Modern Network Monitoring: Unifying NMS Telemetry with Kentik NMS

Hi, everyone. Thanks for joining us today. So we are excited to share a demo with you, but first, I wanna share a bit of our story. Kentik, we have been an expert in the network observability space for years at this point. So, of course, we know everybody has an NMS And so, like, NMS is a very mature product that our customers have been using forever. And it's very important I mean, it's a critical piece of your operational suite. It's keeping all of your networks running, keeping your software running, and ultimately that keeps your business running. So we know that, but we've also noticed that more and more, our customers, they're starting to, let's say, take issue with their NMSs. And that's part of the reason why they often have more than one, I think. They're losing trust in them. These NMSs, they're usually old, they're slow, they're bloated. And even worse, there have been some catastrophic security events in the industry, and that's got people second guessing these tools. Like, should we be using these these, NMSs that we've had on board for a long time? So if we're taking a look first at what NMS does really excel at. It's designed to just assess the health and performance of your network. Right? At best, it's gonna make those metrics about the network's health, actionable, accessible to the engineering team. And it's great at helping engineers solve for known unknown. So for example, maybe, a faulty network at salty network device. And that is in contrast to observability tools. So observability tools are more designed to help engineering teams solve for unknown unknowns. One weakness that they have though that we hear from our from our customers In most of these metrics observability systems, they don't really understand the network. So particularly for data centers or on premise infrastructure, You have to spend a lot of time to get them to perform the basics of an NMS. Like, interface utilization polling or data parsing and visualization alerts. To get that out of one of these observability systems that you see here, You have to configure a lot of it from scratch. So we've we've heard of the customers complaining about that. And Kentik, we have that observability principle of empowering engineers to solve for unknown unknowns. We've got that into our DNA. We call it, answer any question. Kentik was built to help network engineers solve these harder problems. But that required a different approach than what most network visibility tools take. We started out by pioneering a newer frontier of network visibility and that's advanced traffic analysis. That's bringing all of your networks to Kentik, making sense of your telemetry by adding context to it, showing teams insights from their traffic and providing a platform for exploration and what we like to call human powered automation. So down approach to solving unknown unknowns in the network space, it really relies on or it was built out of advanced traffic analysis. And that's that huge value for our customers who are running these really large, running these really large complex networks with varying leaning teams, and we see that a lot. Our focus on flow analysis started to attract the most advanced network engineers They lean heavily into using flow analysis versus more traditional strategies like SNMP monitoring because it makes them more efficient. But still, at the end of the day, every team we work with, they still need an NMS. Like, even if they're leaning into flow, they still need that. So we've heard our customers say over the years, why don't you build an NMS? So we can use Kentik to monitor up and down and interface stats with SNMP. I I've been talking a lot at you about what our customers have been saying. I think that these requests that we build that we build SNMP monitoring are really driven by that distrust and dissatisfaction in NMS that I mentioned earlier that the tools are old. They're slow. They're bloated. But to give us more detail, Chris, my colleague here, has been working with NMS customers for years and understands these challenges better than anyone. So, Chris, can you talk to us a bit about kind of what you've heard in the field and and what these challenges are? Yeah. So there's a lot of NMS in the world, and it's like so why do people keep asking us for another one? We wanna understand what challenges our causing them to ask that question. So, you know, I talked to a bunch of these folks, and what I learned is, pretty consistently. People were wanting much faster polling. The average polling or the com most common polling interval is every five minutes. And that just doesn't fit for today's networks. When something is down for thirty seconds, that's pretty bad. So five minutes not great. The fastest polling people were doing is is one minute, and that's maybe ten percent of the folks that I talked to. And even then, A minute in twenty twenty four is quite a long time. The other thing I heard was correlating data between tools. So particularly, of course, people talk to Kentik about traffic analytics. Your whole network's purpose is to move traffic, and they really care about what traffic precisely it is that the network is moving. But once they have some sort of interesting anomaly, observation, problem, They wanna correlate that to what's going on on my network gear, like an NMS typically tells them what's my CPU, what's my interface utilization, what are my BGP prefixes doing, all of those sorts of things. So that correlation, with traffic and even when synthetics and other technologies You know, you want all of these tools playing the strongest role in your tool set. Most of the folks I talked to also had One or two sort of snowflake specialty use cases where they wanna grab a data point and solve a problem, but typically, in a mess are not very extensible, which makes that difficult. And then, maybe the last one is the one where I saw the greatest variation. About half the people I spoke to were like, oh my gosh. I do not want an on prem in a mess. I'm tired of it. I don't wanna be installing servers, installing soft where running database servers, running polling, servers, all of these different things. I want out of that. I just wanna get my monitoring up and configure my monitoring. So half of the folks really were looking for something