Fluke's VPM 4.0 Suite Ably Keeps An Eye On Networks

We were all set to dismiss Fluke Networks' revamped Visual Performance Manager 4.0 as mere network management eye candy. But when we tested the updated network performance tools on our production network, we were impressed -- particularly with the new VPM Portal's views of the entire VPM array.

VPM aims to cross IT silos with end-to-end common views of server and client interactions. Fluke isn't quite there yet: VPM lacks small, fixable stuff, like reading tagged virtual LANs. But overall, this is a good first go.

Unlike other big network systems management vendors, Fluke seems to be improving rather than cannibalizing acquired technology. VPM's core Tracker technology, which Fluke purchased from Crannog and Visual Network, provide handy network diagnostic tools for LAN and WAN spaces. Likewise, the VPM Portal is a strong first effort: The standard analysis tools are there, the integration is adequate, and the usability is well done.

Be forewarned, however: It will take some expertise to understand and use the deep performance data dives this product reveals. In addition, the product relies on visual rather than database-integrated correlation: VPM 4.0 only sees two tiers into an n-tier application farm. It also cannot handle virtual LAN-tagged data streams. Given that VLANs are a way of life for many, this qualifies as a glaring omission. Fluke claims it will address both of these shortcomings in future versions.

VPM 4.0 combines Fluke's Netflow analysis and its UpTime LAN/WAN performance probes. The Application Performance Appliance houses the database and runs the UpTime data analysis/data collection tools. VPM displays the output from these two tools, combining personalization and well-thought-out navigation options. Anything from SQL statements, client behavior, and historical trends, to real-time network performance, can be viewed in the portal. Behind the pretty customizable VPM Portal face are options beyond the usual views. For example, report and distribution policies can be centrally pushed to all appliances, and thresholds for alarms can be static or learned. Data is stored in MySQL or Microsoft SQL databases. Application definition is manual and static, but it's not that tough, requiring some table configuration. Integration within the portal for Tracker is done by publishing URLs within the VPM portal interface -- which sounds more complex than it is. What We Tested

We ran port-mirrored traffic and Netflow traffic to the APA and Tracker Appliance, respectively. VPM shows customizable tabs for My Dashboard, Application Response Time, NetFlow Tracker, UpTime Select, Reports, and Alarms. The default dashboard includes a useful Response Time Breakdown chart, which stacks application, payload, and network response times.

With a single dropdown, we moved from a 60-minute to a 30-day view without any configuration work, and other graphs, such as Number of Transactions, TCP Retransmissions, and Data Rate, automatically adjusted their time range. This allowed us to spot performance issues during periods of increased application response time, and drill down to analyze the trouble.

Tracker shows what users are experiencing and doing on the network. It keeps every flow and both sides of a conversation, and lists all applications for a configurable time up to three months. Long-term reporting is user-configurable to 999 years.

One of the nicest features about the Tracker views is that their access can be limited: Drilldowns can be removed, preventing unauthorized access. So the boss gets a view that won't hurt him, or you. Another really cool Tracker capability is source address dissemination, which shows how many conversations an IP address is having per second. Besides performance information, it showed us hosts with balanced transmit/receive transmissions -- an indicator of hosts being scanned. We could then focus on the hosts running the scans. Tracker allowed us to view the usual top 10 by error, bandwidth, server, application, etc., but we could also see the bottom n devices if we wanted, since all conversations were captured. VPM 4.0 isn't cheap, but it's not out of line with other network systems management offerings. The VPM portal is free. The APA starts at $25,000, and software is $40,000 per APA. Netflow is licensed by device monitored, which means a multiple interface router/switch only counts as a single device. A 10-device license is $9,000, with tiers running up to a 500-device license for $175,000. UpTime WAN and LAN probes range from less than $1,000 to $10,000 for T3 and 1-GB probes. Annual maintenance ranges between 10% and 18% of retail across the product line.