Tetration Analytics - Network Analytics & Machine Learning Enhancing Data Center Security and Operations Mike Herbert, Principal Engineer, INSBU BRKDCN-2040 Session Abstract Huge amounts of data traverse network infrastructure on a daily basis. With the innovative big data analytics capabilities, it is possible to use rich network metrics to provide unprecedented insight into IT infrastructure. By leveraging pervasive low overhead sensors in both hardware and software, a complete view of application and network behavior can be attained in real time. In modern data center today some of the key operational and security challenges faced are understanding applications dependencies accurately, ability to generate consistent whitelist policy model and to ensure network policy compliance. This session will describe how Analytics uses unsupervised machine learning approach to collect hundreds of data points and, use advanced analytics, addresses these challenges in a scalable fashion. BRKDCN-2040 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 3 If this is not what you were hoping for here are some other Tetration Sessions • Tetration Analytics, the secret ingredient for every Data Center • Session ID: PSODCN-1800 • Cisco Tetration: Data Center Analytics Deployment and Use Cases • Session ID: BRKACI-2060 • Tetration API’s : • Session ID: DEVNET-2423 • Tetration Analytics - Industry's Powerful Analytics Platform • Session ID: LABACI-3020 • Inside Cisco IT: ACI & Tetration Analytics • Session ID: BRKCOC-2006 BRKDCN-2040 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 4 Okay what does Tetration Mean? • Tetration (or hyper-4) is the next hyperoperation after exponentiation, and is defined as iterated exponentiation • It’s bigger than a Google [sic] (Googol) • And yes the developers are a bunch of mathematical geeks BRKDCN-2040 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 5 Tetration Analytics Platform Introduction We Are at the Cusp of a Major Shift TRADITIONAL DATA CENTRE CLOUD DATA CENTRE Adoption Curve HYBRID CLOUDS We are here Efficiency AUTOMATION IT as a Service IaaS | PaaS | SaaS | XaaS Flexible Consumption Models VIRTUALISATION CONSOLIDATION EFFICIENCY SIMPLICITY | SPEED DIGITAL EXPERIENCES 2000 2010 2015 The Next 5+ Years BRKDCN-2040 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 7 What if you could actually look at every process and every data packet header that has ever traversed the network without sampling? BRKDCN-2040 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 8 Cisco Tetration Analytics Pervasive Sensor Framework Provides correlation of data sources across entire application infrastructure Enables identification of point events and provides insight into overall systems behavior Monitors end-to-end lifecycle of application connectivity BRKDCN-2040 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 9 Cisco Tetration Analytics Policy Discovery and Observation APPLICATION WORKSPACES Public Cloud Private Cloud Cisco Tetration Analytics™ Application Segmentation Policy BRKDCN-2040 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 10 Profile and Context Driven Application Segmentation 1. Real-time Asset Tagging 2. Policy Workflows 3. Policy Enforcement (Role Based and Hierarchical) Cisco Tetration Application Insights (ADM) No Need to Tie Policy + to IP Address and Cisco Tetration Sensors Tag and Label-Based Add-on Policy Port (For Example, Mail Filters) Cisco Tetration Customer Defined Platform Performs the Translation Compliance Monitoring Enforcement Public Cloud Bare Metal Virtual Cisco ACITM* Traditional Network* BRKDCN-2040 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 11 Tetration Analytics: Open Access NORTHBOUND NORTHBOUND NORTHBOUND APPLICATION CONSUMERS CONSUMERS Kafka Broker Programmatic Message Tetration Interface Publish Apps Cisco Tetration Analytics Platform REST API Push Notification Tetration Apps Tetration flow search Out-of-box events Access to data lake Sensor management User defined events Write your own application BRKDCN-2040 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 12 Tetration Analytics Platform Architecture - Sensors Tetration Analytics Architecture Overview Data Collection Analytics Engine Open Access Software Sensor and Web GUI Enforcement Cisco Embedded REST API Network Sensors Tetration (Telemetry Only) Analytics Event Notification Cluster Third Party Sources (Configuration Data) Tetration Apps Self Managed Cluster No Hadoop / Data Science Background Needed Easy Integration via Open interfaces One Touch Deployment No External Storage Needed