Riverbed Cascade and Network Behavioral Analysis (NBA)

In the few weeks since Riverbed's acquisition of Mazu Networks, I've been able to meet some of our new colleagues and learn about Riverbed's newly-added Cascade line of products.  The more I've discovered about Cascade, the more excited I've become at its potential to add significant value for Riverbed's existing and future customers.  Of particular "coolness" is the fact that Cascade's capabilities go far beyond traditional network reporting.  Rather, Cascade happens to be the leading product in an entirely new product category known as Network Behavioral Analysis (NBA). 

Sure, Packetshaper and dozens of other network reporting products available on the market can spit out voluminous amounts of statistics and hand that data to you in some neat nice-looking graphical interface.  But the real question is can you make sense of all that data?  Can you tell if Application X is performing adequately from the perspective of the end-user?  Or of the 1000's of IP addresses on your network, which is the one that is doing something suspicious?

The fact is Riverbed Cascade offers far more than the capabilities of traditional network reporting products such as Packeteer.  Those legacy products merely feed you statistics; it's up to you to decide which of the 100's or 1000's of statistics that you are looking at has any significance.  And of course, the larger your network, the more statistics you get, to the point where information overload sets in, and you don't know what you're looking at, or what you're looking for.

That is the problem that Cascade is designed to address.  Cascade's NBA technology looks at historical behavioral patterns to determine if something out of the ordinary is happening.  Cascade sifts through the volumes of statistical data so that you don't have to, and alerts you when it finds meaningful behavioral changes anywhere in your network.  Unlike Packeteer and other traditional network reporting tools that present data from a per-link or per-device perspective, Cascade provides you with a high-level network-wide perspective of the health of your IT infrastructure.  Rather than merely providing you with round-trip ping times to each of your remote sites, Cascade tells you whether your end-users are experiencing fast application response times. Instead of only relying on gateway security systems deployed on your network perimeter, Cascade provides you with an added layer of security protection by monitoring the behavior of all of your internal network hosts, and alerting you to internal attacks that traditional firewall-based security systems are not equipped to detect or protect against.

This last aspect of Cascade is particularly interesting, because NBA technology actually grew from the need to identify threats that traditional security systems (e.g., firewalls, IDS/IPS, antivirus) were not designed to identify.  Cascade complements these defenses by detecting internal attacks from unauthorized users, activity, or software inside your network.

Comments

[primemover]

To describe the Blue Coat/Packeteer PacketShaper as a "network reporting product" is disapointingly misleading compared to what it and the other Mazu competitor products deliver.

[Josh Tseng]

>>>To describe the Blue Coat/Packeteer PacketShaper as a "network reporting product" is disapointingly misleading...<<<

Now that's an interesting statement. The PacketShaper users that I talk to, and even former Packeteer product managers that are now my colleagues describe the PacketShaper as a network reporting product. If it's incorrect to describe the PacketShaper in that way, then how would you describe it?

[FrameGuru]

To describe Mazu as the leader in NBA is also disappointing and inaccurate. As one example, Lancope has more than twice the customers, and an average larger deal size. They scale dramatically larger, and offer a much faster time to resolution. I am sure there are other examples as well.

[Josh Tseng]

The fact is that Lancope and the former Mazu are about the same size, with about the same revenue run-rates, and roughly the same market share. The primary difference is that Lancope is a more security-focused product, while Mazu's capabilities extend beyond security, to cover behavioral analytics for network performance and other general networking issues.

I respect all that Lancope has accomplished as a small private company. However, there are good reasons why Riverbed chose to purchase Mazu. Primarily, we believe that Cascade offers existing and future Riverbed customers the best capabilities in network analytics for the broadest range of network requirements.

[DavidS]

Agree with primemover. Reporting is just a part of the Packetshaper solution.