Magic Quadrant for Network Performance Monitoring and Diagnostics

Published: 21 February 2017 ID: G00301193

Analyst(s):

 Sanjit Ganguli, Vivek Bhalla

Summary

NPMD solutions are key in helping I&O leaders support more complex technologies and services with network visibility, performance issue detection and root cause analysis. Vendors are innovating with cloud monitoring, support for software-defined environments and more flexible deployment models.

Market Definition/Description

This document was revised on 12 April 2017. The document you are viewing is the corrected version. For more information, see the Corrections page on gartner.com.

Network performance monitoring and diagnostics (NPMD) tools allow IT operations to understand the performance of application, network and infrastructure components via network instrumentation. These tools also provide insight into the quality of the end-user experience. The goal of NPMD products is not only to monitor the network traffic and infrastructure to facilitate outage and degradation resolution, but also to identify performance optimization opportunities. This is conducted via diagnostics, analytics and root cause analysis capabilities to complement monitoring of today's complex IT environments.

This market is a fast-growing segment of the larger network management space. Gartner estimates the size of the NPMD tool market at $1.6 billion and growing at a compound annual growth rate (CAGR) of 20.7%, according to Gartner's "Market Share Analysis: Performance Monitoring, Worldwide, 2015." The NPMD market overlaps slightly with aspects of the application performance monitoring (APM) space and, to a lesser extent, the IT infrastructure monitoring (ITIM) market.

This Magic Quadrant research period has seen continued reshuffling within the NPMD vendor space, with the completion of the leveraged buyout of SolarWinds by Silver Lake Partners and Thoma Bravo; the sale of InfoVista by Thoma Bravo to private equity firm Apax Partners; the spinoff of Streamcore from Automic; the acquisition of Aternity by Riverbed; and the pending spinoff/merger of HPE Software to U.K.-based software company Micro Focus.

Additionally, this year has seen innovation from network switch vendors, incorporating network analytics directly into their switch fabric through enhancements in switch chip technology. These vendors include Cisco, with its introduction of Tetration Analytics, but also Arista Networks, Brocade and Pluribus Networks. Additionally, NPMD vendors have slowly been waking up to the reality of the cloud, with a few vendors actively investing in filling the visibility gaps left by cloud migration.

Magic Quadrant

Figure 1. Magic Quadrant for Network Performance Monitoring and Diagnostics

Source: Gartner (February 2017)

Vendor Strengths and Cautions

AppNeta

Founded in 2011, Boston-based AppNeta focuses on APM; however, much of its intellectual property roots are based on NPMD technology. AppNeta is back in the NPMD Magic Quadrant this year. AppNeta is focused on easy-to-deploy, inexpensive SaaS-based solutions. The vendor is a re-entrant to the NPMD Magic Quadrant based on its decision to reverse its cessation of flow-based data source support that only lasted approximately 12 months, throughout most of 2015.

AppNeta's core NPMD features come from its AppView product (for synthetic application availability monitoring), enhanced with SaaS-specific monitoring for Amazon Web Services (AWS), Google Compute Engine, Microsoft Azure, Salesforce, ServiceNow, Office 365 and Google Docs, among others. FlowView provides traffic analysis including both deep packet inspection and flow analysis. The unique component of the offering is PathView, which provides deep path analysis along with patented capacity measurement based on AppNeta's TruPath technology, an automated diagnostics engine for fault isolation and root cause determination.

AppNeta has undergone realignment over the past 18 months (as its reinclusion in this Magic Quadrant suggests). In August 2015, a new CMO was hired, and in April 2016, an agreement was reached with SevOne to resell AppNeta's PathView technology. In September 2016, AppNeta's TraceView product, which monitors the application layer of web-based infrastructures, was sold to SolarWinds.

AppNeta's NPMD revenue is between $11 million and $25 million per year.

STRENGTHS

• A SaaS-focused model ensures lower operating costs.
• The vendor offers high scalability for distributed environments, with up to 7,000 sites supported per client.
• AppNeta has convenient unified communications (UC) and voice over IP (VoIP) monitoring without the overhead normally associated with UC monitoring tools.

CAUTIONS

• The vendor has no physical commercial presence beyond North America planned until the first quarter of 2018.
• The lack of 100G network support via physical monitoring point appliances is inhibiting AppNeta's ability to meet end-user requirements to fulfill future demands.
• Security and privacy perception issues related to SaaS products persist among risk-averse end users. This is a sales inhibitor when competing against traditional on-premises-based tools.

CA Technologies

Headquartered in New York City, CA Technologies has an extensive history and product set for NPMD that was built over many years of acquisitions and organic development. CA has recently hired a new chief product officer and a general manager of its Agile Operations business unit, both of whom are from Cisco, to oversee NPMD product development.

The CA Technologies' NPMD offering is the organically developed CA Performance Management solution (which includes Performance Center as its visualization element), and it is complemented by other offerings, including CA Unified Infrastructure Management (CA UIM), CA Virtual Network Assurance (CA VNA), CA Network Flow Analysis, CA Unified Communications Monitor, CA Application Delivery Analysis, CA Systems Performance for Infrastructure Managers (physical systems agents) and CA Virtual Assurance for Infrastructure Managers (virtual systems agents). CA VNA was released in December 2015, and provides visibility into performance bottlenecks and vulnerabilities in software-defined networking (SDN) and network function virtualization (NFV) environments.

CA Performance Management forms the basis for the vendor's new network portfolio architecture strategy, which is a departure from its previous strategy of leveraging CA UIM as its consolidation platform. According to the vendor, this decision was driven by changing market conditions and customer feedback. CA UIM is being repositioned as the solution for hybrid cloud, systems and storage monitoring, while CA Performance Management is targeted at network monitoring, despite some overlapping capabilities.

CA's NPMD revenue is between $100 million and $250 million per year.

STRENGTHS

• Positive financial viability continues to show that there is limited risk to stability in doing business with CA.
• Investments in monitoring cloud-based environments have outpaced other NPMD vendors.
• Strong geographic diversity in the customer base proves the vendor's ability to support clients globally.

CAUTIONS

• CA's NPMD solution is an amalgamation of various product lines from several acquisitions with limited integration, which introduces some complexity in UI and workflows.
• Emergence of CA Performance Management as the vendor's NPMD solution has caused confusion as it conflicts with its previous CA UIM strategy, with uncertainty among end users regarding future development plans for either product.
• There has been limited development of flow and packet analysis capabilities, with CA Network Flow Analysis and CA Application Delivery Analysis receiving little in the way of new features.

Cisco

San Jose-based Cisco, with its network-hardware-centric heritage, enjoys broad name recognition in the NPMD space. The vendor has enhanced its offerings with the introduction of a scalable data center visibility solution, policy-based automation and simplified product bundling options.

Cisco's NPMD solutions remain spread across multiple product lines. Its primary NPMD offering remains Prime Infrastructure, and it is used for SNMP and flow monitoring, configuration management, and provisioning of Cisco network devices. This is supplemented with Prime Network Analysis Module for packet analysis, and Prime Collaboration Assurance for UC monitoring. Cisco Nexus Data Broker provides network packet broker (NPB) functionality.

Cisco's latest offering is Tetration Analytics, a hardware and software agent-based network analytics platform that leverages onboard switch-chip-based network analytics on its latest Nexus switches to provide scalable data center visibility. Finally, Cisco offers Application Policy Infrastructure Controller Enterprise Module (APIC-EM), its policy-based SDN controller providing path analytics along with workflow automation capabilities.

The vendor has announced its Cisco One Foundation licensing in WAN, access and data center variants that bundle various NPMD products into the broader hardware sale motion. This aims to simplify the pricing and licensing options for its NPMD products, as well as accelerate the sales of its software products.

Cisco's NPMD revenue is between $51 million and $100 million per year.

STRENGTHS

• Cisco provides a unique vision for highly scalable network analytics integrated into network hardware with Tetration Analytics.
• Cisco is in an exclusive position to support its pervasive networking installed base, offering in-depth support for Cisco monitoring technologies.
• New bundling of products allows broader availability of NPMD solutions to the vendor's customers.

