Using IP Visibility to Manage Network, Service, and ... - NetScout
Using IP Visibility to Manage Network, Service, and ... - NetScout
Using IP Visibility to Manage Network, Service, and ... - NetScout
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
January 2007<br />
<strong>Using</strong> <strong>IP</strong> <strong>Visibility</strong> <strong>to</strong> <strong>Manage</strong> <strong>Network</strong>, <strong>Service</strong>, <strong>and</strong><br />
Cus<strong>to</strong>mer Quality<br />
An Executive Brief
Frost & Sullivan reports are limited publications containing<br />
valuable market information provided <strong>to</strong> a select group of<br />
cus<strong>to</strong>mers in response <strong>to</strong> orders. Our cus<strong>to</strong>mers<br />
acknowledge when ordering that Frost & Sullivan reports<br />
are for our cus<strong>to</strong>mers’ internal use <strong>and</strong> not for general<br />
publication or disclosure <strong>to</strong> third parties.<br />
No part of this report may be given, lent, resold, or<br />
disclosed <strong>to</strong> non-cus<strong>to</strong>mers without written permission.<br />
Furthermore, no part may be reproduced, s<strong>to</strong>red in a<br />
retrieval system, or transmitted in any form or by any<br />
means, electronic, mechanical, pho<strong>to</strong>copying, recording,<br />
or otherwise, without the permission of the publisher.<br />
For information regarding permission, write:<br />
Frost & Sullivan<br />
7550 West Interstate 10, Suite 400<br />
San An<strong>to</strong>nio, TX 78229<br />
United States<br />
2
TABLE OF<br />
CONTENTS<br />
TABLE OF CONTENTS<br />
Executive Summary 4<br />
Market Drivers Moving the Industry <strong>to</strong> Cus<strong>to</strong>mer-Centric Operations 5<br />
What is Cus<strong>to</strong>mer Centric <strong>Service</strong> Assurance? 6<br />
Where Does <strong>IP</strong> <strong>Visibility</strong> Fit In? 7<br />
The <strong>NetScout</strong> Assurance Solution 10<br />
A Case Example – Large Wireless Carrier 13<br />
The Last Word 15<br />
About Stratecast 16<br />
3
EXECUTIVE SUMMARY<br />
In the current telecommunications environment, evolving network technologies, business<br />
strategies, regulations, <strong>and</strong> competitive forces, are all converging with a focus on<br />
delivering services that hold the greatest appeal <strong>to</strong> the end-cus<strong>to</strong>mer. More than ever<br />
before, competitive pressures are causing communications services providers <strong>to</strong> alter<br />
their business strategies around the cus<strong>to</strong>mer, not just the network. With multiple<br />
services delivered over a single infrastructure, it is no longer valid <strong>to</strong> assume that the<br />
quality of the service provided <strong>to</strong> an individual is good as long as the network<br />
infrastructure looks good. In fact, knowing the health <strong>and</strong> status of any service is<br />
insufficient in determining the quality of service received by an individual cus<strong>to</strong>mer. Some<br />
service providers are now focusing their efforts on managing cus<strong>to</strong>mer-level service<br />
quality, each time the cus<strong>to</strong>mer accesses a service. Stratecast refers <strong>to</strong> this area of<br />
quality management as cus<strong>to</strong>mer-centric service assurance.<br />
The interest in cus<strong>to</strong>mer-centric service assurance is presently most prominent with<br />
mobile network opera<strong>to</strong>rs because they have already experienced the tribulations that<br />
come from offering multiple services over a single access network <strong>and</strong> the difficulties of<br />
moving that access network <strong>to</strong> an all-<strong>IP</strong> infrastructure. The 3G Partnership Program<br />
(3GPP) is defining st<strong>and</strong>ards for the mobile sec<strong>to</strong>r, which involve the integration of<br />
multiple services over <strong>IP</strong> over a wireless network – known as <strong>IP</strong> Multi-media Subsystem<br />
(IMS). The IMS st<strong>and</strong>ards bring definition <strong>and</strong> structure <strong>to</strong> <strong>IP</strong> convergence. However, IMS<br />
does not address cus<strong>to</strong>mer-centric service assurance even though a vast majority of<br />
wireless <strong>and</strong> wireline carriers are moving closer <strong>to</strong> large-scale IMS deployments.<br />
<strong>Service</strong> providers are on their own when it comes <strong>to</strong> determining the quality of service<br />
delivered <strong>to</strong> an individual cus<strong>to</strong>mer. The difficulties they are facing lie mostly with<br />
operations <strong>and</strong> management of both the network infrastructure <strong>and</strong> cus<strong>to</strong>mer service<br />
usage. As the number of cus<strong>to</strong>mers <strong>and</strong> types of services supported by a single network<br />
infrastructure increase, the complexity of managing the combination of cus<strong>to</strong>mer issues,<br />
service problems <strong>and</strong> network alerts/alarms exponentially increases. For example, a<br />
mobile user with a h<strong>and</strong>set configuration problem will not be detected by existing OSS<br />
solutions as either a network or service failure, yet from the cus<strong>to</strong>mer perspective<br />
problems at the network, service or cus<strong>to</strong>mer level are perceived the same way: “the<br />
service doesn’t work.” Cus<strong>to</strong>mer-centric service assurance is all about the collective<br />
ability of a service provider <strong>to</strong> moni<strong>to</strong>r the network <strong>and</strong> offered services, correlate<br />
