This section describes the equipment choices available to you. It includes the following sections:

When determining what kind of equipment you need at each site—whether that site is a data center, a branch office, or a large building on a corporate campus—answer the following questions:

The following table shows additional NetProfiler solutions for several reporting attributes you might want to capture.

The following table shows additional SteelCentral solutions for several reporting attributes you might want to capture.

In choosing the right equipment, you want to make sure that the data you receive is the data you need. The following table describes some of the different flow formats supported by SteelCentral and specifies the features available within these formats.

In most environments different sites have varying numbers of users and volume of network traffic. A site with 10 users transferring large files all day generates many fewer flows than a site with 200 users making extensive use of web-based applications. For calculation purposes, Riverbed recommends that you use 40 to 60 fpm as the estimated average flows per minute per IP endpoint. Exact flows per minute depend on the traffic characteristics in your environment and can vary beyond the estimates.

Use multiplication to estimate the maximum number of flows per minute. For example, 100 users that each generate 50 fpm produce an approximate flow rate of 5,000 fpm. However, if the site has servers that are accessed from remote locations, the overall flow rate is likely to increase, potentially by a large amount. If you have used flow tools in the past, you might already have some flow estimates. You can also look at session counts on SteelHeads, firewalls, or load balancers to assist in obtaining flow estimates.

You must have the appropriate number of technical staff on site. In a small remote office of only a few non-technical people, deploying a virtual version of an appliance might make more sense than installing one or more physical appliances.

Consider other network equipment that is already installed at a site when you decide which SteelCentral product to install. If an office site contains multiple large switches capable of generating NetFlow or SPAN and port mirror traffic, a NetShark or Flow Gateway might make sense. Conversely, if a small office contains only a wireless internet router with no other network infrastructure, you have limited options for deploying visibility solutions; it is possible you might not need a SteelCentral solution in this location.

If you have a site that reports significant quantities of data across a WAN, consider the bandwidth used by SteelCentral for the transfers. Typical WAN bandwidth use is approximately 1.5 percent of monitored traffic. SteelCentral products report flows once per minute. If reporting multiple megabytes of traffic per minute seriously impedes the performance of WAN links, you might need a different solution: for example, restricting the amount of data being monitored.

The NetProfiler is licensed on a flow-per-minute basis, with the number of flows counted after all flows have been deduplicated. You want to choose the right NetProfiler model so that you do not receive inaccurate results as a result of receiving excessive numbers of flows. Consider the following factors when you are deciding which type and model of NetProfiler to install:

There are two models of the NetExpress: NetExpress 470 and NetExpress-v 470. The functionality of the appliance and virtual editions is the same. Each version shares the same licensed capacities and maximum packet storage capabilities.

After deduplication, NetExpress 470 has flow rates ranging from 15,000 to 120,000 fpm. The NetExpress is best suited for smaller organizations or a small subsection of a larger network. Because the NetExpress can forward the flows it receives and processes directly to a different model of NetProfiler, this deployment can make sense for sites in which there is a need for local visibility and broader enterprise-wide visibility.

The NetExpress includes functionality similar to that of the NetProfiler, NetShark, and Flow Gateway. You can install a more compact deployment by combining the functionality into a single physical or virtual appliance.

The following table shows the NetExpress model options. Most features are available in the base unit. The NetExpress is 1U high, and you can upgrade in the field to the next-higher flow-rate version. If you want to analyze traffic within a software-defined network, you can add a software-defined network license.

The Standard NetProfiler is available as both a physical and virtual appliance. The primary difference between the two models is the amount of deduplicated fpm and available flow record storage that is available. The physical appliance limit is 10 Tb, and the for virtual appliance this limit is 50 Tb. The NetProfiler-v provides a broader range of flow limits.

The Standard NetProfiler has flow limits ranging from 200,000 to 1,000,000 fpm, and the NetProfiler-v has flow limits ranging from 15,000 to 2,000,000 fpm. The physical models are suited for medium-size organizations with between 4,000 and 20,000 hosts, and the virtual models with between 3,000 and 40,000 hosts assuming an average of 50 fpm per host.