CAUTIONS

• While innovative, Tetration Analytics currently lacks broad market appeal, given its premium pricing, strict deployment prerequisites, and burdensome hardware and agent requirements.
• Gartner continues to observe that Cisco Prime Infrastructure is mostly used as a point solution, often requiring buyers to purchase other management tools for comprehensive performance monitoring.
• End users have cited dissatisfaction with Cisco Prime Infrastructure's product reliability, as well as its integration and interoperability with third-party solutions.

Corvil

Founded in 2000, Dublin-based Corvil focuses on short-time scale network monitoring, providing comprehensive multisegment and highly accurate packet analysis. These capabilities have always appealed to the vendor's financial services customer base's heritage; however, Corvil continues its transition — based on its streaming analytics platform — to deliver machine-time data visibility (see Note) and operational intelligence to a broader target audience.

Product development progressed, with an 80 Gbps 8400 appliance released in July 2016. The August 2016 Tera+ Release delivered adaptive contextual enrichment to raw packet data based on preloaded rules and conditions. This was coupled with autodiscovery and population of application metrics to an updated user interface that includes greater drag-and-drop and workflow aids than its predecessor. In September 2016, Corvil's VoIP App for Splunk was released as a free download via Splunkbase.

Aside from product development, a new chief business development officer was hired in October 2015 to focus on growing strategic partnerships and develop Corvil's channel partner program. Early results are the addition of Japanese channel partner IWI and global service company WWT. Gartner has also observed customers being added to the installed base in new regions such as Mexico, Colombia and Brazil.

Corvil's NPMD revenue is between $26 million and $50 million per year.

STRENGTHS

• Corvil enjoys healthy sales performance and growth, with total revenue growing by 40% year over year.
• The machine-time data analytics concept aligns well to end users with Internet of Things (IoT) initiatives.
• Corvil's licensing model continues to cause pricing disruption in the market space, with a separation of software pricing from the underlying hardware.

CAUTIONS

• Corvil lacks virtual and cloud visibility for those customers that are migrating critical services into virtual environments.
• Conservative organizations may view Corvil's size, compared to larger vendors in this market, as a perceived risk due to increased exposure to potential acquisition or market volatility.
• SNMP and flow-based data source support remain comparatively weak.

ExtraHop

With global headquarters in Seattle, ExtraHop is new to the NPMD Magic Quadrant this year, and focuses on packet analytics for performance and application insights. Over the last year, ExtraHop has doubled its head count and made several key additions to the senior leadership team. This included a new CEO, who previously served as the president of Fluke Networks. This year has also seen the departure of ExtraHop's senior VP of sales and the senior VP of marketing and business development.

The vendor's solution consists of ExtraHop Discover Appliance, which provides real-time analysis on network data; ExtraHop Explore Appliance, which provides indexing and storage of transaction records; ExtraHop Trace Appliance, which provides continuous packet capture; and ExtraHop Command Appliance, which provides centralized management. To achieve end-to-end workflows that are common to NPMD, a combination of the Discover, Explore and Trace Appliances must be deployed.

ExtraHop's recent focus has been on expanding supported data streams, which now include NetFlow and continuous packet capture. ExtraHop has combined these new data streams into end-to-end troubleshooting workflows, although there is limited customer feedback on this, given the recent release of these new features. The vendor's solutions also have integration with various IT operations management (ITOM) tool vendors, and it promotes its solutions as part of an ecosystem of other best-of-breed products. ExtraHop has also invested in looking beyond the data center, investing in cloud, IoT and virtual network monitoring.

ExtraHop's NPMD revenue is between $50 million and $100 million per year.

STRENGTHS

• ExtraHop provides network-derived business intelligence data, allowing IT operations users to move closer to the lines of business, with strong application visibility.
• ExtraHop was an early pioneer among NPMD vendors to offer a monitoring solution for infrastructure as a service (IaaS) environments like AWS and Azure.
• The vendor is aggressively investing in marketing and expanding sales operations beyond its current North American base, primarily in the Asia/Pacific region.

CAUTIONS

• ExtraHop's products often appeal to buyers as a complementary solution to NPMD, as opposed to a core NPMD offering.
• The vendor provides a limited view of infrastructure health, compared to its NPMD competition.
• ExtraHop's ability to derive and use application context from network data should not be confused with full application performance monitoring (APM) capabilities.

Flowmon Networks

Flowmon Networks, based in the Czech Republic, specializes in scalable flow-based monitoring to meet NPMD and network behavior analysis (NBA) disciplines. The vendor has been 100% self-funded, and has grown through sales of its NPMD and NBA products. While flow-based monitoring is the focus, packet capture (via Flowmon Traffic Recorder) and the Flowmon Application Performance Monitor component also contribute to Flowmon's NPMD capabilities.

The vendor augmented its existing agentless monitoring capabilities for HTTP and HTTPS traffic with the acquisition of FerretApps in March 2016. New integrations with network tap manufacturer Garland Technology in June and IBM's QRadar in October broadened its technology partnership program.

Flowmon Networks' plans to expand to new geographies have also seen new value-added reseller (VAR) partnerships struck in June 2016, with Ingecom to cover Portugal and Spain, and Gintel to support Latin America, the Caribbean and Florida. Concurrently, a new business development manager was appointed for the U.K. and Ireland region. Product development has continued with a new version of Flowmon released in May 2016, providing profiling of flow data with 30-second granularity to help reduce reaction times to service-affecting incidents. Triggered packet capture and a mobile app for iOS and Android devices were also among the new features included.

Flowmon Networks' NPMD revenue is between $7.5 million and $10 million per year.

STRENGTHS

• There is an aggressive product roadmap, with flow generation from PCAP, extended visibility into application layer protocols and OpenStack virtualization support all anticipated before the fourth quarter of 2017.
• Flowmon Networks is competitively priced, with cloud and virtual appliance options that would appeal to smaller and midsize organizations with flow-based monitoring requirements.
• Flowmon Networks is highly scalable, with the ability to support 100G environments and 250,000 flows per second per appliance.

CAUTIONS

• North American, Latin American and Asia/Pacific region end users should ensure that local resources are adequate for their needs.
• Despite continual improvements, the user interface remains below par compared to leading NPMD vendors, based on Gartner's analysis.
• Security operations features and capabilities dilute the focus of Flowmon's R&D on purely NPMD use cases and scenarios.

Genie Networks

Genie Networks targets its solutions to the communications service provider (CSP) industry. Based in Taiwan, the vendor's strategy is to provide scalable, yet competitively priced, solutions.

Building from a competency in traditional SNMP-based network fault and performance monitoring capabilities, Genie Networks also incorporates deep packet inspection and flow analysis into its current offerings, GenieATM 6300 and GenieATM VM Software Version. The vendor states that a single instance of the product supports up to 110,000 flows per second, and up to 100 routers and/or switches. It also provides combined traffic analysis with policy configuration for SDN environments.

Throughout 2016, Genie Networks has increasingly been positioned and deployed to address security operations use cases and scenarios, primarily distributed denial of service (DDoS) attack mitigation and protection. The vendor has also gained traction beyond its traditional China installed base, with new customers being won throughout 2016 in Japan, Saudi Arabia and, most significantly, the Netherlands.

Genie Networks did not respond to requests for supplemental information and/or to review the draft contents of this document. Gartner's analysis for this vendor is therefore based on other credible sources, including previous vendor briefings and interactions, the vendor's own marketing collateral, public information, and discussions with end users.

Genie Networks' NPMD revenue is between $11 million and $20 million per year.

STRENGTHS

• Genie Networks has an improved presence in and focus toward EMEA.
• The vendor offers attractive pricing, balanced with an aim to deliver carrier-grade scalability.
• Appliance and virtual machine (VM)-based options offer customers multiple form factors.

CAUTIONS

• The vendor's profile remains low, particularly from a marketing perspective, which limits lead generation opportunities.
• Positioning and messaging have shifted almost exclusively to security operations use cases and scenarios.
• Genie Networks' focus on IT and network operations product features appears to have stagnated in favor of security operations functionality.

HPE

One of the first vendors to offer enterprise network monitoring tools, Hewlett Packard Enterprise (HPE; spun off from HP Inc. in November 2015) has a long history of investment in the NPMD market. Based in Palo Alto, California, HPE has a substantial portfolio and customer base, with thousands of installations worldwide.

HPE's NPMD solution is composed of Network Node Manager i (NNMi) and HPE Real User Monitoring (RUM). NNMi provides a consolidated view of fault and performance data, while RUM monitors actual user interaction with a website or application from client desktops and mobile devices.

