Network change is constant. NetBrain has two mechanisms in place to catch changes and ensure network intelligence is accurate and up-to-date:

• Scheduled re-discovery will automatically detect newly added or removed devices.
• Recurring benchmark will collect and analyze in-depth network data such as configuration files, routing tables, CAM tables and any CLI-command output to profile changes in network topology and design.

Under certain scenarios, users may have to work on a network that doesn’t exist yet (during the network design phase), or that they have no direct access to (e.g. a clients’ network for a consultant). NetBrain can model a virtual network and provide a map-driven work environment by:

• Importing a set of configuration files of routers, switches and firewalls from most mainstream hardware vendors
• Importing specific CLI-Command output to enhance the network model by adding L2 and Traffic Flow details

To analyze what-if scenarios, users may create a separate local workspace for each virtual network.

Networks are constantly undergoing change. Maintaining documentation that accurately reflects those changes is a constant challenge.

Dynamic Network Maps always accurately reflect the latest state of the network. Recurring benchmarks (discussed in Section 1.2) can be scheduled to run automatically so that the network model that drives each map is always up-to-date.

When a diagram is critical to the troubleshooting process, having confidence in the accuracy of the diagram is essential.

When the network is in trouble, the first thing you need is a diagram of the problem area. But that diagram may not exist or may be out of date.

With dynamic mapping technology, you can simply enter the name of the problem device in the search dialog, and then click the “map” button to create a fully-annotated diagram of the problem area.

You may index the network with a variety of different search strings:

• IP addresses
• Interface names
• Text strings in a config file (e.g. “eigrp 100”)
• Network object model (e.g. “Cisco 5505”)

Most network problems are related to connectivity between point A and B. But mapping out the A/B path is a labor-intensive manual task and users have to do again and again.

With dynamic maps, mapping a traffic path is as simple as entering two endpoints (via IP or hostname) and an L3 and L2 map of the traffic flow is automatically created.

Refer to section 5.1 for more details about NetBrain’s path analysis capability.

For troubleshooting or network inventory, users may need a map of a subnet or VLAN. With NetBrain, a dynamic map for this purpose can be created instantly by entering the subnet IP address (e.g. 192.168.1.0/24) or selecting a VLAN name from a switch’s neighbor dialog.

A complex data center may include thousands of network devices. Building a comprehensive inventory report and network map can be a daunting task.

You can use NetBrain to automate this task:

• Execute a discovery of the entire network or just the data center of interest
• Map all devices that belong to one site or data center automatically (multiple maps may be created)

All network devices (routers, switches, firewalls and end systems) are included.

For networks with thousands of routers, switches and firewalls, you can use a data-driven “site” to organize and map the network. For example, you can:

• Map an entire network showcasing the hierarchical relationships between all sites
• Map WAN connectivity with sites and border routers
• Map traffic paths using sites to better understand the flow

You can define sites by a set of search criteria, or by defining the border links. When your network changes, all sites established will dynamically adapt.

To visualize how traffic is routed towards a destination, users can simply type the destination IP into NetBrain’s routing table toolkit, and drag and drop the matched routing table entry into a map.

The routing table information is retrieved from either the live network, or from using historical data captured by the benchmark engine. As a result, users can visually discover the difference between live and historical routing tables.

Devices with common attributes can be grouped together to form a device group. Common attributes include:

• Characters in the hostname (e.g. all Tokyo POP routers have a hostname starting with tok-)
• Configuration file patterns
• Vendor/Models
• O.S. Versions
• SNMP parameters, etc.

Similarly, users can group links together based on common attributes of the LAN/WAN links and create dynamic maps.

Dynamic maps of device groups/link groups may include user-defined variables. This is a powerful way for large organizations to reduce the amount of pre-defined maps. For example, create a set of OSPF maps – one for each area; you can create a single dynamic map with a variable “area_number”. Users will define the value of this variable right before they need an actual map. At that time, NetBrain will calculate map elements and create the final map.

Users can use many fields to define the search criteria of a link group/device group, to define a map (e.g. vendor model number, O.S version, routing protocol, VRF, etc.

Sometimes the logic required to troubleshoot network issues is simple, but trying to identify the problematic device one at a time can be difficult. This procedure will check every device in the map and report if there are any increasing interface errors.

Logic: Retrieve ‘show interfaces’ command twice and calculate the delta of each parameter. If delta is greater than 0, report error and highlight it on the map.

Compliance audits generally take a lot of time, especially on large networks with tens of thousands of lines of configuration. This compliance procedure will check whether the device password encryption service is enabled for every specified device

Logic: Search no service password-encryption command in the configuration file of every specified device.

Often times, an important troubleshooting step is to determine what changes have occurred in the network. This procedure will automatically detect if EIGRP neighbors have changed since a specified baseline date.

Logic:

• Determine if EIGRP is configured on each device
• Parse EIGRP parameters and compare with historical data
• Highlight changes in the map

Multicasting is notoriously difficult to visualize because it is dynamic in nature. Due to its complexity, many organizations have only one or two individuals who are capable of troubleshooting multicast problems. A multicasting specialist can build a procedure once for anyone to use.

