Cisco today announced Tetration Analytics, a new appliance that Cisco is launching for data center visibility and monitoring. According to Cisco, the appliance has the capacity to process millions of flows every second, and can store hundreds of billions of “telemetry records.”
Information is fed into the Tetration hardware via agents. First is a “silicon-based agent” in specific models of the Nexus 9000 switch line that captures flow data at line rate. Cisco says the flow collection won’t affect switch performance.
Cisco also has software agents that sit in VMs and on physical servers to collect flow data, as well as other information such as the service name.
All these data go to the Tetration appliance. According to a Cisco video, the appliance can start producing analysis, such as application dependency mapping, about ten minutes after it starts receiving information.
The appliance also stores a deduped flow record for every flow that it has collected. This historical data can be used for analysis, reporting, troubleshooting, and forensics.
One cool use case Cisco described is the ability to test rule changes or policy updates against existing flow records to see whether that change, such as a new firewall rule, might affect production traffic.
This idea isn’t new. For instance, Skybox Security offers a Network Assurance module to assess network and firewall rule changes. And a startup called Veriflow uses near-real-time network state, based on device configuration, to model network state and let operators test changes against that state.
(Very) Quick Take
In the initial product rollout, the only network devices that can feed data to Tetration are the Nexus 92160YC-X and the 93180YC-EX because of the built-in silicon agent. Cisco is yet again making the case for custom silicon as a value-add (and cost justifier). It’s also tying Tetration closely to ACI.
This appliance is competing directly with established network visibility vendors such as Gigamon, and more recently, Big Switch, which is going after the monitoring and visibility market with its Big Tap application.
According to the press release, a full-rack appliance will be generally available in July.