In September 2016, HPE announced a spin-off/merger of its software business with U.K. firm Micro Focus as part of an $8.8 billion deal. This came off the back of previous restructuring following the split of HPE from HP Inc. End users report that implementation, training and professional services account for a greater proportion of total HPE NPMD deployment costs than observed by Gartner for other vendors.

HPE's latest releases in July 2016 included updated support for Cisco Unified Communications Manager (UCM), Common Criteria and FIPS140-2 encryption compliance, an Elastic Docker monitor, and a new HTML5-based application health dashboard. Among other features, VXLAN support and a number of OpenStack integrations and plug-ins are planned for 2017.

HPE's NPMD revenue is between $101 million and $250 million per year.

STRENGTHS

• HPE has a broad portfolio of complementary availability and performance monitoring products, with integration with products such as HPE Network Automation.
• HPE's product roadmap cites the utilization of operations analytics. Execution against this roadmap will be key.
• HPE Professional Services has a global presence, with a strong reputation for implementing and maintaining its clients' solutions. (Note that HPE has announced the sale of its Enterprise Services segment to CSC, expected to close in April 2017.)

CAUTIONS

• With ongoing organizational changes, customers continue to express concern over HPE's direction and vision in the NPMD space.
• Execution against the roadmap is questionable, given that aims of monitoring converged infrastructure, SDN and NFV frameworks have been deprioritized compared to previous plans.
• Current messaging and product positioning fail to resonate with midmarket organizations.

InfoVista

With worldwide headquarters in France, InfoVista is a CSP and large-enterprise-focused NPMD provider, and is owned by private equity firm Apax Partners. InfoVista's offerings span NPMD, wireless network design and planning, and mobile network optimization.

Product offerings focused on NPMD include VistaInsight for Networks, which includes the Vista360 UI for visualization across the interrelated components of the suite. Those components are 5View Service Data Manager for data aggregation and analysis of the raw metric data, which feeds up to VistaInsight for Networks; 5View NetFlow appliances for flow collection; and 5View Applications appliances, which provide deep packet inspection capabilities. The final module is 5View Mediation, which collects data from appliances doing packet and flow analysis for long-term, analytical reporting purposes.

In March 2016, 5View Applications added new support for discovery of cloud and SSL-based applications, and VXLAN, among other features. InfoVista then experienced a change of ownership as Thoma Bravo sold the company to Apax Partners in May 2016. In October 2016, InfoVista acquired Ascom's mobile operator-oriented testing and optimization TEMS business. In November 2016, InfoVista launched IpanemaGO, a cloud-based SD-WAN solution. Although the solution is adjacent to NPMD itself, this will lower barriers of adoption for enterprises looking to SD-WAN as a means to improve and protect the performance of applications on a per-session and per-user basis. 40G and 100G support is cited by 3Q17.

InfoVista has also overhauled its Global Channel Program, focusing it around the delivery of its new SD-WAN solution, including a partnership with ZTEsoft for the China region. Relationships with Ipanema-acquired channel partners Orange Business Services and BT have also been developed further, with a "sell to, sell through" strategy having been developed with both organizations.

InfoVista's NPMD revenue is between $26 million and $50 million per year.

STRENGTHS

• End users recognize InfoVista's strong product roadmap and vision.
• VistaInsight and the 5View suite are multitenant, carrier-grade solutions optimized to meet the specific requirements of CSPs.
• Extensibility of the InfoVista solution allows it to meet sophisticated use cases that many other vendors cannot meet.

CAUTIONS

• 2016 SDN and NFV API-related features have been deferred until mid-2017.
• End users continue to report higher-than-average implementation and maintenance costs.
• Extended service engagements are common to meet specific requirements of target service provider customers.

Ipswitch

Ipswitch, based in Lexington, Massachusetts, has been in the infrastructure monitoring arena since 1991 and makes its debut in the NPMD Magic Quadrant. Ipswitch supports a large client base with its product WhatsUp Gold, which is offered as BasicView, ProView, TotalView or TotalView Plus, reflecting different assortments of modules. These modules include Wireless Monitoring, Virtual Monitoring, Application Monitoring, Network Traffic Analysis and Configuration Management.

The product provides a simple and easy-to-use networking monitoring solution, combining both SNMP-based infrastructure health and availability monitoring with import of flow records. Packet data is handled via a packet to flow converter agent called Flow Publisher. Ipswitch's plans for WhatsUp Gold include support for monitoring cloud IaaS environments and increased support for storage and wireless LAN infrastructures.

Ipswitch sells in North America predominantly through direct sales, and through partners in other regions. It has recently opened a center of excellence in Ireland to lead expansion in EMEA. Expansion plans include additional partnerships with system integrators, as well as managed service providers (MSPs) that use WhatsUp Gold to provide IT monitoring services to their end customers. Notable MSPs using Ipswitch include Dimension Data, Cable & Wireless Communications and NTT Communications.

Ipswitch's NPMD revenue is between $26 million and $50 million per year.

STRENGTHS

• Ipswitch offers a low-cost and easy-to-license NPMD solution.
• The vendor's low-friction sales model, with a "try and buy" option, has shown success in growing its customer base, focused on SMBs.
• Network topology visualization is intuitive and easily navigable, with a useful path tracing capability.

CAUTIONS

• There is limited packet support, application visibility and drill-downs for troubleshooting.
• Scalability and granularity of data is below the level of leading NPMD solutions.
• Despite its many years in the market, Ipswitch suffers from less market awareness when compared to similar NPMD vendors.

LiveAction

LiveAction is a privately owned company founded in 2007, based in Palo Alto, California, and is new to the NPMD Magic Quadrant this year. Its LiveNX product is focused on visibility and analytics to help simplify network management. LiveUX is a complementary product to LiveNX, delivering end-user experience monitoring. For non-Cisco environments, LiveAction uses its nProbe component for packet inspection and performance metrics collection.

The vendor's product development cadence has been healthy for the past 18 months. March 2015 brought a new virtual appliance option, while reporting features to aid capacity planning tasks were also added. In November 2015, a new HTML5-based interface was launched. Support was expanded to Cisco's Nexus 9000 series routers and QoS configuration support was provided for Cisco Catalyst 3850 and 4500 devices. A free SaaS version of LiveUX, monitoring availability and performance of web-based applications, was also made available during the same month. In June 2016, SD-WAN visibility was delivered. Path changes are compared to preconfigured thresholds and validated against policies to ensure that application performance over SD-WAN is maintained. Support for private and public cloud, including AWS, Azure, Apache CloudStack and Rackspace, was also added in June 2016. Further site-to-site analysis to aid capacity and resource planning was added in October 2016.

LiveAction raised $36 million in Series B funding in March 2016 to expand operations globally and accelerate product development. Cisco Investments was one of the funding partners. LiveAction shares a close relationship with Cisco as a SolutionsPlus partner, with the networking vendor including LiveNX on its global price list. Under this agreement, Cisco resells LiveNX and provides training to end customers and partners, while also aiding marketing efforts. A reseller agreement also is in place with Japan-based network configuration and change management (NCCM) vendor LogicVein, which is the primary route to market for this region. The overall primary route to market for LiveAction is through channel sales.

LiveAction's NPMD revenue is between $11 million and $25 million per year.

STRENGTHS

• LiveAction customers report high satisfaction in terms of value, service and support offered.
• The vendor has had strong growth over the last two years with a significant ramp-up of customers and the total installed base, partially driven by Cisco channel sales.
• Unique SD-WAN traffic steering capabilities are coupled with overlay views of flows and control plane data to deliver compelling visualization of network topologies, aiding troubleshooting and problem diagnosis.

CAUTIONS

• LiveAction's in-house resources are almost exclusively focused on the North American region. Customers from other regions should ensure the reseller resources made available are adequate and sufficiently skilled to provide ongoing support.
• Heavy focus toward supporting Cisco infrastructure may inhibit opportunities where there is a requirement to manage a more heterogeneous environment.
• LiveNX is an on-premises-focused product and lacks a cloud-hosted deployment option.

NetScout

NetScout, based in Westford, Massachusetts, has the largest market share in the NPMD space, and boasts a large and loyal customer base. NetScout's customers span the large enterprise, service provider and public-sector industry verticals. In 2015, NetScout acquired parts of NPMD vendor Fluke Networks, along with several other assets, including Tektronix Communications and VSS Monitoring.

