Cascade Family Overview

Cascade^® combines flow analysis (NetFlow, sFlow, J-Flow, IPFIX, etc.) with packet capture and analysis to provide an integrated, top-down, application-aware network performance management (NPM) solution. Cascade gives network managers a single, integrated view of all network data, so they can discover and map critical services and applications, analyze and report on their status, and troubleshoot network performance and security problems faster than is possible with competitive offerings. As a result, the impact and duration of service outages is minimized and network management costs are reduced. Typical results include 83% faster problem resolution and 34% fewer downtime incidents per month.

• Application-aware – offers an application-oriented view of network traffic
• Proactive – alerts to problems before users call to complain, which enables fast resolution, often before the business is impacted
• Comprehensive – provides end-to-end network coverage with deep packet-level intelligence as needed
• Easy to use – provides a simple interface that delivers sophisticated functionality to solve complex solutions
• Fast time to value – offering an application-oriented view of network traffic
• Application-aware – deploys without having to modify applications and shortens your mean time to resolution

Cascade has an elegant and simple design that deploys quickly and easily in complex environments and provides true integration across the Cascade family and with Riverbed Steelhead® products. Cascade is the only network performance management solution to combine flow data and packet data into a single logical record. The result of our better architecture is accelerated problem resolution and the ability to scale more easily over time. This also means that Riverbed customers gain superior visibility, management and troubleshooting of their networks by deploying fewer appliances than others in the industry require to achieve similar results, saving our customers both capex and opex.

An ROI study of Cascade customers conducted by IDC in 2010 found a remarkable three-year ROI of 364% and a payback period of just 5.5 months. Among the benefits:

• Average annual benefits of $31,679 per 100 users due to improvements in IT staff productivity, user productivity and other cost reductions.
• Reduction in average mean time to resolution (MTTR) from 12.8 hours to 2.1 hours.
• Reduction in the average duration of help desk calls by 87%
• Average annual savings of $53,431 on server purchases and an average annual savings of $123,449 on tool purchases
• Decrease of 34% in the number of downtime incidents per month with a 51% reduction in the average incident duration
• Unmatched Leadership: Riverbed understands packet capture and analysis better than any other company. Riverbed brings together the three leading innovators in this field – Steve McCanne, current CTO and Executive VP at Riverbed, and co-creator of TCPDUMP, Loris Degioanni, creator of WinPcap, and Gerald Combs, creator of Wireshark – to continue the advancement of network performance management solutions that enable complete end-to-end visibility and analysis for network and application performance.

Network Performance Monitoring: Network performance monitoring (NPM) is the equivalent of visiting a primary care physician for regular checkups versus rushing to the emergency room when in crisis (troubleshooting). Cascade provides service-level dashboards based on powerful behavioral analytics that enable the IT organization to proactively monitor application and network performance to identify and resolve emerging issues before end users call the help desk to complain.

Network Troubleshooting: Effective network troubleshooting requires high-speed, high-fidelity packet capture and analysis to ensure that the packets – the definitive source of network information – are always available when needed. Cascade's packet-level analysis quickly pinpoints performance anomalies and isolates the root cause so the IT organization can quickly resolve the most challenging and complex network and application performance issues.

Discovery and Dependency Mapping: Major IT projects such as consolidation, disaster recovery or cloud have one thing in common: the IT organization first needs to find out what is currently running on the network. Whether the IT organization is consolidating a few servers or entire data centers, Cascade provides a cost-effective way to discover application servers and clients on the network and map the dependencies, without using agents or scanning.

WAN Optimization and Analysis: Cascade measures performance accurately in both optimized and non-optimized environments, enabling network managers to plan for WAN optimization, assess the impact of the deployment, and quantify benefits.

Network Security: Cascade leverages network-based analytics to identify advanced security events such as zero-day, "boutique" malware, and threats from creden¬tialed insiders that are often missed by signature-based security offerings. It automatically recognizes potential threats characterized by conditions such as changes in network or application behavior, resource usage, server modifications, or policy violations.