that was more like a SaaS deployment for their NMS. Half of the folks didn't care. Right? So It really depends on where you are as a as a company, but those are the big challenges I heard over and over. When you said that last one, I I always think back to that conversation we had with a customer. And she was like, you know, we're really trying to get out of the really trying to get out of the infrastructure business. Really trying to get out of of operating our infrastructure, and that really stuck with me. And I think, that's true at a lot of organizations. That's a huge initiative that they have. Yeah. Well, thank you for sharing those challenges. And I think the more we hear about those, the more that and and also the more we've heard, well, what about SNMP? Why aren't you doing it? What about network monitoring? The more we've asked ourselves, what is the observability way to do network metrics monitoring? Like, what's the Kentik way? What's the modern approach? And we know that to make that possible, we're gonna have to bring together our advanced traffic analysis with the NMS metrics data that we know every enterprise still needs so that teams can correlate that telemetry like you're talking about, Chris, just so they can understand it faster and more deeply. That's the modern approach. And it's bringing these together in a modern SaaS system that's gonna ingest all of that network telemetry that you need into one place That's where you get that platform to solve for unknown unknowns and really make sense of the data because it's all there and it's all automated for you. So on that note, I think we have an announcement. Right? We are excited to announce that we just launched our new next generation NMS, and we really are making what's old new again. You know, the team has been working on this for quite some time and, piloting you with customers with a select few customers who've provided great inputs, and we're really excited how it's looking and and can't wait to show it to more people. What we've really seen with customers in our pilot program and our private release programs for Kentik NMS is that consolidating these two tools flow analysis and network monitoring, or or four tools, as we said at the beginning, it means faster correlation and and greater network team efficiency. So that's helping our customers to lower their costs, while also increasing the efficiency of the team, it really is a win win. And I think why tell you about that anymore when when we can show you? So go ahead, Chris, take it away. Okay. So the first challenge that I told you about was, slow polling and stale data. And what we can see on the screen is data coming from SNMP. We're pulling once per minute, which is about as fast as you can go with SNMP before you start worrying about overloading that piece of network infrastructure. And the story that this data is telling me is I'm sitting around one, two percent CPU utilization, and then between one zero two AM at one zero three AM, I increase to about nine percent, and then it goes back down at one zero four AM. Chris? So you were talking about kind of low fidelity data, and I just heard you say that one minute is about as fast as as, I can get with pulling, the SNMP. If I need a faster interval, like, let's say I'm troubleshooting something mysterious and I wanna pull faster. But can I can I change that? What's the default? And and can I Can I do it faster if I need to ad hoc? Yeah. So one minute is the default. That's Again, the fastest you wanna go with SNMP, but to get faster than that, you need to use newer, collection technologies, something like streaming telemetry. So we can look at this same time period, from streaming telemetry data, and we see here we're collecting that data one data point per every two seconds or so. So much more granular data. And from that, you know, the conclusion I would derive then is It's really one zero three and twenty seven seconds this morning, and, this morning that we had that problem, that the CPU increased or that the CPU increased to twenty nine percent. That lasted for about ten seconds and then CPU decreased to twenty percent. And then after about ten seconds, we were back down to normal. So this is actually quite a different picture than we just saw. Right? With the SNMP data, once per minute, we see a spike to nine percent, and we may draw a conclusion that this device could support something like ten times as much load as it has now, versus the, streaming telemetry data where we can see it's more like this device could support maybe three times as much load. It's you know, device load isn't quite that linear, but you get the idea granularity of the data is really important and you draw different conclusions. Like, these are two very different stories as to what's going on in your network, and it's obvious which one is more accurate. Right? The other thing that that, faster data collection does for you is it opens the door to getting much fresher data in your NMS. So imagine you're troubleshooting some problem in your network and it seems to resolve revolve around this, arista one sixty. And so, looking at this device, we've got high CPU utilization here. Not a big surprise that there's some sort of network problem. Now I would go and troubleshoot this and come up with some sort of action to take to try and re resolve this problem, and then I would wanna see if NMS can confirm that I have indeed resolved the problem. So I'll take that action now. And typically with SNMP, it would take a a good while, like, ten minutes to see that data in your browser and you'd be refreshing the page and this sort of stuff. Here we can see the first data point, already with that coming down to thirty four percent, staying at that for a little bit. And so it's very fresh data. Not only is the data collection. Now we're at one percent Not as only as the data collection fast, but that data makes it all the way from the device through all the systems directly into your browser. Without a refresh and within five seconds or so. This is all very cool. She means lemmetry. Very cool. Do you have also kind of the basics of NMS. So if I wanna see up down and what's going on at my sites. Yeah. Yeah. Everyone needs your dashboard. Right? So we've We've got the basics of NMS that has things like, you know, the landing page where you've got these