NetScout's NPMD solution consists of nGeniusONE platform, Infinistream platform and UC Performance Management. These solutions are sold alongside various analysis modules, which can include NPBs or security analytics. NetScout continues to list Fluke Networks' assets as products, including OptiView XG (handheld network diagnostics), AirMagnet (wireless LAN planning and monitoring) and TruView. NetScout has announced that it is relaunching Fluke's TruView Live as nGeniusPULSE, for synthetic-based monitoring of cloud environments.

NetScout has announced plans to invest in a dual strategy to introduce next-generation instrumentation coupled with superior analytics. As part of this strategy, the vendor introduced InfiniStreamNG, with support for 40G and 100G line rates, and offers a real-time analytics platform to take advantage of the packet data it is collecting. NetScout also announced the release of nGenius for Flows, which brings its flow monitoring capability closer in line with competitors.

NetScout did not respond to requests for supplemental information and/or engage in Gartner's standard procedures to address the contents of this document. Gartner's analysis for this vendor is therefore based on other credible sources, including previous vendor briefings and interactions, the vendor's own marketing collateral, public information, and discussions with end users that either have evaluated or deployed each NPMD product. NetScout has sued Gartner over the content of the 2014 NPMD Magic Quadrant, and that lawsuit is pending.

NetScout's NPMD revenue is between $500 million and $750 million per year. This reflects combined revenue from NetScout and the acquired Danaher assets, including parts of Fluke Networks, VSS Monitoring and Tektronix Communications.

STRENGTHS

• NetScout's plans to develop nGeniusPULSE are an important initiative to fill network visibility gaps left by cloud migrations.
• NetScout's AirMagnet is a strong offering for the growing need for wireless LAN network monitoring and troubleshooting.
• NetScout's outward marketing has improved, with an overhaul of its website and an improved presence on social media.

CAUTIONS

• Gartner has observed end-user confusion (through client inquiries and one-on-one meetings at Gartner events) regarding NetScout's future plans for the Fluke Visual TruView product line.
• Cost-conscious NPMD buyers should be aware that NetScout continues to be described as a premium-priced solution by end users that interact with Gartner (for example, in client inquiries and one-on-one meetings at Gartner events).
• NetScout's ability to derive and use application context from network data should not be confused with APM capabilities.

Paessler

Based in Nuremberg, Germany, Paessler focuses on infrastructure monitoring software to meet the needs of the midmarket and SMBs through its unified PRTG Network Monitor offering. The solution covers monitoring of network elements for fault, flow analysis and packet sniffing in a single, simple solution. Additionally, the product supports health monitoring of application instances, servers and virtual environments.

The vendor continues to prioritize simplified ease of use and transparent licensing. Paessler continues to release a steady stream of new sensors at a regular cadence. In December 2015, cloud sensors were made available to monitor Google Analytics, Google Drive, Microsoft OneDrive and Dropbox. January 2016 witnessed the delivery of a Business Process Sensor that allows users to monitor the health of end-to-end business processes (or services) such as websites, email and other business functions. A sensor to monitor Docker containers was made available in March 2016.

Aside from product development, Paessler has expanded its presence outside of its home EMEA geography. In August 2015, it revamped its partner program and this is starting to pay dividends, with the vendor reporting an increase of 36% channel sales worldwide and the U.S. being the largest market. In May 2016, two senior sales managers were appointed to cover the Australia and New Zealand (ANZ) and Asia/Pacific regions, respectively. In August 2016, North American head count was increased by 50% to support the increase in sales. In October 2016, Paessler announced its first training partner for the Asia/Pacific region, based in Australia.

Paessler's NPMD revenue is between $26 million and $50 million per year.

STRENGTHS

• Paessler's customers report high satisfaction in terms of value, service and support offered.
• The vendor has had strong growth over the last two years with a significant ramp-up of customers and the total installed base.
• Paessler's rapid development stream means that new and updated sensors are released frequently — on a quarterly basis.

CAUTIONS

• Paessler targets midmarket enterprises and SMBs, limiting its ability to meet specific large-enterprise scaling requirements.
• The vendor does not currently offer its solution as a hosted service, a deployment option that may appeal to some of its target market.
• The packet sniffer and flow modules have limited capabilities, including an inability to save data to disk for historical analysis.

Riverbed

Riverbed, headquartered in San Francisco, has assembled a broad set of NPMD capabilities through acquisition, alongside its core WAN acceleration business and a newly formed SD-WAN offering. This has been augmented by Riverbed's recent acquisition of Aternity to add an endpoint monitoring capability.

The suite, branded as SteelCentral Network Performance Management (NPM), includes several appliance lines and software components that support network data collection, storage and analytics. SteelCentral NPM is headlined by NetProfiler for flow analysis and AppResponse for packet analysis. These capabilities are supplemented by SteelCentral Packet Analyzer Plus, Transaction Analyzer, NetSensor and UCExpert, which provides additional capability for packet trace analysis, infrastructure monitoring and UC monitoring. Rounding out Riverbed's offering is SteelCentral Portal, which provides a common visualization and analytics framework for the entire SteelCentral line, and SteelCentral Aternity, a new agent-based endpoint monitoring capability.

In its latest release, Riverbed has brought further integration between its NPMD capabilities and its APM products, with integrated network and application workflows. The NetShark appliance, which was part of the SteelCentral NPM suite, has been integrated into the AppResponse appliance, with now only a single packet collection appliance. Riverbed also acquired Ocedo to enter the growing SD-WAN market, with a product called SteelConnect, and integration of SteelCentral visibility with SteelConnect automation is expected.

Riverbed's NPMD revenue is between $100 million and $250 million per year.

STRENGTHS

• The planned integration of SteelCentral and SteelConnect presents unique intent-based networking opportunities coupling deep visibility with network control.
• Riverbed's integration of AppResponse and NetShark, and dropping of the NetShark brand, represents a much needed rationalization of the vendor's product suite.
• Further SteelCentral integration and simplification will allow Riverbed to better leverage its strong partner and distribution network to the benefit of its customers.

CAUTIONS

• The vendor's focus on improvements in suite integration and rationalization limits the introduction of innovative new features.
• Endpoint agent-based user experience monitoring, such as SteelCentral Aternity, may provide limited value to network-focused NPMD buyers.
• Despite more focus on its social media and marketing presence, Riverbed still has a gap in distinguishing its brand outside of its WAN optimization roots.

SevOne

Headquartered in Boston, Massachusetts, SevOne focuses on infrastructure monitoring, complemented with capabilities for flow and log monitoring. SevOne markets primarily to the large enterprise and service provider markets, based on its scalability and a flexible distributed architecture. The vendor had been increasing its head count since last year, but significant layoffs were publicly reported in August 2016, in addition to the resignation of SevOne's two founders.

The vendor's NPMD solution consists of SevOne Performance Appliance Solution (PAS), Dedicated NetFlow Collector (DNC), Performance Log Appliance (PLA) and the newly introduced End User Experience Appliance (EUE), the latter through an OEM arrangement with AppNeta. EUE is offered as a SaaS capability.

SevOne has updated its offering with live maps, and support for infrastructure orchestration solutions, SD-WAN, hybrid cloud and carrier network virtualization. Improvements have been made to log integration with standard SevOne workflows, but these log monitoring capabilities should not be confused with pure-play log monitoring vendors. SevOne has also embarked on significant updates to its user interface, as well as more flexible deployment options for public and private cloud infrastructures. The vendor announced a new program called SevOne Ready Alliance in July 2016 to foster both integrations and go-to-market strategies.

SevOne's NPMD revenue is between $51 million and $100 million per year.

STRENGTHS

• SevOne is the first to integrate metric, flow, logs and synthetic end-user experience data into an enterprise-class, carrier-grade platform, with one-second polling granularity.
• SevOne is building a strong platform story with partnership announcements with innovative players in the SD-WAN and storage space.
• xStats adapters that are highly customizable and have very broad support continue to be a competitive differentiator for clients looking for broad support of unique systems.