Open Data Lake (via Tetration Apps) BRKDCN-2040 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 14 Traditional Monitoring Is Showing Its Age Not suited for Modern Network and Security Operations Where Data Is Created Where Data Is Useful SNMP SNMP Server Non Syslog Real Syslog Collector time Storage & Analysis CLI Strong burden on Scripts back-end Normalize different encodings, transports, data models, timestamps BRKDCN-2040 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 15 Data Granularity Needs to Improve One Minute SNMP Polling Telemetry – 10 Second Push SNMP – 1 Minute Polling BRKDCN-2040 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 16 Data Granularity Needs to Improve 10 Second SW Process Push Telemetry – 10 Second Push BRKDCN-2040 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 17 Data Granularity Needs to Improve Sub Second HW/SW Push BRKDCN-2040 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 18 Data Granularity Needs to Improve Type of Problems Customers are Looking to Address Workload Placement Service Level Monitoring ADM Security and Policy Enforcement Microburst Detection Traffic Engineering Capacity Planning Troubleshooting & Remediation (Self Driving) On-Change <= 1 sec ~10s sec ~minutes-hours Resolution = Frequency of Data Collection BRKDCN-2040 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 19 Processing on the Source Device is Expensive e.g. Consider Flow Collection Efficiency 512K Sampled Flow Cache with Flow Flow Data streaming export Table • Collect and Keep all Flow Data in the • Maintain a small ‘cache’ and Local Hardware or Software Flow export the cache at a high data Table • Sampling Flows Reduces rate • Size of the Table depends on the Cost of the Telemetry but • Shift the cost of aggregation to Data Rates and Connectivity Density Reduces Accuracy backend resources • BW is Growing Faster than Memory • Aggregate ‘Flow Table’ can be (Cost of Flow Entry per Gbps is not much larger flat) BRKDCN-2040 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 20 The Richer the Data Sources the Better More Data == Better Interpolation Lamp Sensor Plug Sensor Heater BRKDCN-2040 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 21 The Richer the Data Sources the Better You don’t always know what you need in advance • On-Box Filtering Loses Data • Can’t Change Your Mind About What’s Important Later • Can’t Scale Out Embedded Processing • Compression (Lossless) is Good • Massive Amounts of Data Motivate the Shift in Collection • Bulk Collection is Efficient • Bulk Processing/Export Not So Much BRKDCN-2040 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 22 Streaming Telemetry is a game changer Monitoring becomes a big data problem Where Data Is Created Where Data Is Useful Removing limitations and complexity • Streaming paradigm Real time • Dense Sensor Framework • Increased Data Granularity Volume – Scale of Data Velocity – Analysis of Streaming Data • Update on every event Variety – Different Forms of Data • Multiple Data Sources Big Data and Machine Learning Problem BRKDCN-2040 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 23 Pervasive Sensors Software Sensors Network Sensors Third Party Sources Available Now Next Generation 9K switches 3rd party Data Sources Linux VM Asset Tagging Nexus 9200-X Load Balancers Windows Server VM Bare Metal IP Address Management (Linux and Windows Server) CMDB Nexus 9300-EX Universal* (Basic Sensor for other OS) … *Note: No per-packet Telemetry, Not an enforcement point New! Enforcement Point (Software agents) Low CPU Overhead (SLA enforced) Highly Secure (Code Signed, Authenticated) Low Network Overhead (SLA enforced) Every Flow (No sampling), NO PAYLOAD BRKDCN-2040 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 24 Tetration Sensors Locations 9732C-EX LC Hardware Sensor Packet and Flow Events Buffer and Switch State Software Sensor Processes & Socket Packet and Flow Events 92160CY-X 93180Y-EX HYPERVISOR HYPERVISOR HYPERVISOR Tetration Cluster BRKDCN-2040 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 25 Hardware Sensor EX and FX series Nexus 9000 • Embedded Module (Flow Cache) • Nexus 92160CY-X • Nexus 93180Y-EX & 9732C-EX Line Cards • Extracts Meta-Data from the forwarding pipeline • No latency impact, no performance impact Flow Cache PRX LUA LUB LUC BRKDCN-2040 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 26 Hardware Sensor Direct Export of the Hardware State Monitor SW State (polled, BGP EthPM STP timer driven, on demand, …) CPU sources the SW Telemetry Data (everything not in the HW export) Configure