Next Generation of PortMonitoring using SDN by Big Switch Networks Big Monitoring Fabric

I was really fascinated by the BigSwitch Networks Presentation from Rob Sherwood at NetworkFieldDay11 . It was fantastic in many different ways. First Rob is a great presenter that can show even very complex content in an easy to understand way and also keep the presentation entertaining. In the past I have seen a lot of presntations that overused SDN as a major bussword in every second slide. I didn´t like that hype. Here at BigSwitch it was the opposite. Rob Sherwood was one of the early pioneers of SDN and activly envolved during the devolopment of SDN technolgies. He didn´t even mentioned the word SDN.  He showed a practical usecase that runs SDN technology in the backround. I am more interested in what we can do with a technolgy instead of talking about a technolgy just for the sake of it. The usecase that was presented here is a TAB or Monitoring Network. To protect a datacenter it is very commen to use a set of tools or Tool Farm with a varity of different technolgies like FlowAnalyzer, IDS, IPS,  ect. All of them will need to have a copy of the actual traffic that is going across the Links of your datacenter. With only one tool you could get away with a standard span/monitoring port , but when you are using multiple tools and would like to see the traffic on different links like e.g. inside and outside of your firewall, you need an extra dedicated TAB Network that can deliver you the different monitored sources for your toolfarm. If you have deployed that you know “where to find the rainbow in your network”. That was done in the past with special hardware or TABs. The approach from the Big Switch Monitoring Fabric is to use standard whitebox switches for that with the BigSwitch Software on top. With the software based appoach you get a much more flexible TabNetwork that can be programmed via API and is capbale of Event triggered Monitoring. That wouldn´t be possible with only switches. BigSwitch introduced a new component witch they call Service Node. It is a x86 based server that uses DPDK in the backround to do all the magic that can not be proceded  by a switch. The Big Monitoring Fabric is the first product that uses the Service node but I suggest in the Future all the really exciting new stuff  from BigSwitch will be done with some kind of x86 servers that have more flexebilty from a software capability standpoint.

The network Autobahn View

Building Tab Networks was always a very difficult, static and expensive task in the past. I like the new approach of the Big Monitoring Fabric to address the task. It adds plenty of choices. For me the most exsiting thing here is that SDN shows its potential for new real world products. I suggest we will see more of that in the future. The other point here is that Big Switch has understand how the modern more community based marketing works. All of the BigSwitch major releases have been announced at a Networking Field Day event. You have to address your massage to the right audiance.

http://www.bigswitch.com/sdn-products/sdn-products/big-monitoring-fabric