The Cascade Product Line
Customers achieve the greatest value and return on investment when deploying the entire Cascade family, which combines sophisticated end-to-end, service-level monitoring with high-speed, high-fidelity packet capture and analysis for both broad and deep network performance monitoring and analysis. However, Cascade Shark with Cascade Pilot can be deployed as a standalone network troubleshooting solution, while Cascade Profiler and Cascade Gateway provide robust, end-to-end network monitoring.

Cascade Profiler: Cascade Profiler is the centralized analysis and reporting console for the Cascade family, correlating information collected by Cascade Shark, Cascade Gateway, Cascade Sensor and even Steelhead products to provide centralized monitoring, analysis and reporting of network and application performance problems. Cascade Profiler enables enterprises to proactively monitor and troubleshoot applications and the network, automate discovery and dependency mapping, plan for capacity planning and WAN optimization, and assure a consistent and reliable end user experience.

Cascade Gateway: The Cascade Gateway appliance collects flow data (NetFlow, sFlow, J-Flow, IPFIX and other popular flow statistics) from network infrastructure devices and sends it to Cascade Profiler for analysis, providing cost-effective, enterprise-wide, behavior-based network monitoring.

Cascade Shark: Cascade Shark appliances deliver scalable, high-performance continuous packet capture and long-term storage, enabling real-time and back-in-time forensic analysis and reporting of network and security events. Cascade Shark appliances are typically deployed wherever detailed and historical back-in-time analysis is needed, such as within the datacenter, headquarters or key branch offices, and can be used as an integral part of the Cascade visibility solution or as a standalone troubleshooting solution.

Virtual Cascade Shark: A software version of Cascade Shark that has been virtualized to run on VMware ESX environments, Virtual Cascade Shark taps into the virtual switch in the ESX hypervisor to monitor the performance of all inter-VM traffic and send data to Cascade Profiler for analysis and reporting and/or to continuously capture packets and store them on the local server or on a storage area network (SAN) for back-in-time analysis with Cascade Pilot.

Cascade Sensor: The Cascade Sensor appliance performs deep packet inspection to supplement Flow-based data with Layer 7 application classification, end-user experience and performance metrics.

Cascade Sensor-VE: Virtualized Cascade Sensor software that runs on the Riverbed Services Platform (RSP) on Steelhead appliances, Cascade Sensor-VE is functionally similar to Cascade Sensor

Cascade Pilot: Cascade Pilot is a robust analysis console that enables users to quickly analyze multi-terabyte packet recordings on remote Cascade Shark appliances and Steelhead products without having to transfer large packet captures files across the network.

Steelhead: All Steelhead models (Steelhead, Virtual Steelhead, Cloud Steelhead and Steelhead Mobile) can provide remote site visibility to Cascade via flow export, packet inspection (Sensor-VE) and packet capture.

There are three primary deployment scenarios that can be achieved with the Cascade family. Each has its benefits. Ask a Riverbed sales person to help determine what's most appropriate for your organization's needs.

Scenario 1: Application-aware network performance management. This scenario uses every product in the Cascade family: Cascade Gateway for flow collection from network devices distributed throughout the network, including non-optimized branch offices, Cascade Sensor for Layer 7 application identification, Cascade Sensor-VE and Cascade Shark that is embedded on Steelhead appliances for branch LAN visibility, and Cascade Shark in the datacenter for deep packet capture and analysis and Virtual Cascade Shark for monitoring and troubleshooting virtualized environments. Cascade Profiler is the console that brings the disparate data sources together for analysis and reporting. Cascade Pilot is the analysis console for packet analysis for Cascade Shark products.

Scenario 2: End-to-end flow visibility. Cascade Profiler analyzes and reports on performance metrics provided by Cascade Gateway (flow collection of the end-to-end network, including non-optimized branch offices) and Cascade Sensor for Layer 7 application identification. This scenario provides proactive monitoring and troubleshooting, discovery and dependency mapping, network security, and WAN optimization analysis.