events, <strong>and</strong> identify affected users simultaneously. By reviewing network, service, <strong>and</strong><br />
cus<strong>to</strong>mer data <strong>and</strong> applying intelligence <strong>to</strong> this data, service providers get a better picture<br />
of how services are performing <strong>and</strong> ultimately the quality of service experienced by their<br />
cus<strong>to</strong>mers.<br />
There are several ways that service providers <strong>and</strong> vendors are approaching the challenge<br />
of delivering cus<strong>to</strong>mer-centric service assurance. This executive brief explores one of<br />
those aspects: <strong>IP</strong> visibility using deep packet inspection. A brief discussion of the need for<br />
cus<strong>to</strong>mer-centric service assurance is followed by a discussion of <strong>IP</strong> visibility <strong>and</strong><br />
examples of how one vendor, <strong>NetScout</strong>, is providing the market with such a solution.<br />
4
MARKET DRIVERS MOVING THE INDUSTRY TO CUSTOMER-CENTRIC<br />
OPERATIONS<br />
As service providers migrate <strong>to</strong>ward converged <strong>IP</strong>-based services, the type of network<br />
–circuit-switched or <strong>IP</strong>, wireless or wireline—is no longer a source of competitive<br />
differentiation. Additionally, the services offered over these networks originate from a<br />
variety of sources <strong>to</strong> deliver what cus<strong>to</strong>mers want <strong>and</strong> are willing <strong>to</strong> pay for including:<br />
Web access, music/video downloads, low-cost voice, <strong>and</strong> combined technical capabilities<br />
that deliver a variety of new-generation “cus<strong>to</strong>mer lifestyle improvement services.”<br />
Assuring the availability <strong>and</strong> operability of each service <strong>to</strong> every cus<strong>to</strong>mer every time is<br />
recognized by the communications industry as a key <strong>to</strong> cus<strong>to</strong>mer loyalty, profitability, <strong>and</strong><br />
long-term sustainability. In addition, the business focus is exp<strong>and</strong>ed beyond network<br />
optimization <strong>to</strong> include service quality <strong>and</strong> cus<strong>to</strong>mer satisfaction, especially for high value<br />
cus<strong>to</strong>mers.<br />
Today’s most critical business drivers are causing service providers <strong>to</strong> redirect their<br />
business strategies from a network-centric focus <strong>to</strong> a stronger emphasis on the cus<strong>to</strong>mer<br />
experience in all areas of their operations. From an assurance perspective, these drivers<br />
include:<br />
<strong>Network</strong> Technology Evolution – <strong>Network</strong> convergence between fixed <strong>and</strong><br />
mobile, along with architectures such as IMS, provide the capability <strong>to</strong> offer<br />
cus<strong>to</strong>mer-controlled mobile services. Such new services involve presence,<br />
availability <strong>and</strong> billing-based or usage-based policy options. Addressing the<br />
management needs of such services requires flexible cus<strong>to</strong>mer-oriented<br />
assurance processes that keep the cus<strong>to</strong>mer experience in the spotlight <strong>and</strong><br />
network management in the background.<br />
Wireless Cus<strong>to</strong>mer Churn – Discussion with service providers globally has<br />
shown that as wireless data services increase in both usage volumes <strong>and</strong> offering<br />
types, so does the degree <strong>to</strong> which cus<strong>to</strong>mers move from one provider <strong>to</strong> the<br />
next in search of the best data quality experience. Some service providers have<br />
documented that as much as 50% of their wireless data cus<strong>to</strong>mers churn<br />
regularly due mostly <strong>to</strong> unresolved service problems. Assuring the quality of the<br />
cus<strong>to</strong>mer experience, at the cus<strong>to</strong>mer level, is essential for the success of these<br />
<strong>and</strong> many other service offerings.<br />
Increased Cus<strong>to</strong>mer Support Calls – The time <strong>to</strong> address a mobile or fixed<br />
line data services problem is presently three times greater than voice service<br />
problems due <strong>to</strong> the number of offerings <strong>and</strong> the complexity built in<strong>to</strong> <strong>to</strong>day’s<br />
mobile devices. As mobile data services continue <strong>to</strong> gain acceptance <strong>and</strong> as<br />
more complexity is added, such as services involving fixed-mobile architectures,<br />
underst<strong>and</strong>ing the cus<strong>to</strong>mer experience will be critical <strong>to</strong> the isolation <strong>and</strong><br />
troubleshooting of problems that may only appear in one type of technology but<br />
not another.<br />
5
New <strong>Service</strong> Capabilities – Appealing <strong>to</strong> cus<strong>to</strong>mer dem<strong>and</strong>, the availability of<br />
mobile phones with video/TV capabilities is increasing dramatically <strong>to</strong> where the<br />
volume will likely exceed that of regular TVs; all within the next 5-7 years. With<br />
this change in how TV is viewed, integrated presence/location-based partner<br />
advertising is changing both the way people watch TV <strong>and</strong> the way companies<br />
advertise their products. From a wired perspective, <strong>IP</strong>TV has shown that<br />
interactive services definitely hold cus<strong>to</strong>mer appeal. Assuring that the cus<strong>to</strong>mer<br />
experience for both mobile <strong>and</strong> fixed-line TV services lives up <strong>to</strong> market<br />
