This past week's Interop conference was an encouraging experience -- the Riverbed booth drew strong interest from attendees wanting to view our presentation and the Steelhead Mobile demonstration. But there was another observation this week that was even more noticeable than in past Interop conferences from previous years--a startling number of Cisco WAAS customers were actively visiting the Riverbed booth to investigate the Steelhead solution. I personally talked to more than a few WAAS users myself, and my colleagues who were also at the booth similarly reported being approached by inordinate numbers of Cisco WAAS users, including some individuals representing very large enterprises.
A common question they brought up was about how Riverbed addresses patches and CIFS protocol changes implemented by Microsoft. The apparent context of this question was in reference to a recent Windows operating system patch -- KB980232 -- distributed by Microsoft several weeks ago to address some security vulnerabilities in the Windows CIFS client. This patch causes subtle changes in the protocol behavior by Windows CIFS clients, resulting in problems during CIFS file save operations that are being optimized by Cisco's WAAS product. The problem has also been reported by Network World. But for these Cisco WAAS users, this recent difficulty was only the latest in a series of historic WAAS stability problems that they have faced. For this particular problem, Cisco has offered a fix, although that fix requires an upgrade to the newest and unproven WAAS 4.1.5f image (but no fix exists yet for users of WAAS 4.0).
The WAAS users I spoke with were intrigued to hear that Riverbed Steelhead customers have not been impacted by Microsoft's Windows patch. The reasons for the stability of Steelhead deployments go far beyond Riverbed's strong business and technical relationship with Microsoft (indeed, Cisco claims a similar relationship with Microsoft). Rather, the key difference in Riverbed's situation is the Steelhead's transparent TCP proxy architecture compared to the WAAS product's layer-7 caching/proxy approach used to optimize CIFS traffic. In other words, WAAS is a CIFS proxy, while Riverbed is not (Steelheads are a TCP proxy, but not a layer-7 proxy).
As a CIFS proxy, WAAS is responsible for acting as a proxy CIFS server when optimizing CIFS traffic from Windows workstations. In such a role, WAAS must fully and adequately respond to each and every CIFS message from Windows clients receiving optimization services from WAAS. If a Windows client initiates a message that WAAS doesn't expect or understand (such as due to the Microsoft patch), then its optimized CIFS session can potentially be impacted. In other words, in order to properly deliver WAN optimization services for CIFS traffic, WAAS must essentially be as statefully aware of the layer-7 CIFS session as the original Microsoft CIFS client and server. This stringent requirement to properly mimic the behavior of a CIFS server leaves WAAS vulnerable to behavioral changes in Windows clients that may occur as a result of Microsoft patches, such as KB980232.
In contrast, Riverbed Steelheads are not CIFS proxies, and they do not need to be as statefully aware of the CIFS session as a CIFS proxy would. This is an important distinction that allows Riverbed to focus on optimizing only those messages and operations that exhibit chatty protocol behavior. If the CIFS client exhibits unexpected behavior that the Steelhead does not understand or anticipate, the Steelhead can simply ignore those messages because it is not a CIFS proxy. Rather, since the Steelhead is transparent to the CIFS session, it can let the CIFS client interact directly with the original Windows server in the data center for those unrecognized CIFS messages. In this situation the Steelhead continues to offer data deduplication services in order to address bandwidth constraints in the WAN, but the Riverbed solution is not compelled to take any action on the unrecognized message or unexpected behavior that might jeopardize the stability of the ongoing CIFS session.
The fact that the Steelhead is not a layer-7 proxy for CIFS and other applications is one of the key reasons why Riverbed has consistently been able to scale Steelhead deployments for the largest and most complex network environments in the world. While Riverbed products are not perfect, and they do have their share of bugs and other issues, nevertheless the overall track record and stability of the Riverbed solution when deployed in such demanding enterprise environments has been very remarkable.