Ellacoya beefs up deep packet inspection

Ellacoya is taking the next step in its product evolution, today announcing the e100, a scalable box that can support line-rate deep-packet inspection at rates up to 20 Gigabits per second, supporting up to 500,000 active subscribers and doing content inspection at 10 Gbps wire speeds.

DPI enables service providers to look at each packet traversing their networks in order to mitigate any threats and to intelligently implement policies that prevent some traffic, such as peer-to-peer communications and downloads, from overwhelming a network. Demand for the technology has grown as peer-to-peer applications, including Skype and BitTorrent, have taken off, and multimedia applications including video streaming have proliferated as well.

The new gear positions Ellacoya for where service providers are headed, said Mark Bieberich, director of Yankee Group’s Enabling Technologies Service Provider - Infrastructure Solutions practice.

“I think the next battleground for DPI is at higher levels of scale than what we’ve seen service providers deploy until now,” he said. “That means not just better Ethernet density but higher speed interfaces such as 10-Gig. It’s driven by a couple of key things—number one, service providers are using DPI platforms for more than just peer-to-peer traffic control. As they find more uses for DPI, the capacity requirements for platforms increase. And service providers are also faced with raw IP traffic growth that forces them to not only upgrade what they currently have but place DPI platforms in a more distributed fashion in the network.”

The e100 is designed to be deployable at the access aggregation layer, within the network at Layer 2 aggregation layers and within the IP core, to inspect traffic as it comes into a network from the Internet or other service providers, said Fred Sammartino, vice president of marketing and product management at Ellacoya. In addition to boosting size and capacity, Ellacoya also has added granular application detection capabilities to enable service providers to determine where a Web download is video, VoIP, online gaming or some other application.

The goal, Sammartino said, is to allow service providers to know how their networks are being used and to better plan network expansion and investment, as well as design new services aimed at higher revenue opportunities.

“In the access network, controls the amount of traffic that goes into your network, and allows you to implement policy,” to control things such as peer-to-peer traffic and to detect threats to the network, he said. At the edge of the IP core or peering point, a service provider “can do very intelligent control, track data to know what they should cache in order to limit international traffic,” he said. “For many overseas service providers, the dominant cost of their network is international connections, since the most-accessed Web sites are in the U.S. This can be an intelligent way to control those costs.”

In addition, Ellacoya is eyeing a new growth area, as wireless carriers also move more heavily into data services, he said. “We have built in features just for wireless carriers,” Sammartino said. “They use much smaller amounts of bandwidth but have many more users.”

Ellacoya competes with Sandvine, Cisco Systems and its P-cube acquisition and Allot Communications in DPI. Sandvine announced 10-gig capabilities earlier this year, and Cisco also has 10-Gigabit capabilities on its SCE-2020 Service Control Engine.

Ellacoya’s e100 is the first hardware-based 20Gbps broadband service optimization platform
, Sammartino said.

“There are software-based solutions that claim to be able to do DPI at 10Gig,” he said. “The advantage of a hardware solution is we can keep up with full line-rate 10G. The type of inspection we can do is much more complex. Many of the illegal peer to peer users can camouflage their packets to make it look like VoIP or HTTP. If you just kind of do a simple software- based solution, it would prioritize peer-to-peer traffic as VoIP, as opposed to in hardware, we can look deeper and determine it is peer-to-peer.”

A hardware-based solution also enables service providers to do multiple lookups on a single packet with very low latency, he said. That capability is important in handling traffic such as video streaming from a Web site.

“Service providers are getting ready for the video explosion,” said analyst Bieberich. “DPI today is still deployed primarily for peer-to-peer traffic control, prevention of security attacks, and intercarrier traffic monitoring and control. Thus far we haven’t seen a tremendous number of DPI deployments for video and multi-media traffic. We expect that type of traffic to become a more significant driver in the next two to three years.”

More useful resources from Telephony

Telephony's Network Security Webcast
Watch this Webcast to find out how you can prevent DDoS attacks, worms, botnets and other vicious infrastructure threats from crippling your operations. PLUS get access to the published service provider analysis --The Worldwide Infrastructure Security Report. Watch now.