Despite the hype around software defined networks (SDNs), the industry has yet to find a legitimate "low-hanging fruit" for the network technology. It appears, though, that one might be emerging, as several vendors have announced TAP aggregation as an SDN application. Earlier this year, when Big Switch launched the company it announced its own product called Big TAP. Later, Cisco released TAP aggregation for its Cisco ONE controller.
Well, last week Arista Networks announced its DANZ data analyzer, which is an application based on EOS (Extensible Operating System).
To say the TAP aggregation market is hot is an understatement. This once niche market has become one of the fastest growing markets in the network industry. In the last year, market leader Gigamon started prepping for IPO, VSS was acquired by Danaher Corporation, NetScout bought ONPATH, and Ixia purchased Anue.
The reason this market is so hot is that legacy network management solutions are old and outdated and, frankly, provide little value. The concept of SNMP-based solutions was fine when the infrastructure was all physical and static. Virtualization has had a radical impact on the data center as more and more infrastructure is becoming virtual and some of it even being put in motion. The only way to understand what’s going on is to have a view of the data center through the lens of the network. Cloud, virtual and mobile computing are network-centric compute models, and understanding network flows and behavior is the only way to truly understand what’s going on with the application experience.
Unlike the Big Switch announcement, though, the Arista network TAP is very robust. While it doesn’t have near the features of a dedicated vendor such as Gigamon, it does have a good chunk of them – enough to satisfy many customers. Think of the 80/20 rule, where Arista can provide base functionality for many customers who can move to a more advanced platform, like Gigamon's, when they need the advanced functions.
Arista released three categories of features as part of its release. Advanced monitoring provides features such as multi-destination monitoring, packet filtering and manipulation and TAP aggregation. The precision capture features include monitor and capture of packets, time stamping, and PTP1588 time stamping. Lastly, event-driven programmability includes a software-defined control plane, programmable data plane and advanced event management for better control of the data. The last set of features was made possible because of the open, programmable nature of Arista’s operating system, EOS.
Now, being a TAP is one thing, but the value of the TAP is really in its ecosystem of analysis partners that can leverage the data. At launch time, Arista announced several network analytic vendors as partners, including Corvil, Endace ExtraHop, Solarflare, Splunk and Riverbed/Cascade, giving them a whose-who of analytic partners. The only major vendor missing was Netscout, which has its own TAP, making a partnership difficult, if not unlikely.
As the market transitions from Gig and 10 Gig to 40 Gig and 100 Gig, I can see how the economics of using an integrated Tap allows network operations teams to not only deploy the faster speeds, but also manage the network. As the network scales and the need arises for dedicated Tap infrastructure and the advanced features, companies can then deploy infrastructure from vendors like Gigamon and VSS.
So, while not a sexy application, TAP aggregation is maybe the best use case of SDNs that I’ve seen to date. It’s kind of like how everyone wants to see Megan Fox in a movie, but sometimes Kathy Bates gives better results. Many of the organizations I’ve talked to that are looking at SDNs are doing so to reduce network complexity. So, even if the legacy network stays in place, the use of an SDN can increase network visibility greatly. Some may argue that this isn’t really SDN, but isn’t improving network visibility the first step in simplifying the network?