ThousandEyes Device Layer Review

Your company’s applications are moving to the Cloud. There’s nothing you can do about that. You are just the plumber a.k.a Network Engineer. The user experience now relies on your local network, as well as the Internet. What are you going to do about that?

We have seen in previous reviews that ThousandEyes offers a layered approach to network monitoring and fault detection. Today, they are adding another data tier: the Device Layer.

ThousandEyes Device Layer allows checking the health and performance of physical network devices. Routers, switches, firewalls, and load-balancers will now be completely visible in terms of load on interfaces, throughput, discards and much more.

Thinking about the OSI model, ThousandEyes promises to correlate layer-7 issues down to layer-2 issues across internal and external network segments – and that’s for any application. Can you believe that? Well, trust no one. Let’s see that in action!

Disclaimer: This is a sponsored review. However, the content and opinions stated here are written independently by RouterFreak’s team. As always, we provide honest product reviews, unedited.

ThousandEyes Device Layer

The main feature of ThousandEyes is the ability to monitor applications and networks, correlating data coming from different layers. Its killing feature is definitely the ability to quickly distinguish between application problems and network issues – in minutes, if not seconds.

In the picture below, we see a typical troubleshooting scenario with ThousandEyes. At the HTTP Server level, there was an error affecting the application availability. Digging down to the Network layer (i.e. Path Visualization), we see that it was due to an end to end packet loss. Total troubleshooting time: 2 minutes to pinpoint the issue!

With Device Layer, you can now see the actual layer-2 devices traffic passes through within your internal network.

Routers, switches, transparent firewalls and load-balancers are now visible (see the next picture) and, most importantly, they come along with a ton of useful data to use when troubleshooting.

The usual Path Visualization is now enriched with insights on layer-2 devices. To see more about Device Layer, let’s check the Topology View. This layer uses Cisco Discovery Protocol or Link Layer Discovery Protocol to map out the layer-2 topology of devices in your network, including how they are connected to each other.

In the timeline (picture below), we see new metrics such as throughput, discards, and errors over time. We can get these aggregated for all devices, or select one device at a time. Same goes for the interfaces, we can get aggregated or individual data.

Another interesting view is the Device table view, showing all monitored devices and status of their interfaces along with the measured metrics such as availability, throughput, discards, and errors.

The next tab in the table is the Interfaces view, where interfaces are listed along with their names, IP addresses, speed, VLAN and the new metrics such as throughput, discards and errors.

Last but not least, the Diagram view displays all ingress and egress interfaces on the selected device. In this view, we can easily see which interfaces are having a high throughput (e.g. the one flagged in red in the picture below), and hence more prone to packet loss.

ThousandEyes Device Layer uses SNMP to gather data from devices, so it needs to be enabled on all the network elements that you wish to monitor. The ThousandEyes Enterprise Agents act as an SNMP poller, so you need at least one agent installed in the monitored network segment (i.e. subnet) to have the Device Layer working as expected. Once the Enterprise Agent has collected all the information, it uploads it to the ThousandEyes SaaS platform so you can enjoy the data visualization from your browser. Easy.

ThousandEyes Device Layer supports SNMPv2 and SNMPv3, so depending on the choice, you might need a community string or a username/key pair to allow the access to your network devices. Network devices can be discovered providing their IP address or an IP address range.

In the next picture, we can see the Device list, with the blue button to add a new device. Once discovered, it will show up in the list, ready to be polled via SNMP. For more details on how the Device Discovery works, please see this article from the ThousandEyes documentation.

Device Layer allows configuring Alerts based on the newly available metrics introduced with this feature. Creating an Alert rule is no different than with other alerts in ThousandEyes, hence pretty easy. Below we can see the Alert builder, it’s just enough adding the logic and the appropriate thresholds.

RouterFreak’s Verdict

Understanding user experience is becoming critically important to the success of all businesses. ThousandEyes is one of the top players in the field when it comes to application monitoring (layer-7), allowing to correlate data from the IP network plumbing (layer-3) and now also from the underlying data link layer (layer-2).

Years ago, determining the cause of network issues was much easier. Every company had its own monitoring dashboard based on ping, traceroute and similar internal tools designed ad-hoc to work in a well-known and controlled environment. Nowadays, the concept of an outage is much broader, which in case of applications, involves at least three network segments: the local LAN, the public Internet, and the cloud/application provider network.

We live in the Apps & Cloud economy. It is something that we cannot escape. By mapping from end to end, the ThousandEyes platform is able to identify historic and real-time issues, providing a view from bird-eye to a magnifying-glass-level of details.

Having appreciated the ThousandEyes product before, we are glad to see the introduction of Device Layer. As they say in the dark and noisy rooms of any data center, more visibility on the network is never a bad thing. The more the better, that’s for sure.

What we really liked about ThousandEyes Device Layer feature is its ability to give a view of the devices reaching the interface level. Looking at the IP traffic, often we see packet loss on a specific node, but we never know if the loss is due to the device being down, slow, or with interfaces maxed out.

What we missed was the ability to share the Device Layer data. ThousandEyes is well known for its sharing capability. Not sure why the ‘share’ button is missing in the Device Layer view. Maybe it’s something still under development. It would be definitely nice to have to facilitate the sharing of data among collaborators.

Conclusions

We reviewed the new Device Layer feature recently introduced by ThousandEyes. As usual, we were pretty impressed by the increased visibility this platform is allowing, getting better every time we try it.

A great resource to get additional information about Device Layer is this video introduction, which in a few minutes will give a great view of what is available with this new feature:

Even better, you should try ThousandEyes Device Layer on your network, so here is the Free Trial signup page, where you can get access to all the features for 14 days.

Have fun, until next time!