The Packet Slicing feature of the GigaSMART® engine truncates packets while preserving the portion of the packet (the protocol headers) required for network analysis. Packet Slicing can parse variable header packets, starting slicing after a named header (IP, TCP, etc.) with or without VLAN and other tags. Thus, there's no need to rely on a fixed offset to slice packets.
Packet Slicing removes payload that may be irrelevant to network monitoring and security analysis. This reduces tool throughput and disk space while improving performance and data retention. It also removes sensitive data before it is stored, which makes regulatory and privacy compliance easier.
Benefits of the Packet Slicing feature
Removes sensitive information from each packet, thus helping address compliance and confidentiality requirements.
Improves tool performance by eliminating unnecessary transmission of unneeded packet payload.
Increases storage capacity by giving tools more room to store the important portions of each packet.
Increases data retention time on forensic or network recorders.
Reduces needed disk space for backup traffic by up to 95%.
Packet Slicing: one of many GigaSMART features
GigaSMART®offers a number of other essential traffic intelligence services required for active visibility into infrastructure blind spots, including:
Forward the First Set of Packets, then Slice or Drop the Rest
Inspecting long data flows hogs bandwidth and causes unnecessary processing burden on tools. (A flow is HTTP session or any general TCP/UDP session.)
GigaSMART® Advanced Flow Slicing application eliminates these issues by slicing payloads and packets from long data flow. This allowsnetwork operationteams andservice providersto forward the first set of packets in the flow, then slice or drop the rest — saving your bandwidth and increasing tool effectiveness.
Benefits of Advanced Flow Slicing:
Reduces traffic sent to tools by more than 60%
Avoids costly tool upgrades to inspect unnecessary traffic
Improves overall tool efficiency and effectiveness
Retains complete visibility into each flow’s establishment
Data De-Duplication: Stop Overloading Your Tools with Duplicate Packets
Are duplicate packets weighing down your systems? Data duplication occurs when redundant copies of files and other data are generated within your network. Unfortunately, these additional copies take up vital storage space and computing power, decreasing network speed and efficiency.
With Gigamon, the problems associated with packet duplication are a thing of the past. Consider GigaSMART®De-duplication. GigaSMART De-duplication can revolutionize the way your business handles stored data.
What is De-duplication, and why is it important?
Even the most advanced networks and servers have only a finite amount of data storage. And that means if you want your system to run efficiently, you need to make sure that limited storage space isn’t being wasted on maintaining multiple copies of identical data — such as those created during a system backup. Data de-duplication is a process by which unnecessary duplicate data copies can be effectively eliminated from your system. Here’s how:
Improve network speeds by eliminating redundant copies and duplicate packet storage
Centralize data de-duplication and provide multiple tools with the same feed
Gain better performance analytics and reduce false positive results
Get faster, more accurate forensics and malware detection
Unburden your network from the weight of duplicate packets so it can run at hyper speed — packet de-duplication makes it all possible. Take advantage of our newbundled GigaSMART apps to optimize network visibility!
False positives from your analysis tools for problems that don't exist
Inaccurate flow data in NetFlow/IPFIX reports
Prevent packet duplication before it becomes a bigger issue for your network and security tools.
Selected Layer 3 and Layer 4 fields are configurable for duplicate detection, with detection intervals between 10-50,000 μs. Normal packet forwarding changes, such as the source and destination MAC addresses are ignored, ensuring the fidelity of transmitted packets.
SSL/TLS encryption is rising as enterprises face more stringent security mandates, need to ensure optimal SEO rankings, deploy more workloads to the cloud and make wider use of software-as-a-service (SaaS) applications. In fact, over 90 percent of internet traffic around the globe is now encrypted.[1]
Unfortunately, encryption isn’t limited to well-meaning parties. Consider that over 2.8 Million cyber-attacks in 2018 were hidden in encrypted traffic.[2] Cybercriminals use encryption to conceal malware, hide command-and-control traffic and cloak the exfiltration of stolen data.
