So I have to make a point about the new QOE Network PAS function. I realize this device is not like a Sniffer or Wireshark device but it has similar limitations. In a switched network, like most of administer, there is no single point to monitor like there was in the old hubbed network. So one has to move way upstream to be able to monitor data center applications. In most cases applications like accounting or email are congregated in a data center and usually across multiple servers and network switches in that data center. This means the only aggregation point to pick up all the conversations is at a data center core switch on the uplink connecting that data center core to the rest of the network. In large network this is typically a 10g uplink (soon to be 40g). This pretty much makes the Network PAS unusable. In our network we're using sniffer like devices on ports that span the uplinks. Since we typically have two uplinks for each data center core switch, the span port is aggregating 2 ports at 10g each for a total of 20g going to the sniffer device. In addition the span aggregation is monitoring both the transmit and receive side. This brings the data speed up to a potential of 40g. This is where the real problems begin. A typical sniffer hardware interface is 1g and as most of us know, it won't actually support a full 1G due to cpu limitations. So based on the above description, you wind up with a 1g monitoring device receiving a potential 40g signal. That's the proverbial 40 pound of **** into a 1 pound bag. Won't work. The way we've have gotten around this in our network is deploy an aggregation/filter device from a company called a Gigamon that takes the 40g or more span port signal and funnels it down to a 1g port. It does this by giving the user the ability to limit the signal to the port going to the sniffer via filters, such as IP address or port number. Even then one has to do a bit of math on the filter output to make sure it is below the 1g threshold.
So what's the net net of this dissertation? The network PAS probably won't work unless it is attached in the network in front of 1g only signal or it is connected behind a monitoring aggregation device as mentioned above. While I applaud Solarwinds for the addition of the PAS devices, I believe they should add a caveats list to the product documentation that details this issue. Also this issue is only going to get worse as vendors upgrade their hardware to support 40g interfaces. That 40g signal mentioned above now becomes a 160g span aggregation.