More than ever before, the IT network is a strategic asset to a business, and any downtime or degradation in network or application performance can directly impact an organization’s bottom line. This white paper looks at a methodology for solving network and application performance issues and outlines a new approach to getting to their root causes more quickly.
White Paper Table of contents The IT network is at the heart of most enterprises, supporting business-critical applications, providing the data on which business decisions are made and facilitating communications with customers, partners, suppliers and co-workers. More than ever before, it is a strategic asset to the business, and any downtime or degradation in network or application performance will directly impact the organisation’s bottom line. To deliver the service levels agreed with the business, the challenge is two-fold: proactively improve and optimise performance to ensure that the network delivers what users require, and resolve any problems that arise as quickly as possible to minimise downtime. This White Paper looks at methodology of solving network and application performance issues and outlines a new approach to getting to root cause more quickly. Network complexity makes problem-solving more difficult 2 The process for tackling network performance problems 2 Where problems can hide in the network . 2 A new approach to problem solving 3 a. Monitor/alert 3 b. Investigate 4 c. Isolate 4 d. Root cause analysis and problem resolution 5 e. Network optimisation 5 Solutions from Fluke Networks 6 Reduce the risk of network and application performance issues Your how-to guide to optimising network performance and minimising downtime Fluke Networks www.flukenetworks.com 2 White Paper Network complexity makes problem solving more difficult Getting to the root cause of network and application issues is increasingly difficult and time-consuming in today’s enterprise networks. Virtualisation is extending from the data centre to the desktop, cloud services are growing in popularity and BYOD (Bring Your Own Device) is here to stay, reflecting shifting work patterns and cultural change. Problems may result from a proliferation of WiFi devices, excessive use of bandwidth by unauthorised applications, configuration errors, poor application delivery infrastructure or many other sources. The increasing inclusion of voice and video adds more complexity and pushes bandwidth to its limits. Solving performance problems is made more difficult and time-consuming by the challenge of trying to ascertain whose responsibility they are, particularly when all groups are reporting green KPIs. The process for tackling network performance problems To get to the root cause of network performance issues, network engineers typically follow a four step troubleshooting process: The tools available to assist problem solving fall into two categories: Network Management Systems (NMS) and packet capture and analysis tools. The NMS primarily plays a role at the monitor/alert phase, monitoring the company’s routers and servers and asking whether they are working and responding as expected. However, some NMS are so complex to set up that they are only able to manage down to Layer 3 devices, so switches are not monitored at Layer 2. Polling data is aggregated over many minutes and so is smoothed out, hiding the impact of usage spikes. Additionally, because the NMS is centrally located, measurements made with the intention of understanding end user response times are inaccurate because the test is using a different part of the network to reach the device under investigation. As a network engineer progresses through the troubleshooting process, the usefulness of the NMS decreases and it fails to provide the detailed information required to investigate performance problems fully. A recent Fluke Networks survey of approx. 3,000 network professionals found that 82% of respondents ranked network and application performance problems as a concern or critical issue, with 52% stating that an NMS has insufficient capabilities to get to the root cause of the problem most or all of the time. 51% of respondents said that they needed to leave their desk some or most of the time to troubleshoot the problem. To obtain more detailed information, the engineer has to turn to freeware or commercial packet capture and analysis tools. These have a limited role in the alert stage as they only view a single point in the network, but come into their own at the root cause analysis stage. The complexity of packet analysis tools requires skilled and experienced engineers, and they are time consuming to use, as the result can be too much data – millions of packets to wade through, displayed through different user interfaces. This makes the troubleshooting process much more difficult and time- consuming. Where problems can hide in the network The gap between these tools – an NMS without comprehensive information and complex packet capture tools – increases MTTR. Nagging, intermittent problems can ‘hide’ in the network, reducing both productivity and the credibility of the IT department. To investigate and resolve performance issues quickly, the engineer needs end-to-end visibility across the network: a dedicated solution for automated network and application analysis that fills the gap between traditional NMS and packet capture. Monitor / Alert Investigate (Determine problem scope) Isolate (Server/app network/client) Root Cause Analysis & Problem Resolution Figure 1: the problem solving workflow Fluke Networks www.flukenetworks.com 3 White Paper This needs to address: • Unmanagedequipment,whichmayhavebeenpurchasedbecauseitislessexpensivebutwillcostmoretotroubleshootwhen problems occur, as there is no visibility of the health of each network segment