Scenario 3: Standalone packet capture and analysis. For customers who do not want to use flow metrics for monitoring and troubleshooting, Cascade Shark and Cascade Pilot can be deployed with Cascade Profiler for packet-based monitoring and troubleshooting. Steelhead appliances and Steelhead Mobile software also provide CascadeFlow to Cascade Profiler as well as initiate on-demand packet capture for analysis by Cascade Pilot.

Cascade provides end-to-end visibility into service performance – from the remote LAN, across the WAN and deep into the data center – in both physical and virtual environments. This latest version extends Cascade visibility into load balanced applications, virtualized computing environments, and VoIP quality, making today’s complex data centers more transparent for network monitoring and troubleshooting. The new multi-segment analysis and precision time stamp capabilities in Cascade Shark and Cascade Pilot 3.5 enable network manager to quickly determine where in the network problem are occurring.

The Transparent Datacenter

Visbility into application delivery controllers (ADC) – automates the process of discovering and mapping the ADC virtual IP (VIP) address to its backend pool of servers, to enable reporting and monitoring of load balanced applications and services. Cascade Profiler 9.5 supports F5 Local Traffic Manager (LTM), Riverbed Stingray Traffic Manager and manual mechanism for mapping other ADC solutions.

Virtual Cascade Shark – a software version of the Cascade Shark appliance that has been virtualized to run on VMware ESX environments, Virtual Cascade Shark attaches to the virtual switch in the ESX hypervisor to:

• Monitor the performance of all inter-VM traffic and send data to Cascade Profiler for analysis and reporting
• Continuously capture packets and store them on the local server or on a storage area network (SAN) for back-in-time analysis with Cascade Pilot

Virtual Cascade Shark can also be deployed on a customer-provided server as a low-end packet capture appliance.

VoIP quality reporting – while Cascade Shark/Pilot has had the capability to monitor VoIP quality, this latest release brings VoIP reporting into Cascade Profiler, further deepening the integration between the two products. Cascade Profiler can report on jitter, packet loss, MOS and R-Factor, as well as QOS category for H.323, SIP and Cisco SCCP (Skinny Call Control Protocol) signaling protocols. Cisco SCCP is a newly supported protocol.

Multi-segment analysis (MSA) – Cascade Pilot simplifies the task of correlating and analyzing related traffic streams captured from multiple locations or sources to quickly identify where on the network performance issues are occurring. Packet capture sources can include: 

• Cascade Shark appliances 
• Steelhead appliances with Cascade Shark embedded functionality or TCPdump 
• Third-party packet capture solutions, such as  WireShark, that support the standard pcap format

Ease-of-Use Enhancements

High-precision time stamps – Cascade Shark appliances can adopt the precision time stamps from network taps for greater accuracy and for coordinated time stamping across the network and with other monitoring tools in the customer’s environment. Precision time stamping is critical for low-latency trading environments or other time-sensitive applications and provides better accuracy for multi-segment analysis. Supported network taps include:

• Gigamon SMT-436 GigaSMART blade for the GigaVue-2404
• cPackets cPacket cVU & cTap families (with Precision Timing module option)
• VSS Monitoring Distributed Traffic Capture Series

Hierarchical device and interface grouping and reporting – an alternative to service-based views, the interface dashboard organizes all the devices and interfaces known to Cascade Profiler in a built-in and user-defined tree structure and streamlines access to interface-specific metrics, such as utilization, top 10 interfaces, QoS, etc.

Analytics enhancements – streamlines the process of bulk tuning analytics polices, by enabling all policies for a location to be edited from the same screen. In addition, analytics alert evidence tables for response time now automatically breaks down total response time into network round trip time (NTT) and server delay, allowing users to more quickly isolate where the delay is occurring.