Net Optics Director Pro Combines Deep Packet Inspection And Load Balancing

Anyone who need to view network traffic for application, network or security monitoring knows the difficulty in getting traffic from the wire to the analyzer.  Physical and network interfaces have to match exactly, or IT is forced to use switch-span ports that can place additional load on the switch fabric and limit the output speed. Net Optics announced a new inline tap that supports 40Gbps pass through traffic, a  Gigabit Zero Delay TAP and a Director Pro with hardware based deep packet inspection and dynamic load balancing. Director Pro starts at $19,500.

The two new taps are, in a way, incremental improvements to existing passive tap products. The 40Gbps tap is, as far as we can tell, the first 40Gbps passive, full duplex network tap on the market, but we are sure there will be more to follow. Net Optics Zero Delay tap preserves the electrical connectivity to connected device ports, ensuring that if there is a power failure to a Zero Delay tap, the connected devices won't detect the electrical failure and have to renegotiate the physical link.

The bigger news, however, is Director Pro is a new hardware platform that adds additional processing power for performing deep packet inspection (DPI) and load balancing. Existing Director products are not field upgradeable to Director Pro, but both Directory and Director PRO use the same hardware interface modules.

The DPI function allows IT administrators to set-up filtering rules based on patterns that can match anywhere in the packet. Other intelligent tap products like Gigamon's Gigavue has had DPI pattern matching for quite some time. DPI is used to direct matching packets to specific output ports. Net Optics Director and Director Pro can direct packets to specific ports based on a variety of parameters like IP addresses and port numbers, but with DPI, IT administrators can direct only HTTP traffic, regardless of the TCP port being used, to a specific port based on the discovery of an HTTP header. For example, an IDS might be tuned to look for malicious traffic in the HTML responses like SQL Injection or Cross Site Scripting from a client to a server, and you want that traffic to be processed by the IDS. Other HTTP traffic such as images and videos don't need to be processed and won't be sent to the IDS. Or you might want to direct HTTP files like images and videos to be an anti-malware product. Using DPI, setting up those rules allows you reduce load on analysis devices.

Director Pro also allows dynamic load balancing, which can spread traffic flows among a number of different output ports. As network speeds increase beyond 10Gbps, analysis products have a hard time keeping up. Just like load balancing incoming HTTP connections among multiple servers lightens the load per server, load balancing captured traffic among multiple analysis products--multiple IDSes, for example--lightens the load per IDS.Load balancing can be round robin where packets are sent to output ports in sequence. Round Robin might be used in cases where the analysis product receiving the packets has multiple interfaces and can rebuild the traffic flow across all the interfaces. For example, an analysis product might perform TCP off-load on the NICs to relieve that processing from the CPU. By sending packets in a round-robin fashion to the appliance can manage higher capacity.

Flow-based load-balancing is more intelligent and can forward all the packets in a network flow, loosely defined as all the packets between to network nodes, to an output port. Flow-based load-balancing is used in cases where there are different analysis engines attached to a network port. For example, if you have multiple IDSes analyzing traffic, each IDS needs to see all of the packets between two nodes that make up a flow to detect malicious traffic. Director Pro can load-balance flows between two nodes based on IP addresses, meaning all the packets between two nodes will be sent to the same output port. In addition, load-balancing can occur based on source IP address or destination IP addresses. Flow-based load-balancing allows the IDSes in our example to see the entire conversation between client and server while balancing conversations among multiple IDSes.
 
The intelligent tap market is getting interesting.  Director Pro adds some welcome features to network taps. The load balancing might give you more life out of existing analysis equipment without having to go through upgrades to keep up with network speeds and feeds. There are some features, like packet-slicing (removing a payload) and  data-masking (overwriting data), that intelligent taps, such as Gigamon's Gigavue 2404 offers, can aid in conforming to privacy policies while allowing analysis to be conducted. It looks like your options are expanding.