and utilisation levels cannot be monitored. In contrast, with a managed switch a network engineer can go to any switch port and see what the errors look like, view the utilisation and see who is connected to that port. • Undocumentednetworks,acontinualproblemgiventhatfrequentchangesonanetworkmakeanydocumentationout-of-dateshortly after completion. Physically trying to trace the path would take a long time, but without accurate documentation the engineer does not know which packets are flowing where. What is required is a means of discovering the real-time path through the network. • Toomuchdata,whentheproblemmaylieinjustafewpackets.Problem-solvingwouldbemuchfasterwithanautomatedmethodof sifting through captured packets to find the bad ones – an application centric analysis that takes a top down approach. • Problemsinthepast,whichonlycometotheengineer’sattentionhoursaftertheyhaveoccurred.What’sneededisameansofgoingbackin time by capturing and analysing large amounts of granular data over an extended period of time, say 24 hours, to catch intermittent issues. • Newtechnologythatisn’tmonitored,suchas10GbEthernetor802.11nWi-Fi.Manyorganisationshavenotinvestedininstrumentationfor such technologies because they believe the substantial increase in capacity will overcome any problems. • Wirelessdevices–theengineerneedsawaytoidentifyandmonitorWiFidevices,includingBYOD,andtoidentifyWiFiandnon-WiFi interference from Bluetooth devices, cordless telephones, microwaves etc. using spectrum analysis. • Problemsthatresideoutsidethenetwork,sothattheengineercanidentifythemandhandtheperformanceissueandsupporting evidence to other IT teams or external service providers, with sufficient information to enable further investigation and a rapid solution. A new approach to problem solving What is needed is an holistic network and application performance solution that captures all the data in the network and provides intelligent analysis to enable engineers to isolate root cause more quickly, or identify if the real problem lies outside the network. It needs to collect, aggregate, correlate and mediate all information, including flow, SNMP data and information gathered from other devices, with granularity up to one millisecond. Data should be displayed through a single user configurable dashboard, so that guided workflows can be applied to isolate the root cause of the issue quickly. By taking away the need to make assumptions and enabling the user to follow a logical process until the issue is identified and resolved, MTTR is reduced and the network engineer becomes more effective. A network and application performance solution facilitates all stages of the troubleshooting process and provides the visibility needed to support network optimisation. Monitor/alert The first requirement when addressing and resolving network problems is a system that provides a timely alert that a problem has occurred. The worst case scenario is to find out through a call from a user, in which case the engineer is already on the back foot. Many network management tools alerts have to be manually configured for each network by setting the system to ping or discover all the devices in each broadcast domain. With an always on network and application performance solution, however, automated discovery and guided workflows make it quick and easy to immediately see which are connected. This dramatically reduces the time required for set-up and monitoring. PerformancedataiscontinuallycollectedandstoredinadatabaseanddisplayedviaaGUIonaperformancedashboard,whichtheusercancongure to suit their own requirements. Performance is monitored against a user defined baseline (e.g. the SLA) and anything outside this is immediately shown as an alarm. The user can then view the problem in varying degrees of detail as they begin the investigation stage. M SC Home Terminal in Antwerp, Belgium, is one of Europe’s busiest container terminals. It uses a central database containing information about all containers and a combination of many smaller programmes. Any network performance issues would have a serious impact on the charging and discharging of cargo from vessels, trains and trucks. By deploying a network and application performance solution from Fluke Networks, MSC’s IT team has an independent view of overall performance which has led to faster problem isolation and troubleshooting and lessened the risk of service-impacting performance related issues. Fluke Networks www.flukenetworks.com 4 White Paper Network and application performance systems can also be integrated with existing network management systems such as HP OpenView or Tivoli Netcool, and pass information and alarms to service management and operational dashboard solutions. Investigate The network engineer now needs to investigate the scope of the problem. In order to facilitate rapid and accurate investigation, the solution needs to be able to collect and store all pertinent data , e.g. SNMP, flows, packets, end-user-response time etc. and store these for future analysis. A network and application performance solution also provides a real time method of discovering the path from the client to the service or application, significantly reducing the amount of time required; the path between the two devices can then be found and monitored for any problems across internal and external networks and the devices in the path. Results are displayed in a graphical format to facilitate understanding and rapid root cause analysis. Foroptimaleffectivenessthesystemshouldprovideinterfaceswithboth1Gbpsand10Gbpsconnectivity,andbecapableofcapturingdataatline speed on the wire. Some solutions can trace a path through the network from a client to a server identifying Layer 2 and Layer 3 devices in the path and providing the granularity needed to identify the source of the