expectations is critical for cus<strong>to</strong>mer interest <strong>to</strong> continue in both of these<br />
fledgling technologies. Focusing only on the network is not enough.<br />
New Niche Market Players – New niche market retailers are launching<br />
wireless services via VNO agreements with wireless network opera<strong>to</strong>rs. Wellknown<br />
names such as Disney, Wal-Mart, <strong>and</strong> 7-11 know their cus<strong>to</strong>mers <strong>and</strong> are<br />
using cus<strong>to</strong>mized wireless offerings <strong>to</strong> better meet cus<strong>to</strong>mer need. The<br />
convergence of network capabilities between wireless <strong>and</strong> wireline could bring<br />
even more advanced service opportunities <strong>to</strong> this group of marketing-based<br />
“services providers”. Assuring the cus<strong>to</strong>mer experience, not just the network, is<br />
essential for long-term consumer acceptance of the offerings made available by<br />
these new communications services suppliers.<br />
X-Fac<strong>to</strong>r Marketing Giants – Non-traditional <strong>IP</strong>-based competi<strong>to</strong>rs with<br />
significant market attention, including Microsoft, Apple, Google,Yahoo, <strong>and</strong> the<br />
largest consulting firms, are initiating various types of integrated services<br />
packages that have different degrees of telecom focus. With the end-cus<strong>to</strong>mer<br />
in mind, it is not unreasonable <strong>to</strong> view such organizations as potential “services<br />
suppliers” for either internal business needs or for developing external<br />
competitive cus<strong>to</strong>mer service offerings. Assuring such offerings from a<br />
cus<strong>to</strong>mer-perspective is again critical <strong>to</strong> the successful acceptance of services<br />
from these organizations.<br />
WHAT IS CUSTOMER CENTRIC SERVICE ASSURANCE?<br />
Now that there is no longer a one-<strong>to</strong>-one correlation between a cus<strong>to</strong>mer, a service, <strong>and</strong><br />
a set of network elements; moni<strong>to</strong>ring the quality of service delivered <strong>to</strong> a cus<strong>to</strong>mer<br />
involves more than the traditional focus on assuring successful operation of a network.<br />
Cus<strong>to</strong>mer-Centric <strong>Service</strong> Assurance is an addition <strong>to</strong> the network <strong>and</strong> service<br />
management functions that have been a central focus within the industry. We define each<br />
of these functions as follows:<br />
<strong>Network</strong> Assurance (internal focus around technology operability):<br />
Moni<strong>to</strong>r <strong>and</strong> report on network status by element, node, <strong>and</strong> location<br />
Aggregate <strong>and</strong> prioritize for resolution (by policy) network alarms/alerts.<br />
6
<strong>Service</strong> Assurance (internal focus around capability offerings <strong>to</strong> end-user<br />
cus<strong>to</strong>mers):<br />
Analyze the effectiveness of a service for its target cus<strong>to</strong>mers<br />
Acknowledge level of uptake with target audience<br />
Aggregate <strong>and</strong> correlate network information at a service level such as Voice,<br />
VPN, e-mail, SMS/MMS, IM, Internet, WAP, or others<br />
Target network changes <strong>to</strong> improve service reliability/performance.<br />
Cus<strong>to</strong>mer-Centric <strong>Service</strong> Assurance (involves both an internal <strong>and</strong><br />
external focus):<br />
An internal focus on:<br />
Isolating <strong>and</strong> resolving chronic cus<strong>to</strong>mer service problems<br />
Analyzing the effectiveness of a service with its target cus<strong>to</strong>mers<br />
Controlling the value-delivery chain <strong>to</strong> the cus<strong>to</strong>mer (internal <strong>and</strong> 3rd party<br />
partners)<br />
Acknowledging the level of uptake a service has with its target audience.<br />
An external focus on:<br />
Providing, in underst<strong>and</strong>able terms for the end-user, aggregated <strong>and</strong> correlated<br />
data from multiple processes, systems <strong>and</strong> databases including direct<br />
measurements of the end-<strong>to</strong>-end cus<strong>to</strong>mer experience <strong>and</strong> information from<br />
third party sources where applicable<br />
Quantifying how service capabilities are meeting end-user expectations.<br />
WHERE DOES <strong>IP</strong> VISIBILITY FIT IN?<br />
As new competitive threats from advanced enabling technologies provide end-users with<br />
more service capabilities, business change is critical for longer-term survival. Today’s<br />
business environment requires service providers—traditional <strong>and</strong> new entrants alike—<strong>to</strong><br />
have a way <strong>to</strong> gauge the cus<strong>to</strong>mer experience for delivering the levels of service quality<br />
that they <strong>and</strong> their cus<strong>to</strong>mers have grown <strong>to</strong> expect. One approach <strong>to</strong> determining the<br />
level of service quality delivered <strong>to</strong> each individual cus<strong>to</strong>mer is <strong>to</strong> apply deep packet<br />
examination <strong>to</strong> <strong>IP</strong> traffic as it traverses the network.<br />
Deep packet examination requires that each packet be moni<strong>to</strong>red using a probe<br />
connected <strong>to</strong> the network at critical junction points in an <strong>IP</strong> traffic stream. <strong>Network</strong><br />
probes have been used for years by both mobile <strong>and</strong> wireline service providers <strong>to</strong><br />
moni<strong>to</strong>r SS7 signaling voice traffic <strong>and</strong> <strong>to</strong> meet the most recent North American E-911<br />
