What’s Behind the M&A in Network Monitoring?

I got an email on the Emulex/Endace deal, making among other things the obvious comparison between the move and deals like NetScout/OnPath and Riverbed/Opnet.  I think some of Cisco’s recent deals, as well as moves by VMware/EMC, could also be called “related”.  The problem I have at this point is deciding just what the common factor is.

Strategy is like mob psychology.  A charismatic leader raises a banner and attracts followers to the message—for about the first 100 people.  After that, the new converts are just joining the crowd and not the cause, because eventually the mob covers the stimulation.  So we have to look through the mob to see if there really is any cause at the core.

To my mind, the only possible strategic driver for all the sudden interest in network telemetry is the broad shift that was started by the cloud and is now being advanced with specific network initiatives like SDN and NFV.  Whether you agree with the idea of having network intelligence centralized, or you just want networks to be more explicitly controlled by software, there’s no substitute for knowing what you’re doing if you’re controlling something.  If network devices today are wired to adapt to conditions and you propose to override that adaptation in some way, you have to get a handle on conditions before, during, and after your changes.  That would seem to validate the notion that network telemetry could get a LOT more strategic.

Think a moment about this.  If we have a “cloud network” as a virtual-network overlay a la Nicira, could we deal with the fact that such a network can’t impact network performance (since it’s built transparently over the network and not by or in it) through telemetry?  No.  In fact, since a network is a black box to an overlay protocol, we can’t even associate telemetry we might receive with any element of that virtual network.  Much less do anything if we could in fact figure out what we were measuring.  So what this means is that the craze to find out what’s happening in the network has to feed something below “the cloud”, meaning it has to feed an SDN/NFV initiative simply because those two things are the strategic initiatives that are recognized by buyers and vendors.  Absent a link to the special context of these things, there’s nothing useful we can do with telemetry that we couldn’t do all along.  If that’s the case, then the current M&A craze is either crowd-following or consolidation.

If all this network monitoring stuff is going to be useful, then it has to either be subsumed into a movement to create a centralized network control process such as that SDN proposes and which at the moment isn’t being developed by any standards process, or it has to be owned by a network equipment vendor—nay, a GIANT with enough market share to be able to actually add value to a lot of networks.  That’s why Cisco’s moves here are important, and why everyone who isn’t Cisco has to appeal to the higher architecture in their positioning, or they’re not justifying strategic value.

Emulex/Endace, and NetScout/OnPath, have so far failed to establish that connection to the higher layer.  They could do that, of course, but I always wonder when somebody does something big and doesn’t give a big reason, whether there’s a justification for holding back.  Maybe they’re just not thinking big?

The fact is that in the cloud, in SDN, in NFV, we’re doing the classical “groping the elephant” thing.  Vendors are grabbing on to something that has a vague connection to a little part of a big story and then claiming the big story as their own.  In my fall survey, both enterprises and service providers were almost unanimous in saying that while they welcomed the concept of SDN and the cloud, they were being presented with pieces of a story that they could still not grasp (or even see) in its glorious whole.  Absent that glorious whole, there’s no big story and there’s no grand cause, and no revolution.  There’s just a mob.

Leave a Reply