problem. If the issue lies with a client or group of clients, the engineer needs to carry out a performance or application response test to identify if the problem is a wired or wireless network issue. By providing wired and wireless tools integrated using the same user interface, the network and application system enables a single test to identify the source of the problem. Malware outbreaks also can be identified as part of this process, including the originating IP address, enabling the engineer to identify root causes of downtime that other tools miss. Isolate At this stage the problem has been isolated to a single network segment, switch, router, server or application and the path, devices and ports in the path have been identified. Now the path needs to be analysed, requiring traffic statistics for each link to determine whether the issue is due to a faulty device, link media, noise or interference, or traffic overload. OneofthegreatadvantagesofSNMP(SimpleNetworkManagementProtocol)isitsabilitytohelpisolatefaultdomains.UsingSNMPtoqueryeach connection point along the way will determine if a traffic bottleneck is the source of the slowdown. This is straightforward if the devices in the path are managed and the engineer has the passwords or community strings to interrogate the devices. Otherwise he or she has to connect a tool in each link without disrupting the network to view the packets and traffic statistics. This can be extremely time consuming if there are a lot of links over a large geographic area, and may require multiple tools in different locations. An automated network infrastructure health check using a network and application performance tool makes it possible to monitor all of the SNMP supported devices, looking at application flows for those showing packet loss or high utilisation by querying the SNMP MIBs on the routers and reporting back at regular intervals. Whether there are tens or hundreds of switches in the network, the process is simple and quick. Some problems will only be visible by being at the point where the problem has arisen. This requires a portable device with the right testing capabilitiesandtherightinterfacetoconnectattheproblempoint,whetherthatisinfrontofaclientora10Glinkinadatacentre.Withmany people working remotely, having a tool which gives this visibility is vital – and this will only increase in importance with the growth of BYOD. A portable tool can also be shipped to a remote site to see what is happening with unmanaged equipment in the network without the need for an accompanying engineer. Ideally it should be able to perform path analysis, measure application infrastructure health and application flows and analyse WLAN performance, as well as reviewing roaming and retry capability and investigating any interference from outside devices. LeicesterCollegeisoneofthelargestcollegesintheUK,withthreemaincampusesandalargenumberofoutreachcentres.Tostreamlinenetwork planning and maintenance, the college chose Fluke Networks’ OptiView® XG tools to help automate the analysis and troubleshooting of networks and applications. This delivers a level of insight into the network that was previously missing, and allows the IT team to respond quickly when problems arise on the wired or wireless side of the network. It can be used remotely or taken into the field to gather the data needed to troubleshoot or manage the network. If there are no links which are oversubscribed or have frame errors then the problem is not likely to be the network – but this can only be confirmed if the engineer has analysed the links in a reasonable time and the problem he or she is trying to fix still exists. This requires the historic data captured by the network and application performance system. Fluke Networks www.flukenetworks.com 5 White Paper Root cause analysis and resolution At this stage the engineer will confirm the cause of the issue, formulate and implement a fix and validate the solution. If the problem is not located in the network and is not the server response or the result of overloading resources, more detailed information is required by capturing and analysing packets. It is important to have isolated the link or triaged the problem between the server, the network and the application first, as packet analysis can be extremely time-consuming and requires a considerable amount of skill and experience. To get to the root cause more quickly it is best to take a top down approach to the analysis, beginning at the application level. For example, if the path is good but the response time is poor, the problem could be a virtualised server, an application running on multiple tiers or a bug in the application. One option is to use a packet analyser that can easily show the application level and packet ladder diagrams. Span or mirrored tap connections are easytocongurebutcanlosepacketswithheavytrafcloadsandwillnotshowLayer1errorsastheseareblockedbytheLayer2switchproviding the span. Passive taps are best but connecting them breaks the connection, which will disrupt users of the services this link provides. If performance is suffering, this usually does not cause a problem, but it may affect those using this link to connect to other services. A better solution is to construct the network with taps already placed in strategic position in front of server farms, data centres, routers to external links and in the core of the network. This enables the captures can be taken without breaking the network. If this is not possible the engineer may have to resort to span or port mirroring, bearing in mind the accompanying problems and inaccuracies. A network and application performance solution provides an automated method of sifting through the captured packets to find the bad ones. It uses