Guide to Saving Money with Network Reporting Center

Guide to the Importance of Network Application Classification

Vineyard Networks Partner Case Study on ACSI

Vineyard Networks Case Study on the City of Doraly

Vineyard Networks Case Study on ECC

Vineyard Networks Case Study on Pushor Mitchell LLP

Videos coming soon...

Network Application Visibility Library (NAVL)

Frequently Asked Questions

1. How do you pronounce NAVL?

It’s easier than you think: NAVL [na-vuhl] not NAVL [ney-vuhl]

2. Is NAVL a regular expression based engine?

No it is not a regex based engine. NAVL leverages a number of classification techniques such as Deep Packet and Deep Flow Inspection, Behavioural Analysis, Pattern Matching, Future Flow Registration, Conversation Semantics, etc.

3. How many applications do you classify?

We concern ourselves less with the number of applications classified and focus more on the percentage of layer-7 traffic that we classify. Thus, baring the use of silly marketing numbers, we classify 600+ applications and 55,000+ sub-applications in a variety of categories: Instant Messaging, Peer2Peer, Social Networking, Enterprise, Web 2.0 and more. A list of applications is available upon request.

4. Is NAVL a user space library?

Yes.

5. How often do we update application signatures?

We update application signatures on an ongoing basis and release these updates to our partners on a monthly or quarterly basis.

6. How do we update signatures?

New signature plugins are added at runtime and therefore maintain state of the engine. Updated signature plugins are typically reloaded, which does not occur at runtime.

7. Can we create our own application signatures?

Custom rules can be defined by creating custom applications. Our custom application API allows you to create your own application definitions and extend the engine capabilities through using a select set of classification techniques that we provide to you. We configure the custom rules through API calls sent by you.

8. How does Vineyard determine which application signatures to write?

Our application set is determined by a number of factors - we analyze traffic traversing devices deployed globally, we respond to ad-hoc customer requests, we weigh in on the results produced by our application research team who identifies which applications are in high demand, and we rely on a close working relationship with global partners to determine which applications are in high demand for them.

9. Does Vineyard continue to track applications for updates and new releases?

Yes, all application signatures are tracked and upgraded once new versions are released.

10. Do all of the signatures have to be loaded?

No they do not. We provide an à la carte menu, so to speak, of application signature plugins from which to choose from, giving you the option to hand select the signatures plugins you’d like to add to the engine.

11. How is the engine integrated?

NAVL is delivered as a software library. The engine is delivered as a set of binaries. An API ingests data from you by way of a stream or packet based interface.

12. How does NAVL perform?

A single instance spread across 6-8 standard Intel processing cores scales to approximately 10Gbps.

13. How much memory is required to integrate the NAVL engine?

The memory footprint for the engine plus the full signature set is 4.5MB. An additional 1.5KB of memory per active flow is also required.

14. Does NAVL perform specific functions such as, allowing or blocking traffic once it’s been classified?

NAVL provides visibility into the traffic on your network but it does not function as a policy engine. It is up to you how you use the data that is provided to you once the traffic has been classified.

15. What information is provided once the traffic has been classified?

Classification results are returned as an application stack that can contain both application ID’s and application specific attributes. A protocol stack will look something like this: ETH/IP/TCP/HTTP/YouTube. The attributes associated provide the source and destination IP, source and destination port and content type.