Given the amount of encrypted traffic, including with the latest TLS 1.3 cryptographic protocol, the threat vector it now poses and the importance of traffic inspection for a Zero Trust Posture, you need a way to efficiently decrypt SSL traffic, share it with tools and then re-encrypt it.
What is SSL Decryption/TLS Decryption?
To protect vital data, businesses and other organizations implement Transport Layer Security (TLS), commonly referred to as the superseded Secure Socket Layer (SSL), to encrypt data as it is exchanged over IP networks. SSL/TLS creates a secure channel between the server and the end users’ computer or other devices as they exchange information over the internet.
TLS is an industry standard based on a system of trusted rules and certificates issued by certificate authorities and recognized by servers. SSL was replaced by the TLS standard in 2015. In 2018, TLS 1.3 was standardized which mandates the use of Perfect Forward Secrecy for maximum security. Up to 40 percent of large enterprises have already instituted this latest incarnation.[3]
While protecting data, encryption also blinds network security and application monitoring tools. The decryption of SSL/TLS traffic is crucial for these tools. However, it is extremely computationally intensive and can introduce network latency.
The best architecture minimizes the decryption required to inspect all relevant traffic while offering legal and privacy controls. The centralized approach to decrypting SSL offered by Gigamon, decrypt once and feed all tools, provides such an architecture.
GigaSMART®SSL/TLS Decryption is a licensed application that enables information security, NetOps and applications teams to obtain complete visibility into SSL/TLS traffic regardless of protocol or application, so that they can monitor application performance, analyze usage patterns and secure their networks against data breaches and threats using encrypted communications. Gigamon supports both inline/Man in the middle and passive/out-of-band decryption of SSL/TLS, meeting the diverse needs of your organization. Gigamon supports the latest TLS 1.3.
SSL/TLS detection on any port or application
10 Mb to 100Gb interface support
Decrypt once, share with any tools as many times as you need
Strong crypto support including Diffie-Hellman Ephemeral, Elliptic Curves, Poly1305/ChaCha20
Power controls over certificate validation, extending Certificate Revocation Lists and Online Certificate Status Protocol (OCSP)
Integration with the Venafi Trust Protection Platform™ to centralize key management and validation
Meet privacy and compliance requirements: included support for URL categorization
NetFlow is an efficient method for delivering basic Layer 2–4 network traffic data to analysis tools. But extracting high-quality NetFlow using routers and switches can severely strain resources, leading to dropped packets. Other problems include reduced accuracy by relying on sampling and restricted interoperability due to limited format options.
TheGigaSMART®NetFlow module overcomes these roadblocks by automatically generating NetFlow records and exporting them to your SIEMS, storage platforms and other tools. NetFlow from Gigamon has these advantages:
Offloads NetFlow generation load from routers and switches
Provides full fidelity NetFlow intelligence vs. information derived from sampled packets
Supports all formats, including IPFIX and CEF
Gigamon NetFlow provides network and security teams with visibility into traffic types across systems, including multi-cloud environments. This helps organizations catch denial of service attacks, data exfiltration and other security-related activities. Similarly, network- and application-performance management (NPM and APM) tools can quickly troubleshoot and remediate user experience concerns and ensure SLAs.
Expand your metadata choices to over 5,000 attributes and obtain Layer 7 insights. These include details on hundreds of social media, database, ICS, financial and many other types of applications. Find out how usingGigamon Application Metadata Intelligence.
Apply Application and Traffic Intelligence to Your Network
GigaSMART®applications expand the capabilities of theGigamon Visibility and Analytics Fabric™to improve network visibility, traffic handling and tool efficiency. Combine or service-chain a range of GigaSMART applications to achieve exactly the results you want.
Examples include:
Application Intelligence:Visualize all applications on your network and forward only relevant application traffic for greater tool efficiency
SSL/TLS Decryption:Centrally decrypt traffic, including TLS 1.3 to eliminate network blind spots and re-encrypt after inspection to keep data secure
NetFlow and Application Metadata:GenerateNetFlowand over 5000 L3-7metadata attributesto provide contextual insights
Advanced Flow Slicing: Forward the first set of packets then slice or drop the rest to minimize bandwidth and reduce unnecessary burdens on tools
