Story image

Big Switch Networks rolls out new capabilities for app-level analytics and threat remediation

03 May 18

Big Switch Networks has announced updates to Big Mon, or Big Monitoring Fabric, a next-generation network packet broker.

The new innovations, Big Mon Recorder Node and Analytics Node, will enable network and security operations teams to capture cloud-native data centre network traffic at scale while providing application-level analytics.

Big Mon Recorder Node allows high-performance packet recording, querying and replay functions, while Big Mon Analytics Node provides network visibility to monitor, discover and troubleshoot network and application performance issues as well as accelerate root cause of security breach discovery.

Big Switch claims these two innovations allow customers to achieve deep network telemetry for both cloud and traditional data centre environments, while also enabling customers to replay past conversations across users and applications. Big Mon can also be extended to multi-cloud environments, including hybrid cloud and public cloud.

Big Switch Networks chief product officer Prashant Gandhi argues, “Big Switch has pioneered the use of cloud-native networking architectures to achieve pervasive network visibility and enhanced network security.”

Gandhi adds, “With the launch of Analytics Node and Recorder Node, Big Switch further distances itself from legacy box-based solutions, offering unmatched network telemetry to achieve root cause analysis, breach mitigation, and faster mean time to resolution.”

A Big Switch Networks customer, The University of Oklahoma, deployed Big Mon nearly two years ago. The University was replacing a legacy NPB solution, and since then, has deployed Big Mon Analytics Node and Recorder Node as well to tackle three challenges: unauthorised application and device sprawl, capacity planning, and threat mitigation.

The University’s managing director of security operations and architecture Aaron Baillio explains, “Analytics Node and Recorder Node have provided us with an efficient, cost-effective and scalable way to address multiple challenges that we faced due to having an open network.”

“Analytics Node together with the packet capture capability of the Recorder Node has allowed us to reinforce security posture by rapid impact analysis and mitigation of compromised user credentials.”

According to Big Switch Networks, Big Mon Recorder Node offers the following benefits to customers:

  • Feature-rich packet capture, query and replay functions
  • Programmable and scriptable via REST APIs
  • Supports PTP / NTP based timestamping of recorded packets
  • Works on an industry standard x86 server with 160TB storage and 10G NIC
  • Easy-to-use, scale-out, high-performance
  • Integrates with the Big Mon Controller to enable centralised configuration and operational workflows via Big Mon Controller
  • Supports Big Mon Analytics Node-powered event-triggered automated packet capture workflows
  • Integrates with Big Mon Service Node for applying advanced packet functions to filter or massage the traffic, prior to sending it to the recorder: de-duplication, packet slicing, packet masking, header stripping, regular expression matching (DPI) and netflow generation


Additionally, the company claims Analytics Node offers the following benefits:

  • Supports various Health / Capacity Planning / Troubleshooting dashboards
  • Supports Performance views like Top Talkers, Top Apps, TCP connection / latency tracking etc
  • Supports Security views displaying Rogue DHCP/ DNS servers, identifies IP / MAC Spoofing etc
  • Support various Host views like New Hosts seen, DHCP OS fingerprinting etc
  • Supports Automatic alerting on exceeding various thresholds like link utilisation etc
  • Supports sFlow/NetFlow collection to provide real-time application level visibility, including tunneled or encapsulated traffic, enable detection of security attacks like DoS/DDoS and support sub-second triggering
  • Easy-to-use, scale-out, high-performance
  • Integrated / centralised configuration and operational workflows via Big Mon Controller
  • Works on an industry standard x86 server with 128G RAM, 2TB SSD storage and 10G NIC
Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."
Businesses too slow on attack detection – CrowdStrike
The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 cases.
Proofpoint launches feature to identify most targeted users
“One of the largest security industry misconceptions is that most cyberattacks target top executives and management.”
McAfee named Leader in Magic Quadrant an eighth time
The company has been once again named as a Leader in the Gartner Magic Quadrant for Security Information and Event Management.
Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.
25% of malicious emails still make it through to recipients
Popular email security programmes may fail to detect as much as 25% of all emails with malicious or dangerous attachments, a study from Mimecast says.
Google Cloud, Palo Alto Networks extend partnership
Google Cloud and Palo Alto Networks have extended their partnership to include more security features and customer support for all major public clouds.