Big Switch Networks rolls out new capabilities for app-level analytics and threat remediation

Big Switch Networks has announced updates to Big Mon, or Big Monitoring Fabric, a next-generation network packet broker.

The new innovations, Big Mon Recorder Node and Analytics Node, will enable network and security operations teams to capture cloud-native data center network traffic at scale while providing application-level analytics.

Big Mon Recorder Node allows high-performance packet recording, querying and replay functions, while Big Mon Analytics Node provides network visibility to monitor, discover and troubleshoot network and application performance issues as well as accelerate root cause of security breach discovery.

Big Switch claims these two innovations allow customers to achieve deep network telemetry for both cloud and traditional data center environments, while also enabling customers to replay past conversations across users and applications. Big Mon can also be extended to multi-cloud environments, including hybrid cloud and public cloud.

Big Switch Networks chief product officer Prashant Gandhi argues, "Big Switch has pioneered the use of cloud-native networking architectures to achieve pervasive network visibility and enhanced network security.

Gandhi adds, "With the launch of Analytics Node and Recorder Node, Big Switch further distances itself from legacy box-based solutions, offering unmatched network telemetry to achieve root cause analysis, breach mitigation, and faster mean time to resolution.

A Big Switch Networks customer, The University of Oklahoma, deployed Big Mon nearly two years ago. The University was replacing a legacy NPB solution, and since then, has deployed Big Mon Analytics Node and Recorder Node as well to tackle three challenges: unauthorised application and device sprawl, capacity planning, and threat mitigation.

The University's managing director of security operations and architecture Aaron Baillio explains, "Analytics Node and Recorder Node have provided us with an efficient, cost-effective and scalable way to address multiple challenges that we faced due to having an open network.

"Analytics Node together with the packet capture capability of the Recorder Node has allowed us to reinforce security posture by rapid impact analysis and mitigation of compromised user credentials.

According to Big Switch Networks, Big Mon Recorder Node offers the following benefits to customers:

• Feature-rich packet capture, query and replay functions
• Programmable and scriptable via REST APIs
• Supports PTP / NTP based timestamping of recorded packets
• Works on an industry standard x86 server with 160TB storage and 10G NIC
• Easy-to-use, scale-out, high-performance
• Integrates with the Big Mon Controller to enable centralised configuration and operational workflows via Big Mon Controller
• Supports Big Mon Analytics Node-powered event-triggered automated packet capture workflows
• Integrates with Big Mon Service Node for applying advanced packet functions to filter or massage the traffic, prior to sending it to the recorder: de-duplication, packet slicing, packet masking, header stripping, regular expression matching (DPI) and netflow generation

Additionally, the company claims Analytics Node offers the following benefits:

• Supports various Health / Capacity Planning / Troubleshooting dashboards
• Supports Performance views like Top Talkers, Top Apps, TCP connection / latency tracking etc
• Supports Security views displaying Rogue DHCP/ DNS servers, identifies IP / MAC Spoofing etc
• Support various Host views like New Hosts seen, DHCP OS fingerprinting etc
• Supports Automatic alerting on exceeding various thresholds like link utilisation etc
• Supports sFlow/NetFlow collection to provide real-time application level visibility, including tunneled or encapsulated traffic, enable detection of security attacks like DoS/DDoS and support sub-second triggering
• Easy-to-use, scale-out, high-performance
• Integrated / centralised configuration and operational workflows via Big Mon Controller
• Works on an industry standard x86 server with 128G RAM, 2TB SSD storage and 10G NIC