We all know traffic across the data center is increasing. The migration towards 100G ethernet is well underway, with 28% of data centers undergoing the upgrade as of 2018. Meanwhile, 400G ethernet is available and creeping towards widespread adoption. With more and more data passing through data centers, operators need granular information about what form the data may take. Network Packet Brokers (NPBs) are designed to make it easier for administrators and their tools to analyze this traffic, allowing for smoother and more functional data center operations.

Why Does Your Data Center Need Network Packet Brokers?

Even if you haven’t yet deployed 100G ethernet, you probably still need an NPB. Within your data center, you already have a lot of static tools designed to monitor network performance, provide visibility, and mitigate threats and bad actors. To function properly, these tools need a constant stream of packets—but without an NPB, there are few good options to manage them.

For example, you could put these tools directly inline with your incoming network connections, but this could potentially slow down traffic and create single points of failure. Accessing this traffic through network TAPs and SPAN ports provides visibility but can in turn generate too many incoming connections for your tools to process. Coping with this means adding more tools or more links, but this solution is neither efficient nor cost-effective.

Without the requisite data, security and monitoring tools can’t cover the entire network. There are blind spots where neither analytics tools nor human administrators can see what’s happening. This can lead to congestion and network outages—plus it can even give attackers enough cover to pull off a successful cyberattack.

These issues can be solved using a traffic aggregator or advanced features network packet broker. Network packet broker’s core functions are:

1. They aggregate network traffic, taking data from multiple ports and streaming it to a single port (and subsequently a single device). This means that you don’t have to purchase multiple tools to cover multiple links.
2. They filter network traffic, taking only the information specific to an individual tool and then directing it only to that tool. This helps your monitoring tool’s performance, by not getting overburdened by data.
3. They load balance. For example, if you have 40G of traffic coming in and your appliance only supports 10G interfaces, your NPB can load balance the traffic across 4 x 10G interfaces into the appliance.

It’s true that data centers are handling more information than ever, but much of this information is redundant or uncompressed, especially for the purposes of your monitoring tools. NPBs have the capability to compress and deduplicate this data, giving monitoring tools only what they need to function. In addition, their port aggregation features obviate the necessity of purchasing multiple tools to cover increased data center traffic.

>> Aggregation - Adding Value Back Into Your Network and Maximize ROI [Free whitepaper]

What to Look For in a Packet Broker

Traffic Aggregator vs Advanced Features NPB

There are two main categories of network packet brokers. Traffic aggregators or Advanced aggregators perform the key packet broker tasks of aggregating, filtering, regenerating and load balancing the traffic delivered from network TAPs and SPAN ports. In most use cases, this functionality is all that is needed.

Next-generation network packet brokers (NGNPBs) or Advanced Features NPBs have recently emerged as a successor to the original devices that were introduced around 2012. The major difference between these devices and their predecessors is a new set of features.

1. They can packet slice. If packets get dropped before reaching your security tools, then they’re useless for monitoring. Packet slicing reduces packets to only their most vital components, making it easier to store packets in memory and preventing dropped packets.
2. They can deduplicate. Network traffic also can contain duplicate packets. Processing duplicate packets is a waste of resources. Advanced NPBs can natively deduplicate packets for faster throughput.
3. They can perform time stamping. This means that you’ll know when each individual packet entered your network. If a packet comes in at the same time a problem starts to occur in your network, you’ll know to investigate that packet for potential problems.
4. They can tunnel, using Generic Routing Encapsulation (GRE) or VXLAN protocols that aren’t native to your network to transport packets, taking suspect packets directly from the switch to an endpoint for further analysis.

Whether your network implements the more advanced capabilities of an Advanced Features NPB or a traffic aggregator is up to your needs and projected growth. What’s certain, however, is that every data center that needs to scale its capabilities to meet increasing traffic demands needs a network packet broker of some description in order for it to function in a secure and efficient manner.

Looking to add a packet broker to your deployment, but not sure where to start? Join us for a brief network Design-IT consultation or demo. No obligation - it’s what we love to do.