by Phil Hippensteel

Is your network blind to video traffic?

Reviews
Jul 28, 20149 mins

Here’s a look at 5 products that manage video in the enterprise.

Ever since 2010, when Cisco predicted huge amounts of video traffic on worldwide networks, IT managers have been cautiously watching for it to occur. Cisco’s most current prediction is that 73% of all Internet traffic will be video by 2017. Whether we’ll reach that level remains to be seen, but we have observed significant increases and it is reasonable to assume that much of that traffic will creep into enterprise networks.

Also, the amount of such traffic is likely to be higher than IT managers suspect because most monitoring tools only recognize certain forms of video. Since IT managers are likely looking for tools to manage video traffic, we decided to see what products are available and analyze where additional needs exist.

+ Also on Network World: What is WebRTC? +

The ability to see video on your network depends on the type of video. There are four distinct categories:

  1. Video in the form of mpeg transport.

This is often referred to as IPTV and appears often in healthcare, education and in conjunction with the use of security cameras. What characterizes this traffic is the fact that each IP packet uses UDP and has several smaller mpeg packets within the payload field. These mpeg packets carry the compressed audio, video, and a description of the stream.

  1. Two-way video as in videoconferencing.

This nearly always looks like VoIP with large payloads. It’s characterized by the use of UDP and RTP (real-time protocol). In this case the signaling information is handled by a separate protocol, H.323, SIP or Cisco Skinny protocol.

  1. Adaptive streaming video.

This is the only prevalent form of video on the corporate network that is carried by HTTP/TCP. However, because it is in the payload of TCP segments, many decoding tools have no idea whether it is audio or video. The metrics to monitor its performance are much different from IPTV or videoconferencing. Almost all adaptive streams are in one of three formats: Microsoft Silverlight, Adobe HDS (HTTP Dynamic Streaming), or Apple HLS (HTTP Live streaming).

  1. Streaming real-time with RTSP (Real-time Streaming Protocol).

This common and fast expanding form of video most often emanates from security cameras. In a manner similar to adaptive video, it often goes undetected because it is carried by TCP. Consequently, network monitoring tools may not detect it and it may be more prevalent on networks than managers realize.

The difficulty IT managers encounter when looking for appropriate tools results partly from the way the vendors have aligned themselves. Those with the most powerful tools have focused on the service provider market, specifically telephone and cable companies. These include IneoQuest, Telchemy, JDSU and IXIA. Companies with an enterprise focus include SolarWinds, Fluke Networks, NetScout, the Network Instruments Division of JDSU, and Cisco. However, since the physical interface to the network is more often Ethernet than was previously the case, the tools are now gradually being used across the service provider/enterprise boundary. Here’s an analysis of some of the top vendors:

Telchemy

By placing its small efficient agents in companies’ products, Telchemy is part of millions of devices. For example, the agent VQMon, is embedded in TI chipsets, Polycom endpoints, and many test products. VQMon measures almost every critical parameter of all types of video. Coupled with Telchemy’s SQProbe 3.0, a passive software probe, users can measure loss, jitter, and estimate MOS (mean opinion scores) and R-factor scores for video quality. These are industry standard measures used in video conferencing.

For mpeg transport streams, such as IPTV and Apple HLS, SQProbe will detect I, P, and B frames and report standard metrics prescribed by TR 101 290. This standard assures that certain metadata values and stream descriptions are sent frequently enough for the receiver to understand the stream structure and remain synchronized. This information is critical, for example, for the user’s device to know how to find the various channels. In addition, as long as the stream isn’t encrypted, the payload can be extracted from the packets and the measure of the actual image quality can be estimated.

Possibly the stellar achievement of Telchemy’s software is the ability to analyze Adobe, Apple, and Microsoft HTTP streams. The vast majority of products targeted to the enterprise won’t even know the video payload is present in the packets. As it becomes more dependent on delivering sales presentations, product descriptions, training, and executive briefings, the ability to support this form of video is probably going to become critical.