requirements. They have also been used by wireless carriers <strong>to</strong> support, via signaling link<br />
moni<strong>to</strong>ring, the service quality needs of the more recently installed mobile GPRS, UMTS,<br />
<strong>and</strong> CDMA data networks. Probes for moni<strong>to</strong>ring the payload portion of an <strong>IP</strong> packet<br />
stream are a more recent offering in the telecom space although they have been used<br />
extensively by enterprise cus<strong>to</strong>mers over the last several years. In this configuration,<br />
network data probes see every call, packet, or frame that traverses an <strong>IP</strong>-based network.<br />
According <strong>to</strong> the design architecture of any organization using this approach, deep packet<br />
examination probes can be placed in strategic locations for obtaining a real-time view of<br />
7
network traffic data. In addition <strong>to</strong> real-time analysis <strong>and</strong> examination, the collected data<br />
may be aggregated (or not) <strong>and</strong> s<strong>to</strong>red for subsequent analysis <strong>and</strong> trending.<br />
The deep packet data is mined using pre-defined or user-defined rules <strong>and</strong> policies <strong>to</strong><br />
determine service quality or <strong>to</strong> troubleshoot a specific user problem. When done in realtime,<br />
the inspection can reveal individual cus<strong>to</strong>mer problems or pending service issues.<br />
When used in aggregate, the data provides a view of service behavior that supports<br />
subsequent network capacity planning or other essential network or business<br />
management efforts. The detail provided by deep packet examination not only helps<br />
network opera<strong>to</strong>rs moni<strong>to</strong>r quality for specific cus<strong>to</strong>mers, but also helps <strong>to</strong> identify<br />
intermittent problems, application problems that may be associated with a third party<br />
provider, <strong>and</strong>/or <strong>to</strong> detect server/host problems.<br />
To be effective in a real-time operational environment, the probe analysis must be<br />
integrated with supporting OSS <strong>and</strong> BSS data <strong>and</strong> systems for correlating quality metrics,<br />
problems, <strong>and</strong> resolutions with both individual cus<strong>to</strong>mers <strong>and</strong> service level agreements<br />
(SLAs). That data can then be made available <strong>to</strong> a number of different work groups such<br />
as marketing teams, cus<strong>to</strong>mer support groups, network operations personnel, <strong>and</strong>, in<br />
some cases, the cus<strong>to</strong>mer. Advantages <strong>to</strong> a deep packet inspection approach include:<br />
Precise Performance Metrics – Performance <strong>and</strong> quality metrics can be<br />
calculated for individual users, services, applications, <strong>and</strong> network components<br />
as well as grouped metrics for enterprise cus<strong>to</strong>mers, service partners, <strong>and</strong><br />
network segments. Any amount <strong>and</strong> detail of data can be collected <strong>and</strong><br />
correlated in whatever manner the service provider prefers.<br />
Traffic Moni<strong>to</strong>ring – In addition <strong>to</strong> performance <strong>and</strong> quality, the flow of<br />
traffic, potential bottlenecks, trends, <strong>and</strong> security problems can be detected <strong>and</strong><br />
avoided.<br />
Improved Troubleshooting – Knowing the exact time <strong>and</strong> contents of a<br />
transaction or series of transactions can enable a network opera<strong>to</strong>r <strong>to</strong><br />
determine the root cause of a problem or failure <strong>to</strong> better respond more<br />
quickly <strong>and</strong> accurately.<br />
While viewing every data packet, for every cus<strong>to</strong>mer, regarding every service that<br />
traverses the network, may be desirable for guaranteeing cus<strong>to</strong>mer service quality <strong>and</strong><br />
responsiveness <strong>to</strong> a problem situation when it occurs, there are a number of issues that<br />
service providers must take in<strong>to</strong> consideration when implementing such as strategy.<br />
These include the following:<br />
Scalability – Scalability reflects on the size of the network <strong>to</strong> be instrumented,<br />
management of the probe connections <strong>and</strong> correlation of the collected data. A<br />
scalable architecture should be designed for large networks <strong>and</strong> the quantity of<br />
data that will be collected. The quality metrics defined by the service provider<br />
8
determine the frequency <strong>and</strong> types of collected data which must then be<br />
programmed in<strong>to</strong> the probes moni<strong>to</strong>ring each <strong>IP</strong> packet data stream. Solutions<br />
fail the scalability test when they either cannot sample the data at the required<br />
rate or cannot correlate the collected data in<strong>to</strong> a useful format at a rate that<br />
stays in pace with the collection process.<br />
Volume – <strong>Network</strong> probes can generate tremendous volumes of data that must<br />
be acted on in real-time for moni<strong>to</strong>ring, s<strong>to</strong>red for analysis, <strong>and</strong> mined for value.<br />
<strong>Service</strong> providers implement several approaches <strong>to</strong> manage volume including;<br />
carefully identifying the metrics that require real-time correlation, limiting the<br />
depth of packet examination, limiting the volume of packets examined, <strong>and</strong><br />
limiting the frequency of data collection.<br />