CAUTIONS

• SevOne is very focused as an ITIM tool, with drill-downs into flow or log data, but is missing many of the capabilities of NPMD leaders, derived from more holistic network performance monitoring based on packet data.
• SevOne's continued focus is on large enterprises (primarily in the financial services and technology sectors) and CSPs, putting its solution out of reach of the broader NPMD buying market.
• Given the recent reorganization and strategic changes, buyers should scrutinize product deliverables and roadmaps to ensure that they meet requirements.

SolarWinds

SolarWinds, based in Austin, Texas, has a very large network management installed base and wide name recognition, with a focus on infrastructure monitoring for small and midmarket enterprises. SolarWinds offers a low-cost and simple solution that appeals to many IT organizations, but increasingly complex environments and problems often force users to supplement with more sophisticated solutions. SolarWinds has hired the former general manager of HPE's ITOM division to be its new executive VP of product.

SolarWinds' NPMD solution consists of SolarWinds Network Performance Monitor and NetFlow Traffic Analyzer (NTA). The former is primarily an infrastructure monitoring platform, supplemented by flow data from NTA. SolarWinds leverages its Quality of Experience (QoE) software agents for packet monitoring. The vendor offers a variety of additional capabilities around configuration management, topology mapping and application monitoring that provide a loosely integrated solution suite.

SolarWinds' new capabilities include NetPath, which delivers path discovery and analysis across hybrid IT environments, and support for modern network appliances like load balancers, firewalls and web proxies. SolarWinds also relies on an inside sales model only that focuses on digital marketing, and offers no professional services.

SolarWinds was acquired in a leveraged buyout by Silver Lake Partners and Thoma Bravo. Customers are encouraged to do appropriate due diligence whenever a change of ownership occurs.

SolarWinds' NPMD revenue is between $250 million and $500 million per year.

STRENGTHS

• SolarWinds' set of tools beyond NPMD provides useful complementary capabilities, including topology mapping and network configuration management, and newly added APM capabilities.
• SolarWinds boasts a large, active and passionate user community called Thwack.
• The new release of NetPath provides visibility into path analytics and cloud visibility.

CAUTIONS

• The vendor has a limited focus on introducing cutting-edge new features, specifically in the area of network forensics.
• While the vendor offers basic packet monitoring through its QoE agents, this feature is not used or known by much of its customer base, nor has it seen significant investment from SolarWinds.
• SolarWinds' solutions are software-only, which can limit scalability when compared with hardware-based solutions.

Viavi

Viavi is based in Milpitas, California, and formerly known as JDSU. Its acquisition of Network Instruments brought its NPMD solution onboard. Viavi has a long history in network performance monitoring. In the last year, the vendor hired several industry veterans to lead its Enterprise and Cloud Business Unit, including a former executive from NetScout and Fluke Networks.

The current Viavi NPMD solution set consists of the Observer Performance Management Platform, which includes Observer Apex, Observer Analyzer, Observer Management Server, Observer GigaStor and Observer Probes. New to the portfolio is Observer SightOps, which is an OEM arrangement with ScienceLogic that replaces Observer Infrastructure, and is aimed at extending Viavi's monitoring reach into cloud and hybrid environments.

The Viavi performance management platform remains a technically comprehensive, packet-based NPMD tool. Deployment options have improved with the delivery of a virtual appliance of GigaStor Software Edition that supports up to 8TB of storage and provides visibility into east-west traffic. In addition, Viavi has introduced an integration with Cisco FirePOWER to address an integrated security workflow through GigaStor packet extraction.

Viavi is investing in bringing a self-service SaaS-based service assurance and troubleshooting delivery platform to market in mid-2017. It has also introduced a new three-tier Velocity Channel Program late last year, including several online tools to help enable partners.

Viavi's NPMD revenue is between $100 million and $250 million per year.

STRENGTHS

• Packet capture and inspection (via GigaStor) capability continues to be well-regarded by Viavi clients, with in-house-designed packet capture hardware.
• Observer SightOps uniquely addresses the visibility challenges created by hybrid IT, by combining cloud infrastructure monitoring with NPMD workflows.
• Viavi has restructured pricing for GigaStor to better serve the midmarket.

CAUTIONS

• Viavi suffers from poor name recognition among the NPMD customer base, having gone through two name changes over the last few years.
• Viavi's primary corporate focus in the service provider vertical contrasts with Observer's enterprise user base, and must continue to be aligned to find synergies across these business units.
• Support for flow monitoring is limited compared to the competition.

Vendors Added and Dropped

We review and adjust our inclusion criteria for Magic Quadrants as markets change. As a result of these adjustments, the mix of vendors in any Magic Quadrant may change over time. A vendor's appearance in a Magic Quadrant one year and not the next does not necessarily indicate that we have changed our opinion of that vendor. It may be a reflection of a change in the market and, therefore, changed evaluation criteria, or of a change of focus by that vendor.

Added

• AppNeta
• ExtraHop
• Ipswitch
• LiveAction

Dropped

• Automic — Spun off NPMD solution, called Streamcore, which didn't meet minimum revenue requirement for inclusion.
• Niksun — Focus is on security workflows.

Inclusion and Exclusion Criteria

Product-Related Criteria

Vendors are required to meet the following criteria to be considered for the 2017 NPMD Magic Quadrant and Critical Capabilities research:

• The ability to monitor, diagnose and generate alerts for:
  • Network endpoints — Servers, virtual machines, storage systems or anything with an IP address by measuring these components directly, in combination with a network perspective. This includes cloud-hosted and wireless endpoints.
  • Network components — Routers, switches and other network devices. This includes SDN and NFV components.
  • Network links — Connectivity between network-attached infrastructure.
• The ability to monitor, diagnose and generate alerts for dynamic end-to-end network service delivery as it relates to:
  • End-user experience — The capture of data about how end-to-end application availability, latency and quality appear to the end user from a network perspective. This is limited to network traffic visibility and not within components, such as what application performance monitoring is able to accomplish.
  • Business service delivery — The speed and overall quality of network service and/or application delivery to the user in support of key business activities, as defined by the operator of the NPMD product. These definitions may overlap as services and applications are recombined into new applications.
  • Infrastructure component interactions — The focus on infrastructure components as they interact via the network, as well as the network delivery of services or applications.
• Support for analysis of:
  • Real-time performance and behaviors — Essential for troubleshooting in the current state of the environment. Analysis of data must be done within three minutes under normal network loads and conditions.
  • Historical performance and behaviors — To help understand what occurred or what is trending over time.
  • Predictive behaviors by leveraging algorithmic IT operations (AIOps) technologies — The ability to distill and create actionable advice from the large dataset collected across the various data sources.
• Leverage the following data sources:
  • Network-device-generated traffic data, including flow-based data sources inclusive of NetFlow and IPFIX.
  • Network-device-generated health data.
  • Network packet analysis to identify application types and performance characteristics.
• The ability to support the following scalability and performance requirements:
  • Real-time monitoring of 10 Gigabit Ethernet networks at full line rate.
  • Ingesting of sampled flow records at a rate of 75,000 flows per second via a single instance of the product.

Non-Product-Related Criteria

• Total NPMD product revenue (including new licenses, updates, maintenance, subscriptions, SaaS, hosting and technical support) must have exceeded $7.5 million for 3Q15 through 2Q16, excluding revenue derived from security-related buying centers.
• The vendor must have at least 75 customers that use its NPMD product actively in a production environment.
• The vendor must have at least 10 customers located in at least two of the following geographic locations: North America, Latin America, EMEA and/or APAC that use its NPMD product actively in a production environment.

