Last week, I asked in an ambassador post, “Would you automate QoS policy based on real-time flow data?” The resulting comments were a good discussion about the benefits of automating changes to a QoS policy versus the risks inherent in the software doing something stupid, leading to undesirable results.
The comments made for such a useful conversation, that I’m going to rephrase the question like so: if not QoS policy manipulation, what real-time traffic-based automation would you trust? And I’m going to place a couple of constraints around the question.
- Let’s assume that the flow data is actually real-time, and not a netflow export that’s sampled periodically. Think about network traffic being tapped or mirrored to a device that can process the traffic. I know this is the NTA forum and so maybe I’m getting a little far afield, but bear with me.
- Let’s also assume that the software monitoring the tapped traffic can actually process all of the data coming at it. I know you could make the case that with multiple 10G feeds, it’s too hard to keep up with the data. But let’s say we have boxes that can do it.
I think there’s a good case to be made for dynamically reprogramming network forwarding behavior based on real-time traffic analysis. I’m getting away from the specifics and more into the realm of ideas, but these are ideas I’ve heard that make sense to me.
- Temporarily redirecting traffic that’s unknown to a security device for analysis.
- Traffic steering, where traffic is balanced across links based on a combination of traffic characteristics and link utilization.
- Prioritizing specific traffic flows between two endpoints to minimize latency.
Do any of those ideas work, from your perspective? Do you have any ideas of your own where you would trust an automated process to perform network configuration based on network traffic analysis?