How does network analytics collect data?

Network analytics collects data from a variety of sources, including from servers such as DHCP, Active Directory, RADIUS, DNS, and syslog, and from network traffic such as NetFlow, traceroute, and SNMP. It does so by using techniques such as telemetry and deep packet inspection (DPI) to build a rich database from which contextual information can be derived cisco data center.

Deep packet inspection (DPI)

DPI of select traffic flows is a rich data source for network analytics. An analysis of such traffic using techniques such as Network Based Application Recognition (NBAR) and Software-Defined Application Visibility and Control (SD-AVC) can discern the communication protocols being used.

Analytics engines can use this information in a variety of ways, such as setting of quality-of-service (QoS) parameters automatically or profiling endpoints.

Streaming telemetry

Streaming telemetry reduces delays in data collection. Telemetry provides information on anything from simple packet-flow numbers to complex, application-specific performance parameters. Systems that can stream more telemetry, from more sources and about more network variables, give the analytics engine better context in which to make decisions.

Context

Another important factor an analytics engine considers is context. The context is the specific circumstances in which a network anomaly occurs. The same anomaly in different conditions can require very different remediation, so the analytics engine must be programmed with the many variables for contexts, such as network type, service, and application.

Other contexts can include wireless interference, network congestion, service duplication, and device limitations.

How does network analytics scrutinize collected data?

Network analytics derives intelligence and insights from data it aggregates from the network, hosts, and devices. Data from many sources allows network analytics to correlate and view issues from many different angles and contexts and to form a complete, accurate picture of the state of the network itself and endpoints in the network.

Analytics engine

The analytics engine, the software program that analyzes data and makes decisions, collects data from around the network and performs the desired analysis. This analysis may compare the current state with a model of optimal performance. Whenever the program identifies a deviation from optimal, it may suggest remediations or present its findings to a higher-level program or to the IT staff.

The analytics engine may also scrutinize endpoint traffic to help identify the endpoint itself or traffic behavior that may signal malware infection.

Cloud versus local analytics

Networking engineers often debate whether network analytics should be performed remotely, in the cloud, or locally, at the customer premises.

Placing the analytics engine in the cloud offers access to much more processing power, scale, and communication with other networks. Cloud-hosted analytics also benefits from up-to-the-minute algorithms and crowdsourced data. Placing the analytics engine on-premises offers better insights and remediation performance, and it reduces the amount of data required to backhaul to the cloud. Both of those advantages are particularly important in larger enterprise networks.

Should you use cloud or local analytics? The answer is, both. Machine learning (ML) and machine reasoning (MR) modules can be placed in the cloud to benefit from larger computing resources. But having the analytics engine on site can offer large gains in performance and save big on WAN costs.

Correlation

The analytics engine considers the relationship among variables in the network before offering insights or remediation. The correlation among devices, applications, and services can mean that correcting one problem can lead to problems elsewhere. While correlation greatly increases the number of variables in the decision tree and adds complexity to the system, it's essential so that all variables can be evaluated for accurate decisions.

Decision trees

Most analytics engines offer guidance on performance improvement through decision trees. When an analytics engine receives network data indicating subpar performance, the decision tree calculates the best network-device adjustment or reconfiguration to improve performance of that parameter.

The decision tree grows based on the number of sources for streaming telemetry and the number of options for optimizing performance in each point. Because of the complexity of processing these very large data sets in real time, analytics was previously performed only on supercomputers.

Insight

The analytics engine spots network anomalies, faults, and performance degradations by comparing the incoming streaming telemetry with a model of optimal network performance for each data source. That process produces insights into ways network performance and user experience can be improved.