Logic: Leverage the following commands to map the downstream source tree:

• show ip mroute group
• show ip pim neighbor
• show ip igmp group

NetBrain comes with hundreds of built-in procedures but there are virtually unlimited uses for network automation. You can create your own procedures with a simple ‘sample-driven’ platform. There are three components:

Logic:

• Probes – Define how to retrieve live data from the network
• Parsers – Define how to parse CLI output
• Triggers – Define how to analyze the results and provide user feedback

Most user-written scripts work on a certain set of devices and cannot be applied to any other part of the network. Automation Procedures are executable files that can be run on any part of the network, and can be customized to work for any device with a CLI. Domain experts can write their own procedures and share them with the entire team for use anywhere.

In real-time troubleshooting, users need to know how traffic moves across the live network. Live traffic path analysis retrieves live routing tables, configuration files, and CAM/ARP tables to map both L3 and L2 traffic flow.

The network design behind traffic paths is also decoded, including:

• ACL, QOS, NAT
• Dynamic Routing, Static Routing and PBR
• VRF, Multicasting
• Switch port speed and duplex setting along the path

A key question to answer when analyzing a traffic path is "what was the path like before?"

Leveraging benchmark data, users can map L3 and L2 traffic paths using cached data.

By overlaying two paths in single map (one for the live and one for the historical path) users can visualize the changes in traffic flow.

With Automation Procedures, NetBrain’s traffic path mapping capabilities become much more versatile. Traditionally, mapping across devices like firewalls and load balancers has been a difficult task making network visualization difficult. Procedures allow for the customization of mapping through such devices. See Section 3 to learn more about Automation Procedures.

Besides analyzing point-to-point traffic flow (A to B), NetBrain can leverage NetFlow configured in Cisco devices to provide a view of multiple point-to-point conversations off a LAN/WAN link.

The conversation can be sorted by IP address, port and bandwidth utilization. The conversation pair can be mapped out in real-time as well.

If NetFlow is not supported, NetBrain can leverage IP Accounting technology to provide similar analysis.

Users can automatically create various types of network documentation, including:

• Network diagrams in Visio
• Design documents in Word
• Inventory reports in Excel

When the live network changes, NetBrain’s benchmark engine will capture those changes and automatically update the backend data model. Users can then automatically update the exported documents.

Dynamic Qmaps are created inside NetBrain through automation. From time to time, users may need static Visio diagrams for collaboration purposes. NetBrain provides a one-click export feature to export any Qmap to a fully-editable Visio diagram.

Conversely, NetBrain can convert a static Visio diagram into a dynamic Qmap, so that users can benefit from map-driven troubleshooting and design features.

You can automate the creation of network design or network assessment documents using a template-driven approach. First, users will create a dynamic map to define the area of the network to be documented; then select from a set of content templates outlining what to include in the final document. NetBrain’s document engine will create the final Word document and format it based on the selected style.

The content is highly customizable, leveraging the richness of the NetBrain model and a user-extendable design reader technology. For example, users can create documentation for:

• Assessment of specific network configuration, such as QoS configuration, VoIP configuration, Routing, etc.
• Network design review
• Troubleshooting escalation

Leveraging NetBrain’s discovery engine, the asset reports produced hold the industry’s most comprehensive network inventory data. Asset reports are exportable to Excel, where data can be further analyzed.

Users can extend built-in data fields and import values to new fields using the hostname as the key.

Network change is constant. NetBrain’s benchmark engine will automatically update the backend data model to reflect those changes. The same can be done for Qmaps and Visio diagrams saved on local disks. Users can schedule the update of selected maps daily, weekly or monthly.

As a result, users do not need to manually update network diagrams after network changes occur.

Visual network monitoring is different from traditional network monitoring:

• It uses a dynamic map as the launching pad to start and stop monitoring
• Real-time data collected from the live network is displayed in the map, along with alarms

Visual network monitoring can poll many types of data such as up/down status, link error, link delay, packet drop, etc. The interval and alarm thresholds are configurable.

The benefit of visual network monitoring is that users can quickly spot connectivity or performance issues – right from the map.

Once a dynamic map is created around a problem area, discovering “what’s changed” is relatively simple with the batch comparison toolkit.

The batch comparison toolkit will analyze configuration and routing changes between any two data sets (e.g. live and historical data) and list the differences in easy-to-drilldown tables.

Users can also analyze more sophisticated changes such as topology and traffic flow changes.

NetBrain’s revolutionary procedures can automate any series of actions normally completed manually using the CLI. With procedures, any troubleshooting logic can be translated into an executable file format for a repeatable and shareable process.

Hundreds of procedures exist ‘out of the box’ and countless others can be easily customized for virtually any network task. See Section 3 for more details about Automation Procedures.

The typical change management process includes a design review step. But without proper documentation of a proposed design, the design review process becomes a rubber stamp.