Reliability – If a service provider relies on a vendor solution <strong>to</strong> determine the<br />
quality of service delivered across its infrastructure <strong>and</strong> ultimately <strong>to</strong> each end<br />
user, the system must be reliable <strong>and</strong> operate without the need for extensive<br />
opera<strong>to</strong>r intervention. It must be stable enough <strong>to</strong> eliminate the need for<br />
frequent updates that require end-<strong>to</strong>-end integration <strong>and</strong> regression testing, <strong>and</strong><br />
it should run on a platform that is tested, survivable <strong>and</strong> secure.<br />
Multiple Interface St<strong>and</strong>ards – The data flows accessed by the network<br />
probes utilizes a variety of formatting approaches for data moni<strong>to</strong>ring.<br />
Traditional signaling, including SS7 <strong>and</strong> frame relay moni<strong>to</strong>ring, are accomplished<br />
using vendor probes that collect data in a proprietary format, aggregate <strong>and</strong><br />
correlate all message parts through a vendor-specific management <strong>to</strong>ol. Output<br />
is presented generally in an open, user-friendly format or by using a vendorsupplied<br />
report writing <strong>to</strong>ol.<br />
<strong>IP</strong> deep packet examination first used an <strong>IP</strong> st<strong>and</strong>ard approach called Remote<br />
Moni<strong>to</strong>ring (RMON), which was originally implemented by computer <strong>and</strong><br />
network equipment vendors for packet moni<strong>to</strong>ring over a decade ago. More<br />
recently, NetFlow was developed by Cisco as a vendor-based st<strong>and</strong>ard (across all<br />
Cisco <strong>IP</strong> products). This has been followed by other vendors creating a similar<br />
structure, e.g. Juniper with its cflowd <strong>and</strong> Huawei with its NetStream data<br />
collection definitions.<br />
Just like the SS7 moni<strong>to</strong>ring vendors, deep packet examination can also be<br />
accomplished using vendor-specific probes placed at strategic locations in a<br />
network. These devices then moni<strong>to</strong>r <strong>IP</strong> packet data, often using proprietary<br />
data collection, analysis, <strong>and</strong> reporting <strong>to</strong>ols. For probe-based solutions, updates<br />
in technology will require probe updates or modifications, e.g. transition by the<br />
industry from <strong>IP</strong>v4 <strong>to</strong> <strong>IP</strong>v6.<br />
9
THE NETSCOUT ASSURANCE SOLUTION<br />
One example of a deep packet inspection probe-based solution is <strong>NetScout</strong>’s nGenius<br />
Performance <strong>Manage</strong>ment System, including its intelligent nGenius Probes. These probes<br />
are set at critical junction points in the network using passive taps that moni<strong>to</strong>r <strong>and</strong><br />
analyze key information concerning network applications, hosts, conversations, utilization,<br />
<strong>and</strong> errors. The probes feed network data <strong>to</strong> the nGenius Performance <strong>Manage</strong>r, which<br />
uses the collected data <strong>to</strong> provide real-time <strong>and</strong> his<strong>to</strong>rical views, trending analysis, <strong>and</strong><br />
performance reports on the moni<strong>to</strong>red network segment. Figure 1 below is an overview<br />
of the nGenius System architecture.<br />
Figure 1 – <strong>NetScout</strong> nGenius System Architecture<br />
Source: <strong>NetScout</strong><br />
The nGenius Solution allows service providers <strong>to</strong> have global visibility in<strong>to</strong> <strong>IP</strong>-based<br />
services running over a number of different network architectures. Relative <strong>to</strong> a mobile<br />
GSM/UMTS network for example, the nGenius Solution can moni<strong>to</strong>r traffic in each<br />
segment of the network including:<br />
Core – <strong>IP</strong>/MPLS/QOS both physical <strong>and</strong> virtual<br />
Tunnel – Gn KPIs including response time, errors, <strong>and</strong> utilization<br />
Internet – Gi KPIs including flows <strong>and</strong> packets<br />
Roaming – Gp KPIs including response time, errors, <strong>and</strong> utilization<br />
<strong>Service</strong> Area – Diameter/AAA, DNS, DHCP, HTTP, <strong>and</strong> IM<br />
10
<strong>NetScout</strong> described for Stratecast how it has designed <strong>and</strong> implemented its nGenius<br />
Solution <strong>to</strong> address a number of operational <strong>and</strong> architectural needs including the<br />
following:<br />
Scalability – The <strong>NetScout</strong> solution is architected <strong>to</strong> accommodate scale by<br />
implementing a distributed architecture that pushes processing functionality out<br />
<strong>to</strong> the probe platforms for the initial, real-time data correlation <strong>and</strong> then <strong>to</strong><br />
distributed Performance <strong>Manage</strong>r platforms that accomplish the next level of<br />
correlation across the entire network in real time. Current implementations<br />
are deployed on Gigabit <strong>and</strong> 10 Gigabit Ethernet, as well as optical network<br />
links ranging in size from OC-3c – OC-48c, with OC-192c interfaces currently<br />
being tested.<br />
Reliability – The <strong>NetScout</strong> solution is purpose-built for high speed networks<br />
<strong>and</strong> high reliability with st<strong>and</strong>-by <strong>and</strong> fail-over capabilities, as well as dual hot<br />
swappable components <strong>to</strong> ensure reliability <strong>and</strong> minimize mean time <strong>to</strong> repair<br />
(MTTR). Other carrier grade features include: multiple hyper-threading CPUs, 4-<br />
