pointer

Packet vs. Flow-based Network Analysis – the Markets Speak

With the introduction of flow-based metrics nearly a decade ago, the debate began between the use of flow-based metrics and deep packet inspection for network monitoring and analysis. Prior to the introduction, deep packet inspection was the go-to solution for both overall network monitoring and detailed network analysis. But as NetFlow data became more and more available from network devices, the market saw a definite shift towards flow-based data, especially for overall network monitoring.

And because NetFlow is so readily available, and so many IT organizations jumped on the NetFlow bandwagon, the use cases for NetFlow reporting expanded, with many organizations looking to NetFlow to be their only network monitoring and analysis solution.

But packet-based network monitoring and analysis solutions did not fade into the woodwork. Those who are ultimately responsible for troubleshooting complex network problems (you know who you are) never overestimated the capabilities of NetFlow and never underestimated those of deep packet inspection (DPI). Even though NetFlow-based solutions gained ground in the NOC, DPI solutions were not displaced. Over time the urge of IT management to make NetFlow solutions fit for every situation subsided, and both NetFlow and DPI solutions now coexist within the IT management infrastructure, each with its place. Flow-based solutions for monitoring; packet-based solutions for detailed analysis and troubleshooting.

And this week the markets validated what network engineers have known all along. DPI solutions are alive and well, and have a solid future within the portfolio of IT management solutions. How did the markets show this? With the announcement that JDSU plans to acquire Network Instruments for $200M. According to an online article on Enterprise Network Planet, Network Instruments revenue for the past 12 months was approximately $40M. So that means that Network Instruments sold for 5x its current annual revenue, a very strong showing indeed which reflects very nicely on the overall strength of the packet-based network analysis market.

So let’s stop looking at flow-based vs. packet-based as a debate, or an either-or decision. They both have their place in the IT infrastructure, and both serve a very valuable, albeit different, function. When planning for overall network visibility, packet-based network analysis must be part of the solution.

Leave a Reply