WHITE PAPER
Virtual Cascade Shark
Enabling ubiquitous visibility in virtualized enterprises
VIRTUAL CASCADE SHARK – ENABLING UBIQUITOUS VISIBILITY IN VIRTUALIZED ENTERPRISES
Executive Summary
Enterprises have been using Cascade® products from Riverbed Technology for many years to discover,
monitor and troubleshoot their physical network and application infrastructure. Cascade network
performance management (NPM) solution offers a rich set of functionality to understand network and
application performance in the context of end-user experience, and to uncover problems in an organization’s
physical infrastructure. With enterprises aggressively embracing virtualization, this sea change has brought
new visibility gaps in IT infrastructure.
Virtual Cascade® Shark® software is a software version of the Cascade Shark appliance that resides inside
a hypervisor to provide visibility into virtual environments. Enterprises now have a solution that addresses
the new challenges IT managers, administrators, and operators face with managing application performance
within virtual environments.
Introduction
Over the last few years, maturing virtualization technologies have had a significant impact on enterprise IT
environments. According to Gartner, as of mid-2011, at least 40 percent of x86 architecture workloads have
been virtualized on servers1. This installed base is expected to grow five-fold from 2010 through 2015 driven
by the expected increase in workloads and a 75 percent lift in market penetration.
In the past, many companies embraced virtualization for non-critical business applications. But increasingly,
they’re beginning to host business-critical applications within a virtual environment. And many are using
virtualization to support cloud deployments.
Virtualization brings many benefits to an IT organization, including improved resource utilization, improved
performance, improved disaster recovery, higher availability, and capital savings. Along with the good, it also
introduces management complexity that threatens to diminish the benefits with added operational cost. The
challenges include virtual sprawl, lack of visibility into application performance, and new interdependencies.
This paper discusses the lack of visibility in the context of monitoring and troubleshooting end-to-end
application performance.
The Challenge
As companies move their business applications–critical and non-critical–from physical to virtual
environments, a shift in traffic occurs. Traffic that once freely moved between one application server to
another application server in a fully physical environment is now largely localized within each physical host.
That means applications running within a virtual machine (VM) communicate with other applications on the
same physical host. The activity between VMs hosted within a physical machine is considerable and goes
undetected from a monitoring standpoint. Without proper monitoring and troubleshooting in place, virtualized
environments could be compromised by lack of control and security.
Magic Quadrant for x86 Server Virtualization Infrastructure, Gartner RAS Core Research Note G00205369,
June 30, 2011
1
© 2012 Riverbed Technology. All rights reserved.
1
VIRTUAL CASCADE SHARK – ENABLING UBIQUITOUS VISIBILITY IN VIRTUALIZED ENTERPRISES
Customers have long benefitted from Riverbed® Cascade® because of its ability to monitor and rapidly
troubleshoot problems within physical environments. Virtual Cascade® Shark® products extend the same
monitoring and troubleshooting capabilities to virtualized environments for complete enterprise-wide
visibility.
Performance Management in Virtual Environments
In physical environments, performance management is accomplished using flow and/or packet technologies.
Cascade customers use flow technologies, such as NetFlow and sFlow, to monitor bandwidth consumption,
traffic composition and other performance management metrics. Additionally, they deploy packet capture
appliances for enhanced troubleshooting and richer transactional analysis. This flow and packet combination
has been utilized for several years and it is the de facto standard for network performance management.
Many of the performance management functions that are available for the physical environment are also
necessary for the virtual environment. However, this information is not readily available in many of the
virtualization technologies today. To gain visibility in a virtualized infrastructure, customers have to go
through great lengths. But most solutions are expensive, cumbersome and non-cohesive for virtual
environments.
Figure 1 Virtual Cascade Shark
A virtualized system consists of one physical host that abstracts processor, memory, storage and networking
resources into multiple virtual machines (VM). Each VM can run an unmodified operating system and
associated applications. Insight into interactions among various virtual machines on each physical host is
necessary for network performance management best practices.
Deployed within a virtual machine, Virtual Cascade Shark software is a virtualized implementation of the
Cascade Shark appliance. It provides visibility into virtual environments by monitoring all application traffic
traversing the hypervisor. Both the Cascade Shark appliance and Virtual Cascade Shark software capture
and store packet-level information on the local system for back-in-time analysis in the same manner. They
© 2012 Riverbed Technology. All rights reserved.
2
VIRTUAL CASCADE SHARK – ENABLING UBIQUITOUS VISIBILITY IN VIRTUALIZED ENTERPRISES
also send network and application metrics to the Cascade Profiler appliance for real-time monitoring,
analysis, and reporting.
Virtual Cascade Shark software must be deployed on each physical host for complete visibility into virtual
environments. Figure 1 (above) shows a single physical host with several virtualized server applications and
an instance of Virtual Cascade Shark software. Virtual Cascade Shark software captures interactions among
server applications and reports them to the Cascade Profiler appliance for correlation with data that is
aggregated from various data sources from physical and virtual environments. This provides an end-to-end
view into application performance as it traverses both the physical and virtual network.
