Blood Center Draws On Flow Technology To Monitor IT Performance

It wasn't that long ago that Puget Sound Blood Center (PSBC) had to pore through various system logs to uncover problems and determine whether the trouble was with its network or its applications. But now, the Washington nonprofit blood center can check bandwidth, network performance, link utilization and more in real time--all in an effort to ensure its services such as transfusions and transplantation support are available to the more than 200 hospitals and clinics it serves across the Northwest.

PSBC employs a system from Lancope that uses flow-based network performance and security monitoring to help manage 1,200 devices connected to its network. The network is used by 17 remote sites (connected via MPLS circuits). The sites include 11 donor centers where people donate blood, four labs where blood is prepared for hospital patients, and several locations for tissue banking. The blood center's operations also include mobile units that travel throughout the state and regularly connect to the network via air cards from Verizon, says Peggy Dunn, PSBC's IT director.

The center needs a high level of network visibility because of the network's far reach and because it has to ensure that its Blood Establishment Computer System is available around-the-clock to support patients. But the organization lacked real-time monitoring capabilities "We relied on mostly logs to figure out what had happened, after the fact," says Dunn. "We wanted to be able to see activity on the network, while it was actually happening."

PSBC was already using a version of Lancope StealthWatch to help it troubleshoot, but that implementation did not take advantage of Lancope's probes and thus had no real-time visibility. But when PSBC upgraded its LAN, installing new Cisco and Hewlett-Packard switches and routers, the time was right to upgrade the StealthWatch system and start collecting real-time data, says Vickie Dahl, IT network manager at PSBC.

Lancope analyzes and reports on the flow records generated by networking equipment such as NetFlow in Cisco devices and sFlow in HP and Brocade products. Lancope uses appliances - collectors and managers - that cull data in real time from the flow logs and presents the data in various reports, graphs, and more. The flows can be processed into a wide variety of reports to show Internet use, identification of suspicious uploads, and other metrics. The system eliminates the need to put packet sniffers out at all the remote sites, a particular advantage for PSBC with its dispersed computing environment. According to Lancope, up to 1,000 flow sources can send flows into one collector, and a manager can support up to 25 collectors.

PSBC is using Lancope's StealthWatch Xe for NetFlow and sFlow, the StealthWatch IDentity appliance and the StealthWatch Management Console (SMC). Lancope's StealthWatch IDentity appliance links individual users and specific network events. PSBC administrators simply request the username(s) and IP address associated with an event from the SMC, and the system returns the appropriate information in real-time. StealthWatch lets PSBC to monitor network traffic in real time and instantly drill down to any segment, device, application, host or user. This ability means Dunn and her team don't have to travel to remote sites, hook up to switch ports, or follow cables to help troubleshoot problems. StealthWatch also provides audit trails necessary in resolving even sporadic network issues.

One of the biggest benefits is that the product has helped to eliminate the finger-pointing that occurs all too often in IT organizations. "One of the things that has always been frustrating is users will call in and say, 'Oh, the network is really slow, I can't open any applications,' and we have been able to pinpoint that it isn't the network that is slow. Everybody always blames the network, but here, in most cases, it has been the application," says Dahl.

The product also helps PSBC with capacity planning. Dunn says she receives monthly reports that detail bandwidth utilization, and has documentation to show that the organization is adequately provisioned. In addition, Lancope has helped PSBC find and eradicate viruses that had found their way onto a few of the organization's computers. Dahl says there are several capabilities that PSBC has not yet tapped, but the organization plans to see how it can use those, such as real-time security monitoring.