widgets. You can, adjust the size and placements of the widget. Got a bunch of widgets in our widget library, across all of our different tools. So you can, pull in widgets about your, cloud networks, about how you're doing peering, about synthetic results, and DDoS protection, All of those different widgets can fit in here. And out of the box, you get a widget, that shows your geographic map with what's going on at each of your sites. And if there's any problems, we can see device availability overall. We've integrated in traffic. You know, we do a lot of traffic analytics. So, we've got that right integrated into the dashboard. You can see any active alerts. This is our production network. No active alerts. That's definitely a good thing. And covering the very basics, things like interfaces with high utilization, CPU, and memory that's high, you wanna cover all of those basics continue to be important. If there's a problem there, then your customers have a problem. Your users have a problem. If I wanna zoom in on a specific device, Can I do that? What kind of data can I see about about a specific device? Yeah. Sure. So we've got your full list of devices here. And I know one of the more interesting devices in our network is this Edge o three. So jumping into that device, we can see NMS has discovered he this is a juniper. It's a MX two zero four. We've got a serial number if we need to do remote hands. We've got software version information. We're covering the basic metrics, in addition to that metadata, including utilization, CPU memory, temperature, If we jump into traffic, we've got, data and our exploration interface from, our traffic analytics directly in here. So all of this data is filtered for this specific device. So we're looking at, you know, what InMS is covering about the device, those typical in mass data points, and we can immediately correlate those with the traffic, filter to what traffic is transiting this device. We can slice and dice that data however we want using some of the common slices below or the filters. And then if we wanna do a deep dive, we can use data explorer, which we think is the world's best way to analyze your flow. We're covering interfaces, interface stats are super important in an NMS. So things like CPU utilization, sorry, interface utilization, errors and discards, the descriptions for filtering and searching. All of that sort of stuff is covered. You can drill in to see the graphs and charts. We also cover the hardware. So, you know, you've got all sorts of hardware on these, large systems, a chassis will sometimes have hundreds or thousands of pieces of hardware. You know, think about all of the line cards and the SFPs plugged into those line cards And we're covering all of those things in this components tab. So if a power supply goes down and you've got redundant power supplies, none of your production traffic is impacted as if one of two power supplies go down, but by gosh, you wanna know that that's down so you can go and, fix that, replace that power supply. And restore your redundancy. So that hardware is covered as well. We're doing some more advanced things with BGP, IS, and and some other protocols So we can see here all of the neighbors you have, their state. We can see we're, peering with AS five seven nine seven six, and can take market intelligence has figured out that that's blizzard entertainment, so they give us an a nice human readable label. And we can see the history as far as prefixes sent and received. One of the things we heard most frequently when we were talking to people about why they wanted the NMS from us is they wanted the exploration capability. You know, you can do a pretty advanced questions, in our query builder for Flow about your traffic, and they wanted that for their NMS data too. So in, Kentik NMS, basically anywhere you see a data point, you can click to drill into that And you'll see the exact question in our query builder that that data point is answering. So you can understand, you know, what aggregation level was that at, what was my sample size, how recent is that data point. The other thing you can do is use that as a jumping off point. So, you know, I saw that the the number of prefixes sent and received for that one device, but maybe I'll remove the filter and then run that query again. And all of a sudden, I can ask that precisely that exact same question across all of my different devices and see the results and trends there. Very stable in our network, which is which is great. Now there's tons of different options to do filtering and sorting and manage your your windows and filter based on metrics values, maybe only eighty percent. And one of the things we've been playing with is making this more accessible by using natural language. So at the top here, I can type for example, top interfaces by utilization. And what that's going to do is translate that, natural language explanation into a query on the right hand side, and run that query and just show me the answer in the chart here. So I've got all of these interfaces. Maybe maybe I don't like all of those, IRB interfaces. Yeah. I don't need those. So maybe I'll add here excluding interfaces with IRV in the name. And I can just iterate on that query until I'm getting exactly what I wanna It's a really pleasant way to interact with your network in a more sort of natural way. So that's everything that I have for a quick demo. And with that, I'll pass it back Key Rosalind. I have I have one more question if you don't mind, Chris. Yeah. You showed us the NLQ Can I use natural language query, like natural language formatted queries across metrics data? And then also, like, the traffic flow data, or is that only for metrics? Yeah. You absolutely can. You can do that, in this journeys, which is a whole another demo, but you definitely can. Kentik has always been used by the world's largest and most complex networks since our beginning. We've also always been SaaS first from day one. And our customers are enjoying the benefits, like Brian, the CTO at PenTeleData. We showed you a lot of exciting stuff today. I think I got my questions answered, but you probably have some questions too. Please reach out to us to let us know your questions and to book your own custom demo of Kentik NMS if you would like. And check out Kentik NMS to learn more at Kentik dot com.