Furthermore, interactions among server applications can be stored as packets on the local disk or to a
storage area network (SAN). The stored packets can be used for retrospective troubleshooting using the
Cascade Pilot packet analysis console. Users can drill down from the Cascade Profiler analysis console into
the Cascade Pilot console using the integrated drill-down feature in Cascade Profiler.
By using Virtual Cascade Shark software, customers can realize several benefits of restoring visibility in their
virtualized environments:





Continuous monitoring of interactions between server applications within the same physical host
Accurate end-user experience metrics enabled by response time measurement
Deep retrospective analysis of server interactions using stored packets
Baseline virtual environment traffic analysis to identify abnormal changes to the environment
Monitoring for security threats
Visibility Everywhere
Moving beyond physical and virtual environments, there are several other scenarios where visibility is
needed, but a dedicated continuous packet capture appliance may not be viable due to business restrictions
or cost, for example, in a small regional office or in branch locations. Or, for local visibility within the branch
or inter-branch visibility in the case of peer-to-peer traffic such as VoIP.
When a full-fledged appliance cannot be justified, organizations can take advantage of the hardware
independence of Virtual Cascade Shark software. Organizations can deploy Virtual Cascade Shark software
on a commodity server running VMware ESXi that can be used to capture packets via a SPAN port on a
physical switch (or a packet source). Virtual Cascade Shark software reports network and application
metrics to the Cascade Profiler appliance and can also store packets locally for retrospective analysis using
the Cascade Pilot analysis console.
© 2012 Riverbed Technology. All rights reserved.
3
VIRTUAL CASCADE SHARK – ENABLING UBIQUITOUS VISIBILITY IN VIRTUALIZED ENTERPRISES
Figure 2 Full visibility
Physical
Virtual
Branch
Physical or Virtual, Cascade Shark Products are the Right Choice
For enterprise-wide visibility, a mix of Cascade Shark appliances and Virtual Cascade Shark software
provide the broadest coverage. Before making the choice, customers must determine where visibility is
needed, what type of performance is needed, and the volume of traffic to be processed.
Due to high performance and guaranteed packet capture, Cascade Shark appliances are ideal for data
center environments where the volume of traffic is significant. In a virtualized data center, Virtual Cascade
Shark software is required in each physical host to gain visibility. In a hybrid environment where physical
and virtual infrastructures co-exist, physical and virtual Cascade Shark products operate in a complementary
manner. Small regional offices and branch locations that may have constraints for deploying a physical
appliance could instead deploy Virtual Cascade Shark software on a commodity server.
Cascade Visibility Ecosystem
As discussed, Virtual Cascade Shark software and Cascade Shark appliances together provide deep insight
into virtual and non-virtualized environments. When combined with other products in the Cascade portfolio,
such as Cascade Profiler, the result is broader visibility and end-to-end monitoring capabilities for
enterprises of all sizes. In addition, the analytics package powers the Cascade solution to greater heights
by enabling low-touch proactive monitoring by base-lining enterprise network behavior. Together, the
products in the Cascade ecosystem provide multi-dimensional visibility for enterprise environments that
continue to be dynamic and complex with new and emerging technologies and trends.
© 2012 Riverbed Technology. All rights reserved.
4
VIRTUAL CASCADE SHARK – ENABLING UBIQUITOUS VISIBILITY IN VIRTUALIZED ENTERPRISES
Figure 3 shows the Cascade product ecosystem and its applicability to different parts of the enterprise
infrastructure for full visibility.
Figure 3 Cascade ecosystem
Conclusion
Enterprises are rapidly adopting virtualization for dynamic service delivery and service management agility.
IT challenges already exist in virtual environments and will only be exacerbated with the higher adoption of
virtualization. The ability to proactively monitor traffic within these environments is critical for enabling
predictable and reliable delivery of applications and for troubleshooting diverse IT infrastructures.
Riverbed Virtual Cascade Shark software provides a simple yet complete solution for gaining visibility into
virtual environments. When used in conjunction with Cascade Shark appliances, Cascade Profiler, and
Cascade Pilot, organizations can gain full visibility into their dynamic hybrid IT infrastructures.
About Riverbed
Riverbed delivers performance for the globally connected enterprise. With Riverbed, enterprises can successfully and intelligently
implement strategic initiatives such as virtualization, consolidation, cloud computing, and disaster recovery without fear of
compromising performance. By giving enterprises the platform they need to understand, optimize and consolidate their IT,
Riverbed helps enterprises to build a fast, fluid and dynamic IT architecture that aligns with the business needs of the
organization. Additional information about Riverbed (NASDAQ: RVBD) is available at www.riverbed.com.
Riverbed Technology, Inc.
199 Fremont Street
San Francisco, CA 94105
Tel: (415) 247-8800
www.riverbed.com
© 2012 Riverbed Technology. All rights reserved.
Riverbed Technology Ltd.
One Thames Valley
Wokingham Road, Level 2
Bracknell. RG42 1NG
United Kingdom
Tel: +44 1344 31 7100
Riverbed Technology Pte. Ltd.
391A Orchard Road #22-06/10
Ngee Ann City Tower A
Singapore 238873
Tel: +65 6508-7400
Riverbed Technology K.K.
Shiba-Koen Plaza Building 9F
3-6-9, Shiba, Minato-ku
Tokyo, Japan 105-0014
Tel: +81 3 5419 1990
5