s likely that NBAD is unsustainable as a standalone market – but could be part of the broader set of network performance management disciplines. It appears that the WAN optimization vendors agree and are becoming interested in expanding their performance management capabilities. Indeed, Blue Coat already demonstrated this with its 2008 acquisition of Packeteer. In hindsight, it’s a little strange to see network performance monitoring and network behavior analysis as two separate fields.

However, these flow-based NBAD technologies should not be confused with the Cisco-NetQoS technology in Cisco’s WAN Optimization offering–WAAS. In July of 2007, Cisco and NetQoS jointly developed instrumentation for WAAS devices that feeds key performance data to our application response time monitoring product SuperAgent.  SuperAgent was designed from day one to track application-by-application, subnet by subnet, the end-to-end performance of applications running over WANs, and merely had to be adapted to the optimized WAN environment. The SuperAgent-WAAS integration restores visibility into optimized WAN links which create unique visibility problems by breaking the TCP streamup into three separate streams. Without instrumentation in the WAN Optimization Controllers (WOC), you need to have monitoring equipment on both ends of the optimized connection. That gets expensive, so it makes sense to have the monitoring software embedded (at no additional cost) in the WAN optimization equipment.

Without this tight integration, you can still derive a lot of performance-related information from the WOCs as long as they export standard network flow datagrams, notably NetFlow or IPFIX. This data provides visibility into traffic composition across the optimized link so you can see what effects the WOCs are having in reducing traffic. However, it doesn’t tell you anything about the end-to-end response times so you can’t tell if they are better or not (which is severely disappointing if that’s why you bought the WOCs in the first place). NetQoS customers use our ReporterAnalyzer product to monitor NetFlow/IPFIX exports from these WOCs, including those from Cisco, Riverbed and Blue Coat.

It’s not just enough to optimize a WAN connection and hope for the best. If your WOCs–from whatever vendor you choose—are to be effective, they should be monitored. In fact, it’s really smart to monitor your links before you deploy WAN optimization gear so you know which remote sites are the best candidates and to give you baseline performance statistics. Performance monitoring not only helps you measure the performance improvements you’re getting, it helps you solve problems faster.

Given this, it may seem strange that Riverbed would be interested in NBAD technology which gives it NetFlow visibility but not latency visibility across the three segments of the optimized WAN link. We should assume that Riverbed will use its newly-acquired technology for more general purpose monitoring and expand its capabilities over time. Interestingly, Blue Coat’s roots are in the security space and it’s quite likely that Riverbed’s acquisition was, at least in part, intended to bolster its own security-related offerings.

NetQoS has offered NBADcapabilities in the NetQoS Performance Center since February of 2008.

[In the interests of full disclosure: Network Performance Daily is the “house organ” company blog of NetQoS, and is competitive in the behavior analysis space to Mazu and Lancope. –ed.]

Steve Harriman is VP of Marketing at NetQoS.

Chandra Hosek, Ben Erwin, and Andrea Stout contributed to the research of this post.