The Standard NetProfiler and the NetProfiler-v cannot forward flows to other NetProfilers, nor can the Standard NetProfiler and the NetProfiler-v receive flows directly from flow sources (with the exception of NetShark). Because the Flow Gateways and NetSharks can forward flows to five distinct NetProfilers, you can use the Standard NetProfiler to monitor a small subset of a larger network. You can send the flows from the NetSharks and Flow Gateways to the local Standard NetProfiler monitoring a network subset and up to four additional NetProfiler or NetExpress systems.

The following table shows the Standard NetProfiler model options. Most features are available in the base unit. Each physical appliance is 2U high, and you can upgrade in the field to the next-higher flow-rate version through a software license. If you want to analyze traffic within a software-defined network, you can add a software-defined network license.

The Enterprise NetProfiler has a minimum flow limit of 1,000,000 fpm; you can increase the flow limit with Expansion modules up to a maximum of 10,000,000 fpm. Each module provides support for an additional 1,000,000 fpm (until you reach the maximum of 10,000.000 fpm supported). In terms of hosts, an Enterprise NetProfiler can support at least 20,000 hosts, assuming an average of 50 fpm per host. Each additional Expansion module adds support for another 20,000 hosts using the same assumptions.

The following table shows the Enterprise NetProfiler model options. Most features are available in the base unit. The base Enterprise NetProfiler is composed of two 1U units and one 2U unit. Each Expansion module is an additional 2U unit. If you want to analyze traffic within a software-defined network, you can add a software-defined network license.

To plan for future expansion, you must know the current estimated number of flows per minute and the expected flows per minute in the timeframe being planned for. For example, if the network currently has 6,000 hosts and is expected to grow to 14,000 hosts in the next two years, a Standard NetProfiler is sufficient to handle the growth. A software license and hardware upgrade enable a Standard NetProfiler licensed for 400,000 fpm to be upgraded to 800,000 fpm.

Another example is a network currently providing service to 14,000 hosts and expected to grow to 25,000 in the next year. In this situation, an Enterprise NetProfiler is a better choice. The Standard NetProfiler is sufficient in a 14,000-host network, but it is unlikely to provide adequate performance and capacity to manage the network when it grows to 25,000 hosts.

Take the same considerations when you plan for virtual deployments and physical appliances. While the NetProfiler-v might have higher overall flow capacities, it still has upper limits. When you deploy virtual solutions, make sure you do not overrun both the maximum licensed capacities and the maximum available hardware on the virtual platform.

To provide visibility into a subset of the network and a full overview of the entire network, you can install a smaller capacity NetProfiler (such as NetProfiler-v or a NetExpress, or a Standard NetProfiler sufficient for local traffic flow) in combination with a larger capacity NetProfiler (such as a Standard or Enterprise NetProfiler sufficient for overall traffic flow). This combination ensures that the system meets both the immediate and planned growth needs.

While all the NetProfiler and NetExpress devices including the standard, enterprise cluster, and virtual appliances can be supplied with dual network interfaces, those interfaces are not designed for high availability (HA) or other forms of redundancy. You might be able to add a second IP address to the interface; however this is not a supported function and there is no guarantee that the address will remain through a system reboot or upgrade. Changes from version to version can change the functionality of the secondary interface. The only exception to this change is the Dispatcher module on the Enterprise Cluster where the two interfaces may be bonded to provide improved performance on large capacity systems.

The Flow Gateway is available as both a physical and virtual model. The primary difference between the two options is ease of deployment. A single physical Flow Gateway is sufficient to manage a large number of devices. Both Flow Gateway and Flow Gateway-v provide up to 2,000,000 deduplicated flows per minute.

The upgrade from the smallest to the largest Flow Gateway within a class family (virtual or physical) requires only a license change.

The following table shows the available Flow Gateway models.

