What Is a Network Packet Broker, and Why Do You Need One?

A network packet broker (NPB) might be the most important tool you've never heard of. Keeping networks safe and users thriving amid the relentless flux requires a host of sophisticated tools performing real-time analysis. Your monitoring infrastructure might feature network and application performance monitors, data recorders, and traditional network analyzers. Your defenses might leverage firewalls, intrusion prevention systems (IPS), data loss prevention (DLP), anti-malware, and other point solutions.

However specialized security and monitoring tools may be, they all have two things in common:

• They need to know exactly what is happening in the network

• Their output is only as good as the data they receive

Ideally, a company would monitor 100% of its network with security and monitoring tools. In reality, this is not always the case. A 2018 survey conducted by Enterprise Management Associates (EMA) found that the majority of enterprises monitor less than 70% of their networks.1 When asked why they do not monitor 100% of their networks, the top response (38%) from IT professionals was “network complexity”. This feedback equates to having blinds spots in the network, and ultimately, to wasted effort, redundant cost, and a higher risk of being hacked.

To avoid waste and blind spots, start by collecting data about what is taking place across your network. Network taps and mirror ports on network equipment—also known as switched port analyzer or SPAN ports—create access points for capturing traffic for analysis.

This can be considered the “easy part.” The real challenge lies in efficiently funneling data from the network to each tool that needs it — and that's where a network packet broker comes in. If you only have a few network segments, and relatively few analysis tools, the two may be connected directly. More often, 1:1 connections may pose a management nightmare that becomes unwieldy, if not logistically impossible as the network grows. Additionally, ports on high-end analysis tools, such as firewalls, may also be in even shorter supply, and it is critical not to overtax devices to the point of compromising performance.

Why Do I Need a Network Packet Broker?

A network packet broker resides between taps and SPAN ports. They can access network data and sophisticated security and monitoring tools that typically reside in data centers. NPB’s do just what their name says: they broker network packet data to ensure every analysis tool sees exactly the data it needs to perform at the highest possible level. The NPB adds an increasingly critical layer of intelligence—one that reduces cost and complexity to help you achieve the following:

Better data for better decisions

Network packet brokers with advanced data manipulation capabilities organize and streamline data for your monitoring, performance, and security tools.

Tighter security

It is hard to stop threats when you do not see them coming. NPBs work to assure that your firewalls, IPSs, and other defenses see exactly the right data, all of the time.

Faster problem resolution

Zeus Kerravala, principal analyst at ZK Research, observes, “Problem identification is IT’s biggest challenge.” Identifying that there is, in fact, an issue consumes up to 85% of mean time to repair (MTTR). Downtime is money.

Data manipulation features provided by network packet brokers help you detect and determine the root cause of issues faster by introducing advanced application intelligence. Keysight's robust visibility architecture leverages this intelligence to speed up troubleshooting by providing insight into the geographic location of outages and the vendors that may be causing disruptions.