Honorable Mentions

The following sample vendors were unable to meet the inclusion criteria to be included in this research, but do come up in NPMD-related inquiries:

• Dynatrace
• Pluribus Networks
• Empirix
• Extreme Networks
• FixStream
• Kentik
• Netis (Crossflow)
• Nyansa
• Performance Vision
• ThousandEyes
• Splunk
• Statseeker

Evaluation Criteria

Ability to Execute

• Product or Service: Gartner makes judgments from a variety of inputs to evaluate the capabilities, quality, usability, integration and feature set of the solution, including the following functions:
  • Data source support, including application visibility
  • Algorithmic IT operations analytics
  • Diagnostic workflows
  • Real-time monitoring
  • Day-to-day maintenance and management of the product
  • Ease and simplicity of deployment and configuration
  • Ease of use and richness of functions within the product
  • Product deployment options and usability
• Overall Viability: We consider the vendor's company size, market share and financial performance (such as revenue growth and profitability). We also investigate any investments and ownership, and any other data related to the health of the corporate entity. Our analysis reflects the vendor's capability to ensure the continued vitality of its NPMD offering.
• Sales Execution/Pricing: We evaluate the vendor's capability to provide global sales support that aligns with its marketing messages; its market presence in terms of installed base, new customers and partnerships; and flexibility and pricing within licensing model options, including packaging.
• Market Responsiveness/Record: We evaluate the execution in delivering and upgrading products consistently, in a timely fashion, and meeting roadmap timelines. We also evaluate the vendor's agility in terms of meeting new market demands, and how well the vendor receives customer feedback and quickly builds it into the product.
• Marketing Execution: This is a measure of brand and mind share through client, reference and channel partner feedback. We evaluate the degree to which customers and partners have positive identification with the product, and whether the vendor has credibility in this market.
• Customer Experience: We evaluate the vendor's reputation in the market, based on customers' feedback regarding their experiences working with the vendor, whether they were glad they chose the vendor's product and whether they planned to continue working with the vendor. Additionally, we look at the various ways in which the vendor can be engaged, including social media, message boards and other support avenues.
• Operations: We evaluate the ability of the organization to meet goals and commitments. Factors include quality of the organizational structure, skills, experiences, programs, systems and other vehicles that enable the organization to operate effectively and efficiently.

Table 1.   Ability to Execute Evaluation Criteria

Evaluation Criteria	Weighting
Product or Service	High
Overall Viability	High
Sales Execution/Pricing	Medium
Market Responsiveness/Record	High
Marketing Execution	Medium
Customer Experience	High
Operations	Not Rated

Source: Gartner (February 2017)

Completeness of Vision

• Market Understanding: This criterion evaluates vendor capabilities against future market requirements. The market requirements map to the Market Overview discussion and look for the following functionality:
  • Data source support, including application visibility
  • Algorithmic IT operations analytics
  • Diagnostic workflows
  • Real-time monitoring
  • Virtualization (NFV and SDN)
  • Hybrid IT support
• Marketing Strategy: We evaluate the vendor's capability to deliver a clear and differentiated message that maps to current and future market demands, and, most importantly, the vendor's marketing effectiveness to the NPMD market through its website, advertising programs, social media, collaborative message boards, tradeshows, training and positioning statements.
• Sales Strategy: We evaluate the vendor's approach to selling NPMD in the appropriate distribution channels, including channel sales, inside sales and outside sales.
• Offering (Product) Strategy: We evaluate product scalability, usability, functionality and delivery model innovation. We also evaluate the innovation related to the delivery of products and services.
• Business Model: This is our evaluation of whether the vendor continuously manages a well-balanced business case that demonstrates appropriate funding and alignment of staffing resources to succeed in this market. Delivery methods will also be evaluated as business model decisions, including the strength and coherence of on-premises and SaaS solutions.
• Vertical/Industry Strategy: We evaluate the targeted approaches in marketing and selling into specific vertical industries.
• Innovation: This criterion includes product leadership and the ability to deliver NPMD features and functions that distinguish the vendor from its competitors. Specific considerations include resources available for R&D and the innovation process.
• Geographic Strategy: This is our evaluation of the vendor's ability to meet the sales and support requirements of IT organizations worldwide. In this way, we assess the vendor's strategy to penetrate emerging markets.

Table 2.   Completeness of Vision Evaluation Criteria

Evaluation Criteria	Weighting
Market Understanding	High
Marketing Strategy	Medium
Sales Strategy	Medium
Offering (Product) Strategy	High
Business Model	Low
Vertical/Industry Strategy	Low
Innovation	High
Geographic Strategy	Low

Source: Gartner (February 2017)

Quadrant Descriptions

Leaders

The Leaders quadrant represents those vendors that are pushing the NPMD market forward, including those with comprehensive portfolios and the ability to handle broad sets of data inputs and analytics techniques. They offer a choice of hardware or software appliances for optimum flexibility, while making formerly premium-priced NPMD solutions attainable to the broader market. All Leaders offer a high degree of application-aware insight and visibility, along with advanced troubleshooting and diagnostics workflows.

Challengers

Challengers consist of those vendors with high market reach and large deployments. Stalwarts in the network performance monitoring and diagnostics market, they are currently striving to deal with new technical demands and rising expectations. These established NPMD vendors generally bring a substantial installed base, but also architectures, feature sets and pricing structures that require modernization (often in progress) to better compete with those in the Leaders quadrant.

Visionaries

Visionaries have built a compelling plan to competitively address current and future NPMD customer demands. The Visionaries are combining elements of AIOps and NPMD in ways that provide deeper visibility than is currently available from other vendors. Presently, execution is limited either by insufficient market reach, or by the extent of existing tools and technology capabilities that are not initially designed, or able, to meet these needs.

Niche Players

Niche Players are those vendors with solutions catering to specific audiences or with limited use-case support today. They have often been unable to address the needs of larger enterprises, or have only done so within specific verticals or market segments. Each of these vendors is working to appeal to the broader NPMD buying community, versus the targeted use cases they serve today. With the right changes to their product plans, positioning and/or business execution strategies, any of these vendors could successfully shift their differentiated technologies to address use cases in ways that today's Leaders might have a hard time matching.

Context

NPMD solutions should be considered as part of an overall network management initiative included in a larger availability and performance monitoring strategy. Utilizing these additional points of reference will yield further unique criteria (such as existing investments, investment plans and vendor relationships) that, when combined with Gartner analysis, can prove critical to proper solution selection.

In the course of this research, several key observations emerged that should be carefully considered during NPMD strategy formulation and solution selection, including:

• The end-user survey showed an increase in the percentage of respondents leveraging packet data for network analytics.
• When asked to name other vendors considered in NPMD buying decisions, end users from the survey listed the following vendors most often: SolarWinds, NetScout, Cisco and CA.
• A larger-than-usual number of network monitoring industry veterans have left their positions to join other NPMD vendors, as compared to previous years.
• Industry consolidation through acquisition and activist investors has led to changes of ownership affecting several NPMD vendors.
• Normalization of UI and workflows across several vendors' toolsets has shown some progress, but much work must still be done.
• Ease of use remains an area that needs improvement, and it varies significantly both across vendors and within solutions.
• Support for monitoring cloud and hybrid IT environments remains limited; however, slow progress is being made.
• Increasingly, vendors are expanding support for nontraditional NPMD data sources like API and log data into their NPMD workflows.
• Path analytics, as part of a cloud monitoring strategy, has seen some investment from NPMD vendors.
• Vendors have increasingly begun to leverage big data back ends or have built operational analytics overlays to facilitate data analytics across all captured data.
• There is increasing synergy between IT operations and security operations using NPMD data for both performance and security analytics.
• Support for monitoring SDN environments is limited in most NPMD solutions, but many NPMD vendors now offer virtual instances of their products for instantiation in an SDN environment.
• NPMD solutions have a primary data source (SNMP, flow or packet), and have a difficult time leveraging the benefits of each data source for the maximum value to the user.
• Pricing and product/capability packaging vary significantly across vendors.
• On-premises software and appliances are the dominant delivery model, but SaaS offerings are slowly becoming available, although they have not been adopted widely.
• Increasing overlaps with IT infrastructure monitoring, APM and AIOps tools are impacting buying decisions.
• Many NPMD solutions are assembled from multiple products, which can enable modular adoption of NPMD capabilities, but also can add significant complexity to procurement and ongoing maintenance.

It remains imperative that organizations purchase tools that closely match their current maturity levels. Many network monitoring teams have yet to successfully make the leap from basic, reactive network availability management to proactive performance management. While tool investment can play a part in this maturation, it is clear that simply investing in NPMD tooling without similar investments in training, integration and processes will yield limited results, at best. Gartner recommends that IT operations assess its current state of maturity on a regular basis, both individually and at the organizational level, to provide this perspective. To help, teams can utilize Gartner's ITScore for Infrastructure and Operations (ITSIO; see "How to Improve I&O Maturity by Using the ITScore" ).