With NetBrain, engineers can use dynamic maps to document complex network design, making it:

• Easy to create - mostly by automation
• Visual – map-driven
• Portable – everything surrounding the map is self-contained

Users can start by dragging-and-dropping a set of configuration files into NetBrain to model the proposed network changes.

To understand the impact of network changes, users must record the network status before and after changes are made. Traditionally, this is achieved by manually collecting and analyzing the output from CLI commands for each relevant device.

NetBrain can completely automate this process. Not only is the collection of data automated, but analysis of the data is automated as well. This can save a tremendous amount of time and reduce human errors.

The process of executing network changes can be very labor-intensive and error-prone, especially when performed across a large set of devices. It is not uncommon to forget an interface, or ‘fat-finger’ a command.

NetBrain can significantly reduce this burden with automated push-config. Users can easily identify devices to be impacted, and then define changes using the built-in config template. To mitigate the risk of configuration errors, users can also specify a rollback template. After issuing the command to execute changes, users can watch the configuration happen live and stop or pause the progress if necessary.

Armed with benchmark data both before and after the configuration update, an in depth analysis of the changes can be performed automatically. This includes:

• Configuration changes at each and every device
• Routing table changes at each and every device
• Traffic path changes
• Topology changes in L2 and L3
• Changes in any CLI command output

By automating the change verification process, users can spend time correcting problems before outages hit end users.

NetBrain’s automated documentation platform can be leveraged to build customized documentation for the network change. This includes:

• Impacted devices
• List of configuration changes
• Review history
• A map of the changes

By automating the change verification, users can spend time correct the problem before outages hit the real users.

To access historical data managed by NetBrain, users can leverage its powerful search capability. The search result dialog will provide additional operations to further refine results.

With the easy-to-use search function, users can access configuration files, routing tables, CLI command output, etc.

Through NetBrain’s Design Reader technology, complex configuration files can be decoded by technology type and relevant portions of the configuration displayed in any map.

Users can also use Design Reader to evaluate historical configuration, simply by switching the source from “current” to a historical DataFolder.

NetBrain’s automatic data collection can be scheduled to run at user defined intervals, whether every day, week or month. Users also have the ability to further customize data collection, by selecting the exact types of data to be gathered.

Once data is collected, NetBrain will re-compute the backend data model and sync up with client workstations automatically, ensuring up-to-date knowledge.

NetBrain can automatically decode routing design such as BGP, OSPF, ISIS, EIGRP and RIP. From any dynamic map, NetBrain annotates the routing design by color coding links (for IGP protocol) or devices (for BGP protocol). Design Reader templates for each routing protocol allows users to drill-down to the details of each protocol from within a map. If needed, customers can customize templates to yield more relevant analysis.

NetBrain automatically decodes multicasting design such as PIM-DM, PIM-SM and PIM-SDM. The results are annotated in a related dynamic map.

For multicasting RPF analysis, NetBrain provides a toolkit called route propagation analysis, which will evaluate unicast routes towards the multicasting source and map the multicasting forwarding tree.

For any devices configured with MPLS VRF, NetBrain can annotate the VRF alignment in a relevant dynamic map. When retrieving route tables, NetBrain is VRF-aware as well.

For complex path calculation, NetBrain will take into account VRF design.

NetBrain understands VLAN design across LAN infrastructure and is capable of annotating VLAN design from any L2 dynamic map. To make it easier to understand, a L2 VLAN is denoted with a corresponding L3 network segment.

NetBrain can look into the live spanning-tree status and annotate any port that is blocked for each VLAN.

If a port is configured with voice VLAN, it can be highlighted so users can identify proper VoIP phone connections.

Design Reader is a template-based configuration file analyzer. There are over 100 built-in templates to analyze network design such as QoS, VoIP, Multicasting, Routing, ACL for routers, switches and firewalls. Design Reader includes built-in sample maps, which enables users to share best practices about certain technologies.

Users can author their own Design Reader templates through a simple scripting language.

Every Qmap is a self-contained knowledge resource containing much more than just a map. The built-in Map Data Pane contains all the relevant data relating to the map, all in one place. Data is clearly organized for easy sharing and portability. Types of embedded data include:

• Device configuration files
• Show-command data run against devices in the map
• Performance monitoring (e.g. utilization, delay, port up/down status, etc.)
• Attachment files to external resources

To highlight and easily reference key network data, directly on the map, users can easily create and append custom hyperlinks. Once a hyperlink exists on the map, a single click will open the data. Available hyperlinks include:

• Show-command data output
• Automation Procedures to be run on devices in the map
• Links to external reference material

Users can publish their static Visio maps and dynamic maps in a shared map center. The Map Center makes it easy to browse and search for desired maps.

For dynamic maps, users can schedule an automated update to keep everything accurate.

Network alert systems generate text-based alerts, which are difficult for human engineers to work on. Through NetBrain’s API and event system menu extension capability, users can create a dynamic map of each alert on-the-fly. This capability will greatly accelerate network troubleshooting.