At least that's the idea. To see how well vendors' claims really stack up, Network Computing joined forces with Network Test, an independent test lab based in Hoboken, N.J., and Netcom Systems to devise the largest public test of bandwidth managers yet conducted. For more than a month, we pounded four bandwidth managers with traffic from up to 200 concurrent Web sessions--nearly a tenfold increase over previous tests.

The results are promising. Although no device hit our desired bandwidth targets dead-on, all four products came reasonably close. Heading the pack this time was Cisco Systems' 7206VXR, which not only performed best overall but also includes by far the richest set of tools for enforcing service levels. Cisco's device walks away with our Editor's Choice honor.

Deserving particular notice are two unique entrants: Allot Communications NetEnforcer AC301 was the only product we tested with knobs to deal with bursty data and to set upper bounds on latency--both highly desirable features when dealing with large numbers of concurrent flows. The most innovative packaging belongs to the tiny NetScreen-5 from NetScreen Technologies, a budget-priced SOHO (small office/home office) router that also offers outstanding firewall and VPN (virtual private network) gateway features. The fourth entrant, NetGuard GuardianPro 4.11 firewall software, isn't intended for use as a standalone bandwidth manager. Still, GuardianPro's Guidepost bandwidth-management module offers effective control over heavy loads, a capability that can be useful in combating denial-of-service attacks.

Here Comes the Groom

Bandwidth managers usually sit on the LAN side of a company's access router, "grooming" traffic before it hits the WAN. Because they're deployed at the borders of corporate nets, these devices also can act as traffic cops. Indeed, two of the products we tested--GuardianPro and NetScreen-5--offer firewall and/or VPN functionality.

This points to a trend: Bandwidth management is being added to boxes that do something else. Such products were intended solely for traffic management 18 months ago. Now all four products tested pull double duty. Besides tuning traffic, Allot's NetEnforcer AC301 is a load-balancer and proxy cache, Cisco's 7206VXR was a router long before it was a bandwidth manager, and the NetGuard and NetScreen devices offer many security features.

That's not to say there isn't a market for standalone traffic tuners. Noticeably absent from the test lineup is a product from Packeteer, which cited concerns with our test configuration. Packeteer's devices work by throttling client connections when congestion occurs, and our test created congestion only on the server side. We agree that our setup this time wouldn't have exercised Packeteer's device.

Another absentee is Check Point Software Technologies, whose management decided our test scenario would give short shrift to the firewall and VPN features in its product line. However, that concern certainly didn't prevent two other firewall vendors from participating. Lucent Technologies also declined to participate, simply citing a lack of resources.

Even with these absences, we found plenty to compare among the devices that did show. The differences begin with basic networking questions--such as whether the devices are bridges (Allot's), routers (Cisco's and NetScreen's) or both (NetGuard's). The products also differ on the interfaces they support, ranging from NetScreen's plain old 10-Mbps Ethernet to Cisco's choice of virtually every type of interface.

Class Struggle

More important, devices vary widely in the criteria they can use to classify traffic. Classification is critical because it determines which traffic will receive preferential treatment when congestion occurs. For example, during overload periods a bandwidth manager might drop some Web traffic from a given IP subnet to ensure that mission-critical TN3270 flows get first crack at the available capacity.

The Cisco 7206VXR offers the largest number of traffic classification choices, from MAC (Media Access Control) addresses at Layer 2 to URLs and cookies at Layer 7. Allot's device also can parse URLs. However, neither vendor chose to demonstrate application-layer traffic classification in our performance tests. That's because URLs are buried relatively deep inside packets, and finding and interpreting them adds latency. The common ground among all four products was the ability to classify traffic based on IP addresses and TCP or UDP port numbers.

Allot's and Cisco's devices are the only two to recognize two emerging QoS mechanisms--the IP precedence and DiffServ codepoint (DSCP) fields of the IP header. Devices from both vendors can classify traffic based on existing settings and can "mark" (change) packets with new IP precedence or DSCP values.