anapplicationcentricapproach,withaGUIthatshowseachdataowwithavisualindicatortoindicateproblems.Theengineersimplyclickson this to drill down and see exactly which packet or packets have a problem. This can be further aided by capturing packets at multiple points in the infrastructure to determine where the problem exists. It requires the ability to carry out multi-segment analysis, triggering data capture at multiple points at the same time and then merging the results to provide the whole picture. Effectiverootcauseanalysiscanbecarriedoutateitherthedatacentreorremotesitestoseeifproblemsareserverorapplicationrelated.Sometools can pull management information from physical or virtual servers to reveal performance and resource issues. By collecting and analysing historic granular data, the network and application performance system also enables the engineer to go back in time to review the symptoms that were occurring when the problem first appeared, enabling intermittent problems to be identified and resolved. Network optimisation A network application and performance solution provides the visibility engineers need to document and audit the health of their corporate network. It enables them to spot poor performance and identify where the paths of applications or servers are running slowly, so that the slowest and most critical pathscanbeaddressed.Theinformationobtainedcanbeusedtoprioritiseprojectssuchasserverupgradesandmakethebusinesscaseforapproval. It can also support installation of new equipment and applications by verifying that what has been done has worked and ensuring that it has not had a negative impact on performance elsewhere. The data can also prove (or otherwise) the impact of changes to the network such as virtualisation, WAN optimisation or data centre consolidation. T he University of Nottingham is one of the UK’s foremost research institutions, with international campuses in Malaysia and China. The IT organisation supports more than 30,000 staff and students as well as 120 business systems across the University. One of its main challenges was troubleshooting application performance across the enterprise network while maintaining network services. The University uses a Fluke Networks solution to provide visibility into the causes of performance issues, enabling the IT team to detect, isolate and resolve problems with less time and effort and reducing the time required to solve complex problems from days to hours. White Paper Fluke Networks operates in more than 50 countries worldwide. To find your local office contact details, go to www.flukenetworks.com/contact ©2013 Fluke Corporation All rights Reserved. 4263018A Corporate Office: Fluke Networks P.O. Box 777 Everett, WA USA 98206-0777 1-800-283-5853 e-mail: info@flukenetworks.com European Office: Fluke Networks P.O. Box 1550, 5602 BN Eindhoven Germany 0049-(0)682 2222 0223 France 0033-(0)1780 0023 UK 0044-(0)207 942 0721 e-mail: sales.core@flukenetworks.com 6 About Fluke Networks Fluke Networks is the world-leading provider of network test and monitoring solutions to speed the deployment and improve the performance of networks and applications. Leading enterprises and service providers trust Fluke Networks’ products and expertise to help solve today’s toughest issuesandemergingchallengesinWLANsecurity,mobility,uniedcommunicationsanddatacenters.BasedinEverett,Washington,thecompany distributesproductsinmorethan50countries. For more information on our network and application performance solutions, visit www.FlukeNetworks.com/instantvisibility Solutions from Fluke Networks Fluke Networks offers a range of complementary network and performance management solutions: TruView and OptiView. These are dedicated custom hardware with support and interfaces that provide both1Gbpsand10Gbpsconnectivity. Visual TruView TM Appliance TruView provides the ability to track, baseline, trend and monitor individual application performance of every end user experience, enterprise- wide through a highly customizable dashboard. It also provides high volume packetarchivalat10GbpslinerateandcomprehensiveVoIP/Videomonitoring and troubleshooting. More information at www.flukenetworks.com/truview OptiView XG ® – Automated network and application analysis TheOptiViewXGisthersttabletspecicallydesignedfortheNetworkEngineer.Itautomates root-cause analysis of network and application problems allowing the user to spend less time on troubleshooting and more time on other initiatives. It is designed to support deployment of new technologies,includinguniedcommunications,virtualization,wirelessand10GbpsEthernet. The result is that new initiatives get up and running faster and network stay productive even in these days of smaller teams. More information at www.flukenetworks.com/xg OneTouch AT TM – Client to Cloud troubleshooting in 60 seconds The OneTouch™ AT Network Assistant greatly reduces troubleshooting time through a streamlined, three-step approach: 1. TheuniqueAutoTestreplacesmultipletoolsandanhouroftroubleshootingtime. 2. A powerful set of network performance measurements to troubleshoot wired and Wi-Fi networks. 3. It enhances team collaboration through a simple web-remote interface and easy-to-use inline packet capture capabilities. More information at www.flukenetworks.com/OneTouchAT . resolution 5 e. Network optimisation 5 Solutions from Fluke Networks 6 Reduce the risk of network and application performance issues Your how-to guide to optimising network performance and. our network and application performance solutions, visit www.FlukeNetworks.com/instantvisibility Solutions from Fluke Networks Fluke Networks offers a range of complementary network and performance. application performance across the enterprise network while maintaining network services. The University uses a Fluke Networks solution to provide visibility into the causes of performance issues,