I&O leaders should not utilize the Leaders quadrant as a shortlist of appropriate vendors, but instead should build a list of criteria describing their current and future needs, and then select from vendors that best meet those requirements (see 2017 NPMD Critical Capabilities). They should select a vendor that has both a history of and future plans for focusing on this market. Careful consideration should be given to required skills, training, process and deployment investments, because these factors will have a much greater impact on the overall value realized from an NPMD investment than any specific functional capability found in a given tool.

Market Overview

NPMD: A Mature Market Evolves in Response to New Demands

For decades, the well-established practice of network management has enjoyed no shortage of available monitoring technologies, tools and vendors; however, the vast majority of those solutions, both acquired and implemented over the years, have been designed to support isolated, reactive resolution of availability issues by network specialists. There have also been many investments in tools and skills, with the specific goal of monitoring the performance of network infrastructure in addition to its availability; however, these efforts have typically been hampered by technology limitations and isolated implementation. This approach, while delivering moderately satisfactory results for many years, has seen several key shifts, including:

• Increasing recognition that network traffic is a critical source of information about the behavior of the holistic IT stack
• Migration toward cloud-hosted workloads and applications fundamentally changing the flow of network traffic (see "Network Performance Monitoring Tools Leave Gaps in Cloud Monitoring" )
• Increasing virtualization and the explosion of east-west traffic within the data center presenting a data capture challenge
• Exponential growth in application and infrastructure dynamism and complexity forcing network instrumentation as the key piece of the visibility puzzle
• Rising demand for network services and end-user expectations of their quality
• Growing appreciation of the network as a critical component of IT services and as an agnostic, trusted source of cross-domain availability and performance data
• Closer alignment between IT and the business, with an appreciation that network data can provide value through business intelligence

Each of these shifts has pressured network teams to rethink their tooling strategy, so that they can get the visibility they need to truly monitor and troubleshoot the performance of their network resources in the context of the applications and services they support.

NPMD tools provide this required breadth and depth of visibility in both real-time and historical perspectives by uniquely analyzing data from all three of the following techniques: device polling, flow-based technology and packet-based technology. Previous approaches that only take into account one or two of these data sources have proven to be inadequate, so all three must be supported for a tool to be considered an NPMD solution (see the Product-Related Criteria section).

Device Polling Technology

Period polling is one method that looks to quantify network usage of network elements to gauge the requirements of the infrastructure. Each network device has embedded agents that "speak SNMP." These agents can then be interrogated with a polling-based approach, returning metrics from the embedded agent. These collected metrics can be stored, reported on, analyzed for troubleshooting or used for capacity planning. SNMP polling can also be used to gather information about hardware or software errors (faults) and capacity data (for example, triggering an alert when a hardware fault occurs, or the device CPU is above a threshold or the interface capacity is abnormal when compared to a baseline). Based on the metrics gathered, the network team can estimate the delta between existing and required bandwidth needs on a per-location basis. A limitation with this method is the minimal granularity it offers, which matches the frequency of the polling and the overhead it may put on the devices being polled, especially if other tools are also polling. In most NPMD technologies, SNMP is used during troubleshooting to collect additional data, whereas in infrastructure monitoring, it's used more regularly to understand the health of the network devices. In addition to SNMP, the use of APIs as a polling data source is also a common technique to collect health data, and is often used for information from IaaS providers or SDN controllers.

While polling provides information on interface utilization and traffic, it is unable to provide a view into application and end-user usage patterns. To meet this need, consider solutions that provide flow- and packet-based technology.

Flow-Based Technology

Summarized data is generated by the network devices, including characteristics of the IP conversation between two network nodes, and these characteristics are embedded within flows. Flow data is exported from the network devices to the NPMD technologies, which then collect and process this data stream to provide insight into which devices and applications are consuming bandwidth, how long the conversations are lasting, and who is participating in them. Since the data is summarized, a degree of detail is removed to simplify processing and extract meaning from the actual network data.

There are several flow collection standards, such as Cisco's NetFlow (v.5/v.9), Juniper Networks' J-Flow, Huawei's NetStream, Citrix's AppFlow, the Internet Engineering Task Force's (IETF's) Internet Protocol Flow Information Export (IPFIX, which is based on NetFlow v.9) and sFlow from the sFlow.org consortium. Vendor-derived standards are predominant, which hinders integration and comparisons. Flow data collection is a function embedded in the network devices themselves. The device analyzes the network traffic traversing from one interface to another, with the primary purpose of assessing bandwidth consumption, and the level of data being sent and received between various source and destination ports across the network. That data is then summarized into a stream-of-flow record that is sent to the monitoring tools that collect and assess the flow records.

Additionally, the quality and granularity of flow information are always evolving. Many vendors embed additional data within their flows, especially those implementing flexible record types, such as Cisco's IOS Flexible NetFlow, which allows the user to configure the exported data format. Example data embedded in flows contains wireless protocols, link aggregation, URLs, latency information, and other application or infrastructure monitoring data. With such open standards in flow technologies, the architecture varies among network equipment vendors, but most tools collect and process the data regardless of the network equipment implementation. In addition, it can have a performance impact on the devices exporting flow data.

Flow-based data does not provide details down to a specific set of network packets going between the source and destination, nor does it provide any timing information about the conversation itself or the delay components. For this capability, users must consider packet-based technologies.

Packet-Based Technology

Examining the current infrastructure in detail on a per-packet basis provides the necessary real-time and historical visibility into volatile traffic behavior from "bursty" modern application types, like today's chatty web applications, UC services (such as voice and video delivery) and the growing footprint of virtual desktop infrastructure (VDI) technologies. Because only raw, unmanipulated packet data is collected, a vendor-agnostic view of performance can be preserved throughout the analysis. This approach affords far greater insight and precision, but it comes with potentially costly (and for some, impossibly costly) appliance or "probe" implementation requirements. Software-based packet capture capabilities have been introduced as cost-sensitive alternatives, but with obvious limitations in scalability and storage.

Analysis offered by packet-based technology is packet-timing-based, allowing vendors to identify sources of delay, measure user response time and ultimately pinpoint the root cause of performance problems. The packet analysis vendors range from those providing measurements from a TCP connection perspective to those reporting on timing on a TCP request/response basis. Other vendors move up the stack to measuring at the application layer, providing measurements from an application session perspective and a much closer representation to real end-user experience.

Through the years, these high-end proprietary packet analysis technologies have commoditized and moved into open source, with tools such as Wireshark, tcpdump and libpcap providing the underpinnings of this technique. These particular open-source technologies have, in turn, been incorporated into countless numbers of other critical open-source projects, such as ntop or Snort (intrusion detection). These technologies continue to evolve, most recently into enabling real-time visibility and, in many cases, supporting the archiving of packet data for forensics and debugging without requiring the issue to be reproduced for diagnosis.

As the NPMD market continues to grow and develop, Gartner expects that future tool enhancements will center on usability, advanced IT operations analytics and virtualization/SDN support. Additional vendors are expected to enter the NPMD market, as well as vendors participating in the larger network performance monitoring market, but they did not meet the criteria specific to the 2017 NPMD Magic Quadrant.

Adjacent and Overlapping Markets

NPMD is, and will likely continue to be, frequently confused with adjacent and component technologies, as it is both a reasonably recent addition to the dynamic availability and performance monitoring market and a superset of multiple network performance monitoring technologies. Because vendors will both intentionally and unintentionally exacerbate this confusion to their benefit, IT leaders are advised to utilize the following definitions to add clarity to their evaluation efforts.

Application Performance Monitoring

APM tracks the end-user performance of application components, and provides granular troubleshooting tools for the application and its components through server-based instrumentation. It provides this insight by monitoring three main functional dimensions: digital experience monitoring; application discovery, tracing and diagnostics; and application analytics. APM differs from NPMD primarily in its focus on monitoring the quality of the end-user experience via application interactions across all application and infrastructure tiers, including (but not limited to) the network perspective. There are several vendors in the NPMD space that offer accompanying APM solutions, and several vendors offer integrated APM and NPMD solutions. See "Magic Quadrant for Application Performance Monitoring Suites" for further details.