IneoQuest

VeriStream is an IneoQuest tool that targets adaptive streams like those of Adobe, Microsoft, Apple and YouTube. While the product is aimed at the service provider market, there is no reason it can’t be used in the enterprise. The core of its method centers on determining if the server is transferring the video at the same rate, slower or faster than the rate at which it is being viewed. Consequently, it can predict the likelihood there will be rebuffering or loss from oversupply of content.  A Dialogue ASM device with the company’s iVMS ASM software displays simple to understand screens for the network operator to monitor.   Color coded bars indicate the likelihood of rebuffering for each stream detected.

IPTV is IneoQuest’s strong suit. They completely decode and present the critical information about an mpeg transport stream. You’ll be able to tie channel numbers to UDP ports, get measurements of the video quality, and find a myriad of other useful statistics. Unfortunately, IneoQuest doesn’t have good tools for videoconferencing analysis. Since service providers are only beginning to offer videoconferencing cloud services, monitoring this form of video has not been a top priority for the company.

Cisco

The set of tools that come from Cisco is comprehensive. However, like most of its products, use is limited if network devices and endpoints aren’t Cisco-centric. The key ingredient in the architecture, called Medianet, is the software agent Media Services Interface (MSI). With that module installed in key endpoints and network devices, Cisco says it will detect nearly every form of video flowing on the network. This includes conference endpoints, security cameras, and unified communications clients. Traffic can be identified, have flow quality methods applied, and traffic statistics gathered. It is not clear whether adaptive streams could be detected or managed.

Wireshark

Free tools should never be overlooked and Wireshark has some remarkable capabilities relative to video. Video calls set up by devices using H.323 or SIP will be detected. Key statistics about the flows will be available in a format familiar to those who worked with VoIP. While it doesn’t currently have features specifically targeted to adaptive streams such as Flash, Silverlight and Apple HLS; it will decode the mpeg packets carried in the payload. You need to be well versed in how to filter traffic from your streaming servers to get the most out of Wireshark, as unfiltered capture files will routinely contain hundreds of thousands of packets. As the amount of video on networks continues to grow, Wireshark developers need to find user-friendly screens that will help users monitoring security video and adaptive video.

Network Instruments (JDSU)

Network Instruments has been a major player in the data analysis, VoIP and video conferencing area over the years. It was recently acquired by JDSU. Featuring the ability to capture vast amounts of data for post capture analysis, the company positioned their GigaStor product with Observer management interface software as an enterprise tool for network forensics. Observer has an interface somewhat similar to Wireshark, but underneath it’s very much different from a video perspective. It has the ability to identify video flows that use RTP or RTSP. So, it’s useful for analyzing videoconferencing and security video traffic. This is the only enterprise product that has the capability to compete with IneoQuest and Telchemy.

It reports the key statistics for IPTV that allow determination of whether streams comply with TR 101 290. This standard assures that your encoder vendor is sending key metadata frequently enough to assure effective management of the streams. You’ll also be able to pull out the payload of IPTV streams and look at the video to observe tiling and screen break-up. With RTSP traffic from security cameras, you’ll be able to see the timing information in the RTP headers that are encapsulated inside TCP. This is an unusual capability. Still, the real power of the product is recording and trending traffic over long periods of time. Discovering problems in video is often the tedious chore of looking at tens of thousands of packets to discover an event that lasted a sub-second interval. Adaptive video is an area that Network Instruments has little capability, but is currently investigating. Yet, it already has some capability with this traffic if you look at adaptive video as a series of repeating short file transfers.

Other players

We looked at some other products that claimed they analyze video. Some admitted this was an area of development for them. Others thought they did a good job until we pointed out several areas of weakness. These included SolarWinds, WildPackets, NetScout and Frederick Engineering. SolarWinds is prepared to make some significant announcements about video later this year. Wild Packets decoded some forms of video, but didn’t really recognize the need to decode adaptive streams.

After looking at all these products, we believe the best overall fit for enterprise customers who use a lot of video is Network Instruments GigaStor. It decodes and analyzes the most common forms of video, has strong customer support, and has demonstrated the nimbleness to adapt to changing trends in the use of video in the enterprise.

Hippensteel is a professor, consultant and writer with over 40 years’ experience in higher education. He can be reached at pjhippen@centurylink.net.