American Gas Retailer

How well applications use the network is especially important to this American corporation, which operates 1,400 gas stations throughout the Southeastern United States. Each new store is connected to a shared 10Mbps VSAT link and then upgraded to faster DSL connections, if available. Currently, more than 700 locations and numerous complex, critical applications share the meager VSAT link, including the following:

• A highly customized point-of-sale system that depends on more than 20 sub-applications

• A credit-card payment-processing application that must comply with payment card industry (PCI) regulations

• Centralized gasoline-price sign controls that send price updates to 3,000 signs each day

• Fuel-tank monitors that support refueling logistics

  "The distributed and bandwidth-constrained nature of our environment means that our Network team is the first to take the call when something goes wrong, whether it is a network or application problem," says a senior network security engineer. "We're the ones that get the call at 2 a.m. asking, 'Why can't we sell gas?'"

  Despite having numerous monitoring tools in place, including an unnamed competitor and SolarWinds, the Network team lacked insight into how the network and applications interacted. "We are responsible for fielding issues that would normally be assigned to the Application Support group or a DBA, so we need visibility into application and system performance — even if we don't have access to those systems," explains the senior network security engineer.

Seeking greater visibility into application health and performance, the Network team at this company launched a three-month product evaluation of more than 25 vendors, narrowing the candidates to ExtraHop, NIKSUN, and one unnamed competitor. The team chose ExtraHop based on its noninvasive deployment, ease of use, and superior analysis capabilities.

"Many of the tools we looked at relied solely on NetFlow, which provides a quick summary of who is talking to whom over which port, but no details for those conversations," they explained. "ExtraHop provided the application-level detail we sought, and did so without agents or synthetic transactions, which would have added unacceptable network overhead."

Operational Intelligence

Deployed in the corporation's primary datacenter, ExtraHop analyzes all transactions from L2 to L7 to extract critical health and performance metrics across the network, web, database, and storage tiers. This analysis gives the Network team the operational intelligence they need to answer previously intractable questions. In one instance, the Network team used ExtraHop to pinpoint the cause of slow web application load times.

"We had previously spent months trying to determine the root cause of extremely slow load times at certain stores," says one of their network engineers. "With ExtraHop, we saw the affected stores also had an abnormally high number of HTTP 304 status codes, indicating that the browser was checking for updated content despite it not having expired, resulting in asking the server for updated versions of each of the 18 web objects on that page. This was due to an incorrect browser setting, so we rolled out an update and used ExtraHop to watch the superfluous requests start to disappear."

Visibility for All Applications

The Network team uses the ExtraHop platform to gain application visibility even when they do not have direct access to those applications or systems. With this insight, they can provide actionable information to application owners.

"Our inventory system uses a batch FTP upload, and some of the files were not showing up or were corrupted," says the network engineer. "Though the network was suspect, we saw a spike in FTP 425 errors corresponding with the reported problems that meant the clients could not establish a data connection. With this evidence, we worked with the FTP server owner to fix the misconfiguration causing this behavior."