8 Gig of on-board memory, multiple buses for channel rate separation <strong>and</strong> a<br />
separate express bus for disk s<strong>to</strong>rage, separate operating system <strong>and</strong> data<br />
s<strong>to</strong>rage (each with backup), packet recording for deeper data mining <strong>and</strong><br />
redundancy, <strong>and</strong> a 1% failure rate in over 100,000 units shipped. There is also a<br />
high availability configuration option for the Performance <strong>Manage</strong>r server(s), via<br />
the nGenius Performance <strong>Manage</strong>r St<strong>and</strong>by Server.<br />
Distributed Architecture – The nGenius Solution consists of intelligent<br />
probes <strong>and</strong> the <strong>NetScout</strong> Performance Manger. Each Performance <strong>Manage</strong>r can<br />
h<strong>and</strong>le 50 probe interfaces operating on network links up <strong>to</strong> OC-48 or 10G<br />
Ethernet. Multiple copies of Performance Manger can be deployed in a<br />
hierarchical fashion <strong>to</strong> localize data collection <strong>and</strong> polling. Under this<br />
arrangement, the nGenius Solution provides virtually unlimited scalability.<br />
Additionally, all probe data is pre-analyzed <strong>and</strong> compressed at the device level,<br />
so only appropriate data is forwarded <strong>to</strong> the Performance Manger. Finally,<br />
central configuration supports intelligent instrumentation management including<br />
self-moni<strong>to</strong>ring capabilities that allow all parts of the nGenius Solution <strong>to</strong> be<br />
au<strong>to</strong>matically observed from a central location for health <strong>and</strong> status.<br />
Data Granularity – The <strong>NetScout</strong> Performance <strong>Manage</strong>r correlates data from<br />
multiple probes <strong>to</strong> determine packet flow <strong>and</strong> service metrics. Flow data is<br />
retained in memory <strong>and</strong> the Performance <strong>Manage</strong>r harvests the data every 15<br />
minutes (or 15 seconds during direct real-time viewing), including the worst 1<br />
second for each minute’s worth of metrics measured by each probe. The<br />
amount of packet capture <strong>and</strong> depth of packet inspection is determined by the<br />
type of service moni<strong>to</strong>red <strong>and</strong> the corresponding metrics that a service<br />
provider needs <strong>to</strong> identify.<br />
11
Large Cus<strong>to</strong>mer Deployments – A large mobile opera<strong>to</strong>r has over 100<br />
probes currently installed for its MPLS core backhaul network <strong>and</strong> the roll out<br />
is continuing. Large cus<strong>to</strong>mers typically instrument key aggregation points for<br />
their core <strong>and</strong> distribution network, sometimes deploying hundreds of<br />
instrumentation devices <strong>and</strong> dozens of Performance <strong>Manage</strong>r Servers. For<br />
example, some large financial institutions have achieved complete coverage by<br />
deploying probes in national <strong>and</strong> international networks. Due <strong>to</strong> the strategic<br />
placement of these probes in each network configuration, a small number<br />
(relative <strong>to</strong> <strong>to</strong>tal network links) is able <strong>to</strong> moni<strong>to</strong>r substantially all network<br />
traffic via critical confluence points.<br />
Intelligent Probes – Eliminate the need <strong>to</strong> exhaustively instrument the<br />
network. Probes are placed where there is a confluence of traffic rather than<br />
deploying further out in<strong>to</strong> the network. Most large operations groups<br />
implement <strong>NetScout</strong>’s products for Gigabit <strong>and</strong> 10G Ethernet <strong>and</strong>/or OC-3c<br />
through OC-48c infrastructure.<br />
Lightweight Design – <strong>NetScout</strong> manufactures its own probe platform <strong>and</strong> the<br />
kernel is designed <strong>to</strong> be lightweight <strong>and</strong> fast. A cus<strong>to</strong>m kernel has also been<br />
developed <strong>to</strong> st<strong>and</strong>ardize the software platform <strong>and</strong> reduce costs, using dual<br />
core processors <strong>and</strong> dual capture techniques <strong>to</strong> streamline data collection <strong>and</strong><br />
analysis. One processor is used for data capture <strong>and</strong> the other is used for<br />
statistical surveying <strong>and</strong> analyzing.<br />
Vendor Integrity – <strong>NetScout</strong> was established in 1984 <strong>and</strong> began <strong>to</strong> be publicly<br />
traded on the NASDAQ in 1999. <strong>NetScout</strong>’s solutions have been deployed at<br />
more than 3200 cus<strong>to</strong>mers worldwide <strong>and</strong> estimates that they currently moni<strong>to</strong>r<br />
over 80,000 network segments. The nGenius Solution was launched in 2002 <strong>and</strong><br />
has been installed in both service provider <strong>and</strong> enterprise networks since. Yearover-year<br />
earnings per share have increased 40% <strong>and</strong> 75% sequentially, with 2006<br />
revenue of $97.9 million.<br />
The nGenius Solution offers a scalable <strong>and</strong> distributed probe-based approach that meets<br />
the transaction moni<strong>to</strong>ring requirements of a wide variety of cus<strong>to</strong>mers. The probe <strong>and</strong><br />
performance manager architecture offers significant scalability for addressing virtually any<br />
network configuration. Due <strong>to</strong> the nature of the data collection process, the nGenius<br />
Solution is very economical when compared with alternative solutions that moni<strong>to</strong>r out<br />
