Deep Packet Inspection and Beyond
Sandvine‘s acquisitions of CableMatrix and Simplicita were two of the intriguing deals announced at this year’s Cable-Tec Expo. What does this activity indicate about deep packet inspection (DPI) and high-speed data network management, in general?
Sandvine is most often identified as a DPI vendor. DPI is the examination of entire packets – instead of just headers – for malicious code and other flaws. ("What’s in that IP Stream?" is the title of the paper that Sandvine CTO Marc Morin presented at Cable-Tec.)
The focus on lone packets, however, is thought by Sandvine engineers to be too granular for complex modern broadband networks. The company therefore mixes DPI with application layer behavioral analysis tools that look at the dynamics of the entire session, said Tom Donnelly, co-founder and executive vice president of sales and marketing.
The high and low level data are used to create policies that determine how sessions will be handled by the network as conditions change.
The CableMatrix technology uses this data to create value-added service offerings. "It’s … oriented toward the service creation side of the business," Donnelly said. "For example, if the condition is that someone is uploading a photo or a series of photos, then the system can allocate prioritization for the duration of that transaction." Revenue generation In other words, Sandvine’s technology understands what is going on in the network and is capable of alerting engineers when a problem crops up. Combined with CableMatrix, it goes a step further to draw revenue out of reacting quickly to users’ needs. Sandvine and competitors – which, according to Yankee Group analyst David Vorhaus, include Allot, Ellacoya and Cisco Systems through its purchase of P-Cube) – seek to use what formerly were system maintenance tools as linchpins for generating revenue.
Said Vorhaus: "The holy grail for all these DPI companies, and Sandvine is very much in the category, is to get to a point where service providers are using their solutions to do more high level things such as ensuring QoS for traffic or using intelligence to create tiered service models."
Donnelly said that the change in the service can be done on a regular or ad hoc basis. For instance, a "turbo button" could allow gamers to increase their level of service whenever they feel the call of "Doom." The system also has hooks to the billing software.
This is not entirely new ground. Camiant, for instance, has used PacketCable Multimedia (PCMM)-based policy control technologies to enable cable operators to offer high-speed data speed boosts and speed previews to their customers. (For a related story, click here.) Simple security The Simplicita deal concerns security. Sandvine’s core technology determines if something is amiss in the network. Simplicita takes that data, information from the service provider and other sources and filters it through Simplicita’s reputation knowledge servers (RKS). The goal is to create the most effective and up-to-date policies.
"The better information you have, the better polices you can create," Donnelly says.
The Simplicita software also offers protection to domain name system (DNS) – the servers that translate domain names into Internet protocol (IP) addresses. Donnelly said that an application that detects and corrects user domain name typing errors (i.e., tying in "www.espm.com" instead of "www.espn.com") can be built around the Simplicita software.
The deals were strategic: Neither CableMatrix or Simplicita were producing significant revenues when they were acquired. Today, about 55 percent of Sandvine’s business comes from MSOs, 42 percent from telephone companies and the rest from wireless, Vorhaus says. He says that wireless is seen as an especially promising area for the technology.
Donnelly said that its cable customer base is more mature and that rollouts of the combined product are likely late this year or early next. The company inherited ongoing trials with the acquisitions, which already have closed.
– Carl Weinschenk