IT Infrastructure Monitoring

IT infrastructure monitoring (ITIM) tools focus exclusively on monitoring the infrastructure topology composed of compute systems, storage, virtualization and network devices, using agent-based or agentless polling technologies, such as SNMP, Windows Management Instrumentation (WMI) or API integration-based data collection. These solutions focus on the availability and health of these systems, as opposed to the performance insight offered by APM and NPMD solutions. The difference between these tools and APM products is that they look at server-level metrics and processes, while also looking at the way servers interact with one another, versus living within the application logic and seeing the code execute. Unlike NPMD products, which cater to network professional use cases and speak in protocols and packet data that those buyers best understand, IT infrastructure monitoring products focus on IT operations generalists and often don't include support for packet- and flow-based technologies. These generalists need to determine which part of the infrastructure is contributing to poor performance, as well as understand the application's topology from an infrastructure perspective. Some ITIM tool vendors have moved partially into the NPMD space with the introduction of flow and packet support. Infrastructure monitoring should be supplemented by log analytics, NPMD and APM tooling to support complex troubleshooting and performance monitoring. See "Market Guide for IT Infrastructure Monitoring Tools" for more information.

Algorithmic IT Operations Platforms (Formerly IT Operations Analytics)

The coordinated deployment of AIOps technologies is used to discover complex patterns in high volumes of "noisy" IT data by providing a real, automated inference capability not available in most tools. These technologies include complex operations event processing (COEP), machine learning/statistical pattern discovery and recognition (ML/SPDR), unstructured text indexing search and inference (UTISI), topological analysis (TA), and multidimensional database search and analysis (MDSA).

IT operations' future as a big data analysis entity has been cemented by an exponential, continual growth of data (IT and business) generated by highly adaptive systems composed of large numbers of moving parts whose interactions are increasingly transient and complex. These systems' behaviors cannot be characterized, much less managed, by inferring the behavior of the whole from the behavior of any individual part, necessitating the use of AIOps' advanced capabilities (see "Innovation Insight for Algorithmic IT Operations Platforms" ).

Digital Experience Monitoring (Formerly End-User Experience Monitoring)

Digital experience monitoring (DEM) is an availability and performance monitoring discipline that supports the optimization of the operational experience and behavior of a digital agent, human or machine, with the application and service portfolio of enterprises. This discipline also seeks to observe, model and manage the behavior of digital agent communities as they collectively engage with enterprise application and service portfolios. Several NPMD solutions provide DEM capabilities as part of their solution offerings.

Network Packet Brokers

NPBs assist with traffic aggregation, visibility and overall management of the data being sent to monitoring tools. Vendors in the NPB space often partner and collaborate with NPMD and security vendors as a go-to-market strategy, resulting in marketing messages that can make it difficult to determine which tool is actually performing the monitoring (network performance monitoring or security) and which is facilitating the monitoring by managing the data to be monitored (network packet brokering). Vendors such as NetScout and Viavi, both of which are included in this Magic Quadrant, offer NPB solutions as part of their solution set. See "Market Guide for Network Packet Brokers" for further details.

Evidence

Press release: "SolarWinds Acquires AppNeta TraceView Solution."

Press release: "ExtraHop Appoints Former Fluke Networks President, Arif Kareem, as CEO on the Heels of Most Successful Quarter to Date."

"SevOne Begins 'Brutal' Round of Layoffs." Delaware Online/The News Journal.

"SevOne Founders Vess and Tanya Bakalov Leaving Company." Delaware Online/The News Journal.

Press release: "NetScout Strengthens Its Powerful Business Assurance Lineup for the Enterprise With nGenius for Flows."

Press release: "NetScout Unveils Industry's First Real-Time Information Platform for Service Assurance, Cybersecurity and Big Data."

"NetScout Systems' (NTCT) CEO Anil Singhal on Q2 2017 Results — Earnings Call Transcript." Seeking Alpha.

Press release: "Micro Focus Announces Intent to Merge With Hewlett Packard Enterprise's Software Business Segment."

Press release: "Thoma Bravo Completes Sale of InfoVista to Apax Partners"

Press release: "SolarWinds Completes Take-Private Acquisition by Silver Lake and Thoma Bravo."

Note 
Definition of Machine-Time Data

Machine-time data is the flow of communication that is handled without human operators or intervention. The data is exclusive on a machine-to-machine basis in an autonomous fashion. The perception of "real time" in such scenarios is more fine-grained, given that machines can react and respond to situations in microseconds (generally 1 to 2 microseconds), whereas human real-time responsiveness is generally measured in seconds (or tenths of seconds in the most demanding of instances).

Evaluation Criteria Definitions

Ability to Execute

Product/Service: Core goods and services offered by the vendor for the defined market. This includes current product/service capabilities, quality, feature sets, skills and so on, whether offered natively or through OEM agreements/partnerships as defined in the market definition and detailed in the subcriteria.

Overall Viability: Viability includes an assessment of the overall organization's financial health, the financial and practical success of the business unit, and the likelihood that the individual business unit will continue investing in the product, will continue offering the product and will advance the state of the art within the organization's portfolio of products.

Sales Execution/Pricing: The vendor's capabilities in all presales activities and the structure that supports them. This includes deal management, pricing and negotiation, presales support, and the overall effectiveness of the sales channel.

Market Responsiveness/Record: Ability to respond, change direction, be flexible and achieve competitive success as opportunities develop, competitors act, customer needs evolve and market dynamics change. This criterion also considers the vendor's history of responsiveness.

Marketing Execution: The clarity, quality, creativity and efficacy of programs designed to deliver the organization's message to influence the market, promote the brand and business, increase awareness of the products, and establish a positive identification with the product/brand and organization in the minds of buyers. This "mind share" can be driven by a combination of publicity, promotional initiatives, thought leadership, word of mouth and sales activities.

Customer Experience: Relationships, products and services/programs that enable clients to be successful with the products evaluated. Specifically, this includes the ways customers receive technical support or account support. This can also include ancillary tools, customer support programs (and the quality thereof), availability of user groups, service-level agreements and so on.

Operations: The ability of the organization to meet its goals and commitments. Factors include the quality of the organizational structure, including skills, experiences, programs, systems and other vehicles that enable the organization to operate effectively and efficiently on an ongoing basis.

Completeness of Vision

Market Understanding: Ability of the vendor to understand buyers' wants and needs and to translate those into products and services. Vendors that show the highest degree of vision listen to and understand buyers' wants and needs, and can shape or enhance those with their added vision.

Marketing Strategy: A clear, differentiated set of messages consistently communicated throughout the organization and externalized through the website, advertising, customer programs and positioning statements.

Sales Strategy: The strategy for selling products that uses the appropriate network of direct and indirect sales, marketing, service, and communication affiliates that extend the scope and depth of market reach, skills, expertise, technologies, services and the customer base.

Offering (Product) Strategy: The vendor's approach to product development and delivery that emphasizes differentiation, functionality, methodology and feature sets as they map to current and future requirements.

Business Model: The soundness and logic of the vendor's underlying business proposition.

Vertical/Industry Strategy: The vendor's strategy to direct resources, skills and offerings to meet the specific needs of individual market segments, including vertical markets.

Innovation: Direct, related, complementary and synergistic layouts of resources, expertise or capital for investment, consolidation, defensive or pre-emptive purposes.

Geographic Strategy: The vendor's strategy to direct resources, skills and offerings to meet the specific needs of geographies outside the "home" or native geography, either directly or through partners, channels and subsidiaries as appropriate for that geography and market.

© 2017 Gartner, Inc. and/or its affiliates. All rights reserved. Gartner is a registered trademark of Gartner, Inc. or its affiliates. This publication may not be reproduced or distributed in any form without Gartner's prior written permission. If you are authorized to access this publication, your use of it is subject to the Usage Guidelines for Gartner Services posted on gartner.com. The information contained in this publication has been obtained from sources believed to be reliable. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information and shall have no liability for errors, omissions or inadequacies in such information. This publication consists of the opinions of Gartner's research organization and should not be construed as statements of fact. The opinions expressed herein are subject to change without notice. Gartner provides information technology research and advisory services to a wide range of technology consumers, manufacturers and sellers, and may have client relationships with, and derive revenues from, companies discussed herein. Although Gartner research may include a discussion of related legal issues, Gartner does not provide legal advice or services and its research should not be construed or used as such. Gartner is a public company, and its shareholders may include firms and funds that have financial interests in entities covered in Gartner research. Gartner's Board of Directors may include senior managers of these firms or funds. Gartner research is produced independently by its research organization without input or influence from these firms, funds or their managers. For further information on the independence and integrity of Gartner research, see "Guiding Principles on Independence and Objectivity."