<strong>to</strong> the far ends of the network. There are a wide number of uses for the nGenius Solution<br />
as demonstrated by the large amount of enterprise <strong>and</strong> communications service provider<br />
installations. Stratecast believes that <strong>NetScout</strong> clearly delivers a solution that addresses<br />
not only the deep packet moni<strong>to</strong>ring needs of an <strong>IP</strong> network, but also provides a powerful<br />
ability <strong>to</strong> address the up <strong>and</strong> coming cus<strong>to</strong>mer service assurance requirements of new<br />
convergence-based cus<strong>to</strong>mer services.<br />
12
A CASE EXAMPLE – LARGE WIRELESS CARRIER<br />
A large mobile opera<strong>to</strong>r selected <strong>NetScout</strong>’s nGenius Performance <strong>Manage</strong>ment System<br />
for implementation in its 3G/UMTS network. To support this carrier’s move <strong>to</strong> broad<br />
scale deployment of 3G triple play data services <strong>and</strong> a migration <strong>to</strong> an MPLS core<br />
network, <strong>NetScout</strong> was selected <strong>to</strong> provide discrete visibility <strong>and</strong> insight in<strong>to</strong> the <strong>IP</strong><br />
portions of its operations network. The insight <strong>and</strong> intelligence collected with the<br />
nGenius Solution is used <strong>to</strong> troubleshoot both network <strong>and</strong> service issues in its packetbased<br />
infrastructure.<br />
Initial deployments began in late 2004, <strong>and</strong> <strong>to</strong> date this opera<strong>to</strong>r has deployed over 100<br />
nGenius Probes <strong>to</strong> moni<strong>to</strong>r the company’s <strong>IP</strong> backhaul infrastructure. The majority of the<br />
probes moni<strong>to</strong>r OC-48c, OC-12c, <strong>and</strong> OC-3c links on the <strong>IP</strong>/MPLS core bearer network.<br />
This mobile opera<strong>to</strong>r has also deployed Gigabit Ethernet nGenius Probes for moni<strong>to</strong>ring<br />
Gi <strong>and</strong> Gn interfaces as well as the OA&M network. Figure 2 below shows the general<br />
<strong>NetScout</strong> solution that was implemented.<br />
Figure 2 – <strong>NetScout</strong> Implementation Architecture – Large Mobile Cus<strong>to</strong>mer<br />
The implemented <strong>NetScout</strong> solution for this service provider provides:<br />
Source: <strong>NetScout</strong><br />
<strong>IP</strong>/MPLS Core Bearer <strong>Network</strong> <strong>Visibility</strong> – The ability <strong>to</strong> underst<strong>and</strong> <strong>and</strong><br />
track all flows of service <strong>and</strong> non-service data, as well as underst<strong>and</strong> the mix of<br />
dem<strong>and</strong>s placed on the network. Quantitative views of the <strong>to</strong>tal volume of data<br />
versus voice traffic provide input for capacity planning <strong>and</strong> moni<strong>to</strong>ring of<br />
response times. By moni<strong>to</strong>ring the various traffic flows, this service provider has<br />
an early indica<strong>to</strong>r of potential service problems. This viewpoint also provides<br />
13
the starting point for troubleshooting service performance degradations as the<br />
service threads traverse the core network.<br />
Gi <strong>Visibility</strong> – Gi visibility provides the opera<strong>to</strong>r detailed insight in<strong>to</strong> which<br />
external sites are being accessed, response times for internet services, <strong>and</strong><br />
general traffic management KPIs including volume, utilization, <strong>and</strong> errors.<br />
Operations <strong>Network</strong> Moni<strong>to</strong>ring <strong>and</strong> <strong>Visibility</strong> – Operations enterprise<br />
network moni<strong>to</strong>ring <strong>and</strong> visibility provides definitive intelligence for moni<strong>to</strong>ring,<br />
reporting against, <strong>and</strong> troubleshooting the flows of applications <strong>and</strong> activities on<br />
this critical internal operations resource.<br />
This service provider chose <strong>to</strong> use the <strong>NetScout</strong> solution <strong>to</strong> moni<strong>to</strong>r <strong>IP</strong> over its backhaul<br />
<strong>and</strong> optical core networks in addition <strong>to</strong> the <strong>IP</strong> network used for OSS/BSS. By placing a<br />
strategic set of intelligent probes in<strong>to</strong> the network, this service provider is able <strong>to</strong> quickly<br />
<strong>and</strong> accurately moni<strong>to</strong>r the <strong>IP</strong> traffic through the core. This implementation initially<br />
required the aggregation of traffic <strong>and</strong> moni<strong>to</strong>ring data at a higher level <strong>and</strong> recently<br />
includes the ability <strong>to</strong> drill down <strong>to</strong> an individual cus<strong>to</strong>mer level. This first step of<br />
moni<strong>to</strong>ring core <strong>IP</strong> traffic puts this service provider in a position <strong>to</strong> evolve its service<br />
assurance capabilities <strong>to</strong> a cus<strong>to</strong>mer-centric view in the future.<br />
14
Stratecast<br />
The Last Word<br />
As the telecommunications industry continues <strong>to</strong> undergo its massive transition <strong>to</strong> <strong>IP</strong> <strong>and</strong> IMS;<br />
absorb mergers <strong>and</strong> acquisitions; <strong>and</strong> shift <strong>to</strong> a multi-service environment; the success or failure<br />
of a service provider will be tied <strong>to</strong> how quickly/accurately cus<strong>to</strong>mer services are launched <strong>and</strong>,<br />
