Cascade Flow adds Latency to NetFlow

I’m told that Riverbed® Cascade® Flow has introduced latency metrics to their NetFlow exports.  With this new information, we can possibly report on latency between hosts, application latency and even latency involving services in the cloud (i.e. Monitoring Cloud Performance).

We have thousands of customers and a few dozen are collecting NetFlow or Cascade Flow from Riverbed Steelhead WAN optimization appliances. The balance is largely Cisco (e.g. Cisco WAAS) and a few other vendors like SonicWALL, Enterasys, Juniper, etc.

Latency is all the Rage

Latency is the new frontier in NetFlow collection and Riverbed is the 5th company that our IPFIX reporting tool includes latency trends for. The other vendors include:

• Citrix AppFlow / IPFIX
• Cisco Performance Monitoring / Medianet
• nProbe IPFIX
• SonicWALL IPFIX

Sadly, Cascade Flow is meant for Riverbed use only as they want their customers to buy their NetFlow reporting solution. What customers should be aware of is that Riverbed sets the NetFlow v9 header source ID to 0xbeef2002. They also use several element IDs including 100, 101 & 105 – 111 that Cisco may have already assigned to something else.

Riverbed Steelhead Problems

Since NetFlow is a Cisco technology, the above IDs Riverbed is using are not really available to be grabbed by a vendor other than Cisco.  Riverbed should be using IPFIX. When we asked Riverbed for the element ID translations we were told that they are proprietary and that they could not publicly disclose the format or the contents. We were a bit surprised to hear this as we had already signed an NDA and paid over $2000 to Riverbed to be an partner. On the other hand, I can understand that Riverbed wants their customers buying Mazu (aka Riverbed Cascade Network Performance Management).  Long term however, Riverbed Cascade problems might be on the horizon when it comes to working with other NetFlow collectors. This is the first vendor we’ve seen completely shut out other vendors from deciphering their flow exports.

We are Faced with a Question

Should we use the definitions for these IDs given to us by Cisco or label them with the names provided by Riverbed. Well, since Cisco owns NetFlow™ and Riverbed really should be using IPFIX for their unique flow exports like Sonicwall, Citrix, Plixer and nProbe plus, the fact that the large majority of our customers are Cisco focused, I’d have to say we are going with Cisco. But don’t worry, we are determined to figure out a way to create latency reports for Riverbed Cascade Flow exports. Contact me or plixer if you want to help us.

Riverbed Please Consider IPFIX

In the future, if Riverbed wants to continue using NetFlow v9 for Cascade Flow™, they should consider using values > 32767.  Even if they use IDs above 32767, they might still collide with another vendor but, it is less likely as there is a lot more room out beyond 32767.  Again, Riverbed could avoid all this by switching to IPFIX.

Riverbed Cascade Flow Provides Latency

Despite the above Riverbed issues, I’m sure everyone will appreciate these new Riverbed NetFlow exports especially when it comes to monitoring cloud services.  We commend Riverbed for jumping on board even if they refuse to share.

“To help admins know how their WAN is functioning, Steelheads can now export traffic flow information to NetFlow collectors.  I tested this using Scrutinizer from Plixer International and was impressed by how much information about my WAN was being captured and recorded.”

InfoWorld Media Group, Inc. (IDG Communications) – Keith Schultz

Riverbed® Cascade® http://www.riverbed.com/us/legal_notices.php Are the trademarks and property of Riverbed.com