Cascade Shark

Riverbed understands packet capture and analysis better than any other company. Riverbed brings together the three leading innovators in this field – Steve McCanne, co-creator of TCPDUMP, Loris Degioanni, creator of WinPcap, and Gerald Combs, creator of Wireshark – to continue the advancement of network performance management solutions that enable complete end-to-end visibility and analysis for network and application performance.

Cascade Shark delivers scalable, high-performance continuous packet capture and long-term storage, enabling real-time and back-in-time forensic analysis and reporting of network and security events across physical and virtual environments. Cascade Shark is an integral component of the Cascade network performance management solution, supporting the seamless marriage of flow monitoring and packet-based troubleshooting.  

Some of the advantages that Cascade Shark and Cascade Pilot provide over other packet capture solutions include:

Truly distributed analysis – Distributed analysis eliminates the need to export large trace files across the network for local analysis. Cascade Pilot analyzes trace files directly on remote Cascade Shark appliances, refining the data to send the specific packets of interest to Wireshark for decoding. Distributed analysis means that when the network is experiencing issues, your performance management solution is not part of the problem.

Smart packet indexing – Packet meta data called microflows provides efficient real-time indexing of packet data. Microflow technology enables users to quickly search terabytes of data and provides a seamless transition between flow-based information in Cascade Profiler and packet-level information in Cascade Shark. Smart indexing of packets accelerates the troubleshooting workflow, reducing the time it takes to identify, diagnose and resolve complex performance issues.

Wireshark integration – Tight integration and seamless hand off from Cascade Pilot to Wireshark streamlines troubleshooting and takes advantage of the network staff's expertise with Wireshark without having to learn yet another approach.

Flexible storage options – Multiple capture jobs on Cascade Shark appliances enable IT staff to dedicate different amounts of storage to each job to flexibly extend storage time for critical applications. Selective recording of all or a portion of the packets extends the amount of data that can be recorded and the length of time it is available for analysis. For example, one capture job could dedicate 75% of the storage on a Cascade Shark appliance to recording seven days' worth of traffic, retaining the entire packet header and payload for a business-critical CRM application, while a second capture job on the device could use the remaining 25% of storage to store a day's worth of all other traffic, recording only the packet header.

Whether deploying Cascade Shark appliances, Virtual Cascade Shark, or Steelheads that have Cascade Shark embedded or any combination, the Cascade Shark family provides a powerful, easy-to-use, and cost-effective solution for troubleshooting complex or intermittent performance and security-related problems without having to transfer large files across the network. By continuously recording the packets traversing the network, rich troubleshooting details are always available when the IT staff needs them. 

As a result, Cascade Shark:

• Saves time and money by helping IT troubleshoot problems faster
• Enhances IT productivity by avoiding lost time waiting for problems to reoccur
• Minimizes the effect downtime has on business productivity

Cascade Shark provides the following unique features and capabilities:

• Mix 1GbE and 10GbE interfaces on the same appliance for sustained, multi-gigabit per second recording of network traffic without packet drops
• Modular and extensive storage options, ranging from 4TB to 32TB, to meet a variety of capture and storage needs
• Available as a virtualized solution for monitoring and troubleshooting virtual environments 
• Multiple concurrent capture jobs, each capable of sustained line-rate recording, flexibly extend storage time of critical applications
• Multi-terabyte packet recordings are represented as a single "virtual file" in Cascade Pilot to streamline in-depth analysis and traffic visualization
• Truly distributed analysis, which eliminates the need to export large trace files across the network for local analysis
• Supports a wide variety of network protocols and traffic analysis metrics (called views) for in-depth troubleshooting, including:
  • LAN and network (MAC, VLAN, ARP, ICMP, DHCP, and DNS)
  • Bandwidth usage (microbursts, IP, TCP, Web, and VoIP)
  • Talkers and conversations (IP, subnets, countries, TCP, Web, VoIP, database, financial)
  • Performance and errors (IP, TCP, Web, VoIP, database, financial)
  • User activity (Web, VoIP, database, financial)
• Analysis can be applied to live traffic on Cascade Shark's local network interfaces or to off-line network traces stored in Cascade Shark's storage system
• Smart file indexing that accelerates packet analysis by up to 10,000x
• Ability to adopt the precision time stamps from SPAN port aggregators for greater accuracy and for coordinated time stamping across the network. Supported network taps include: Gigamon GigaVUE appliances, cPackets cVu family (with option Precision Timing module installed), and VSS Monitoring.
• Real-time microsecond alerting and microburst views for fine-grained analysis that is often required by low-latency applications
• Selective recording of all or a portion of the packets extends the amount of data that can be recorded and the length of time it is available for analysis
• Multiple capture jobs on Cascade Shark appliances means the user can dedicate differing amounts of storage to each job to flexibly extend storage time for critical applications
• Tight integration with Wireshark for decoding and deep packet analysis

Cascade Shark appliances, whether part of a complete Cascade network performance management solution or as a standalone troubleshooting tool, are typically deployed wherever detailed and historical back-in-time analysis is needed, such as within the datacenter, headquarters or key branch offices.