more importantly, how well these services live up <strong>to</strong> cus<strong>to</strong>mer expectations. Cus<strong>to</strong>mer-level<br />
service quality, measured as a function of the cus<strong>to</strong>mer experience as they use a service, is<br />
what service providers must implement <strong>to</strong> remain competitive <strong>and</strong> <strong>to</strong> reduce churn. Rigidly<br />
maintaining the reliability <strong>and</strong> quality of the network, while still absolutely critical, is no longer<br />
enough <strong>to</strong> ensure that a cus<strong>to</strong>mer’s service usage experience meets expectations.<br />
The network <strong>and</strong> service assurance data required <strong>to</strong> generate a cus<strong>to</strong>mer-centric view of<br />
service quality exists, however service providers require additional <strong>to</strong>ols <strong>and</strong> integration <strong>to</strong> take<br />
advantage of it. In addition, service providers must implement processes <strong>and</strong> organizational<br />
changes that enable a service assurance focus in general <strong>and</strong> a cus<strong>to</strong>mer-centric service<br />
assurance focus in particular. That could mean a dedicated assurance organization operating in<br />
concert with a network operations centre. This would involve a different set of processes <strong>and</strong><br />
procedures for detecting <strong>and</strong> h<strong>and</strong>ling network/service/cus<strong>to</strong>mer events, <strong>and</strong> very likely a new<br />
set of <strong>to</strong>ols.<br />
Vendors such as <strong>NetScout</strong> provide access <strong>to</strong> <strong>and</strong> correlation of <strong>IP</strong> transaction data at both the<br />
network <strong>and</strong> service level. As service providers continue <strong>to</strong> organize their cus<strong>to</strong>mer data <strong>and</strong><br />
migrate their OSS/BSS solutions <strong>to</strong> an integrated, open architecture; network <strong>and</strong> service data<br />
can finally be correlated with cus<strong>to</strong>mer data. <strong>Service</strong> providers <strong>and</strong> vendors are just beginning<br />
<strong>to</strong> explore the possibilities of using the wealth of data available from the network, the services<br />
running across it, <strong>and</strong> the cus<strong>to</strong>mers that are using it. By focusing on the metrics <strong>and</strong> measures<br />
that are important <strong>to</strong> the quality of the <strong>to</strong>tal cus<strong>to</strong>mer experience, service providers can<br />
extend their network <strong>and</strong> service assurance competencies closer <strong>to</strong> the cus<strong>to</strong>mer.<br />
Karl Whitelock Nancee Ruzicka<br />
Senior Consulting Analyst – OSS Competitive Strategies Senior Research Analyst – OSSCS<br />
kwhitelock@stratecast.com nruzicka@stratecast.com<br />
15
Bangalore<br />
Bangkok<br />
Beijing<br />
Buenos Aires<br />
Cape Town<br />
Chennai<br />
Delhi<br />
Dubai<br />
Frankfurt<br />
Kuala Lumpur<br />
London<br />
Mexico City<br />
Mumbai<br />
New York<br />
Oxford<br />
Palo Al<strong>to</strong><br />
Paris<br />
San An<strong>to</strong>nio<br />
Sao Paulo<br />
Seoul<br />
Shanghai<br />
Singapore<br />
Sydney<br />
Tokyo<br />
Toron<strong>to</strong><br />
CONTACT<br />
US<br />
Palo Al<strong>to</strong><br />
2400 Geng Road, Suite 201<br />
Palo Al<strong>to</strong>, CA 94303<br />
Tel 650.475.4500<br />
Fax 650.475.1570<br />
San An<strong>to</strong>nio<br />
7550 West Interstate 10, Suite 400,<br />
San An<strong>to</strong>nio,Texas 78229-5616<br />
Tel 210.348.1000<br />
Fax 210.348.1003<br />
London<br />
4, Grosvenor Gardens,<br />
London SWIW ODH,UK<br />
Tel 44(0)20 7730 3438<br />
Fax 44(0)20 7730 3343<br />
877.GoFrost<br />
myfrost@frost.com<br />
http://www.frost.com<br />
ABOUT STRATECAST<br />
Stratecast directly assists clients in achieving their objectives by providing critical, objective <strong>and</strong><br />
accurate strategic insight, in a variety of forms, via an access-<strong>and</strong>-industry-expertise-based<br />
strategic intelligence solution. Stratecast provides communications industry insight superior <strong>to</strong><br />
a management consultancy, yet priced like a market research firm. Stratecast’s product line<br />
includes: Monthly Analysis <strong>Service</strong>s [Convergence Strategies & <strong>Network</strong> Architectures (CSNA),<br />
OSS Competitive Strategies (OSSCS), <strong>Network</strong> Professional <strong>Service</strong>s Strategies (NPSS),<br />
Consumer Market Strategies (CMS), <strong>and</strong> Business Market Strategies (BMS)]. Weekly Analysis<br />
<strong>Service</strong> [Stratecast Perspectives <strong>and</strong> Insight for Executives (SPIE)], St<strong>and</strong>alone Research, <strong>and</strong><br />
Business Strategy Consulting.<br />
ABOUT FROST & SULLIVAN<br />
Frost & Sullivan, a global growth consulting company, has been partnering with clients <strong>to</strong><br />
support the development of innovative strategies for more than 40 years. The company's<br />
industry expertise integrates growth consulting, growth partnership services <strong>and</strong> corporate<br />
management training <strong>to</strong> identify <strong>and</strong> develop opportunities. Frost & Sullivan serves an extensive<br />
clientele that includes Global 1000 companies, emerging companies, <strong>and</strong> the investment<br />
community, by providing comprehensive industry coverage that reflects a unique global<br />
perspective <strong>and</strong> combines ongoing analysis of markets, technologies, econometrics, <strong>and</strong><br />
demographics. For more information, visit http://www.frost.com.