Story image

Big Switch Networks rolls out new capabilities for app-level analytics and threat remediation

03 May 18

Big Switch Networks has announced updates to Big Mon, or Big Monitoring Fabric, a next-generation network packet broker.

The new innovations, Big Mon Recorder Node and Analytics Node, will enable network and security operations teams to capture cloud-native data centre network traffic at scale while providing application-level analytics.

Big Mon Recorder Node allows high-performance packet recording, querying and replay functions, while Big Mon Analytics Node provides network visibility to monitor, discover and troubleshoot network and application performance issues as well as accelerate root cause of security breach discovery.

Big Switch claims these two innovations allow customers to achieve deep network telemetry for both cloud and traditional data centre environments, while also enabling customers to replay past conversations across users and applications. Big Mon can also be extended to multi-cloud environments, including hybrid cloud and public cloud.

Big Switch Networks chief product officer Prashant Gandhi argues, “Big Switch has pioneered the use of cloud-native networking architectures to achieve pervasive network visibility and enhanced network security.”

Gandhi adds, “With the launch of Analytics Node and Recorder Node, Big Switch further distances itself from legacy box-based solutions, offering unmatched network telemetry to achieve root cause analysis, breach mitigation, and faster mean time to resolution.”

A Big Switch Networks customer, The University of Oklahoma, deployed Big Mon nearly two years ago. The University was replacing a legacy NPB solution, and since then, has deployed Big Mon Analytics Node and Recorder Node as well to tackle three challenges: unauthorised application and device sprawl, capacity planning, and threat mitigation.

The University’s managing director of security operations and architecture Aaron Baillio explains, “Analytics Node and Recorder Node have provided us with an efficient, cost-effective and scalable way to address multiple challenges that we faced due to having an open network.”

“Analytics Node together with the packet capture capability of the Recorder Node has allowed us to reinforce security posture by rapid impact analysis and mitigation of compromised user credentials.”

According to Big Switch Networks, Big Mon Recorder Node offers the following benefits to customers:

  • Feature-rich packet capture, query and replay functions
  • Programmable and scriptable via REST APIs
  • Supports PTP / NTP based timestamping of recorded packets
  • Works on an industry standard x86 server with 160TB storage and 10G NIC
  • Easy-to-use, scale-out, high-performance
  • Integrates with the Big Mon Controller to enable centralised configuration and operational workflows via Big Mon Controller
  • Supports Big Mon Analytics Node-powered event-triggered automated packet capture workflows
  • Integrates with Big Mon Service Node for applying advanced packet functions to filter or massage the traffic, prior to sending it to the recorder: de-duplication, packet slicing, packet masking, header stripping, regular expression matching (DPI) and netflow generation


Additionally, the company claims Analytics Node offers the following benefits:

  • Supports various Health / Capacity Planning / Troubleshooting dashboards
  • Supports Performance views like Top Talkers, Top Apps, TCP connection / latency tracking etc
  • Supports Security views displaying Rogue DHCP/ DNS servers, identifies IP / MAC Spoofing etc
  • Support various Host views like New Hosts seen, DHCP OS fingerprinting etc
  • Supports Automatic alerting on exceeding various thresholds like link utilisation etc
  • Supports sFlow/NetFlow collection to provide real-time application level visibility, including tunneled or encapsulated traffic, enable detection of security attacks like DoS/DDoS and support sub-second triggering
  • Easy-to-use, scale-out, high-performance
  • Integrated / centralised configuration and operational workflows via Big Mon Controller
  • Works on an industry standard x86 server with 128G RAM, 2TB SSD storage and 10G NIC
Symantec releases neural network-integrated USB scanning station
Symantec Industrial Control System Protection Neural helps defend against USB-borne cyber attacks on operational technology.
SingleSource scores R&D grant to explore digital identity over blockchain
Callaghan Innovation has awarded a $318,000 R&D grant to Auckland-based firm SingleSource, a company that applies risk scoring to digital identity.
Ramping up security with next-gen firewalls
The classic firewall lacked the ability to distinguish between different kinds of web traffic.
Spark Lab launches free cybersecurity tool for SMBs
Spark Lab has launched a new tool that it hopes will help New Zealand’s small businesses understand their cybersecurity risks.
Gartner names LogRhythm leader in SIEM solutions
Security teams increasingly need end-to-end SIEM solutions with native options for host- and network-level monitoring.
Cylance makes APIs available in endpoint detection offering
Extensive APIs enable security teams to more efficiently view, enrich, and contextualise real-time intelligence collected at the endpoint to keep systems secure.
SolarWinds adds SDN monitoring support to network management portfolio
SolarWinds announced a broad refresh to its network management portfolio, as well as key enhancements to the Orion Platform. 
JASK prepares for global rollout of their AI-powered ASOC platform
The JASK ASOC platform automates alert investigations, supposedly freeing the SOC analyst to do what machines can’t.