Consider the following requirements when you deploy the Flow Gateway:

For a medium-size organization with multiple disparate geographic locations, a single 2,000,000 fpm Flow Gateway might be able to manage the overall load; however, this configuration might not make sense if a significant amount of your corporate WAN bandwidth is consumed with the transmission of flow data: for example, from remote sites to a centrally located Flow Gateway. Because flow data is usually transmitted through UDP, an unreliable protocol, the likelihood of packet loss is increased the further a packet travels. In this sort of environment, Riverbed recommends that you deploy multiple smaller Flow Gateways or Flow Gateway-vs at major locations.

All the Flow Gateways (both physical and virtual) are supplied with dual network interfaces that are not designed for high availability (HA) or other forms of redundancy. You can assign an address to the secondary (AUX) interface. You can only use the AUX interface for receiving flows from flow sources. You cannot manage the device through this interface.

The NetShark is available as both a physical and virtual model. The primary difference between the two is packet storage capacity and packet processing speed (including write to disk speed). You must choose the appropriate NetShark platform to ensure that you can store the desired quantity of packets and that they are available for analysis. Capture cards are separately ordered items and you must make sure the cards ordered meet the needs of your network.

Deploy the NetShark with one or more capture cards. With the NetShark 6170 series you can have one or more 48 TB or 72 TB storage modules. If you have multiple modules, they must be identical capacities.

If you store every packet traversing a heavily loaded 10-Gbps network, the 72 TB of space on a NetShark 6170 with a a 72-TB storage unit allows approximately 23 hours of storage (assuming a throughput of 7 Gbps). The 576 TB of space allows approximately 184 hours of storage (assuming a throughput of 7 Gbps).

If you store every packet traversing a heavily loaded 1-Gbps network, the 32 TB of space on a NetShark 4170 allows approximately 163 hours of storage (assuming a throughput of 1 Gbps).

The following table shows the NetShark models.

The following table shows the NetShark-v models.

For more information about installing and configuring NetShark-v, see the appropriate documentation on the Riverbed Support site.

If you have deployed an AppResponse in your network, you can deploy a NetShark-based module directly on that appliance. This module provides most of the NetShark appliance analysis functionality to packets that are detected by the AppResponse. The NetShark module on AppResponse can build and forward traffic flows to a NetProfiler or NetExpress with no additional licensing requirements. For more advanced analysis and access to packet data (for example, using Packet Analyzer), you must purchase a NetShark license separately from any existing AppResponse licenses. With a full NetShark license you can access the entire packet store on the AppResponse through Packet Analyzer and perform most Packet Analyzer functions against those packets. Currently, access using the REST API is not supported on the NetShark module running on AppResponse.

The NetShark module running on AppResponse through version 9.0.3 is based on NetShark 10.0.6 code and is missing any of the newer functionality available with more recent versions of NetShark.

In RiOS 8.5 or later, you can deploy NetShark-v directly on the SteelHead EX platform on VSP. The NetShark-v has most of the functionality of a physical NetShark except that it does not perform Layer-7 DPI. The NetShark performs Layer-7 DPI using the same engine as the SteelHead EX and therefore performing Layer-7 DPI analysis with the NetShark-v on the SteelHead EX is redundant. To make sure you are receiving Layer-7 DPI information, export SteelFlow Net from the SteelHead EX in addition to deploying the NetShark.

Riverbed recommends that you deploy the NetShark-v on the SteelHead EX in branch environments in which you want additional visibility but deploying additional hardware is challenging. For NetShark-v on the SteelHead EX to receive packets, you must configure the packets to flow through either the primary or auxiliary interface on the SteelHead EX.

When you deploy Packet Analyzer, you must consider only how many users must perform deep-packet analysis. Packet Analyzer is Windows client software and can be licensed as follows:

Packet Analyzer can analyze traffic from either a virtual or physical NetShark, an Embedded SteelCentral NetShark probe, the NetShark module on AppResponse, or any standard packet capture files. You do not need Packet Analyzer for NetProfiler-level analysis and troubleshooting.