Gartner Reprint PDF

28/02/2017 GartnerReprint
(https://www.gartner.com/home) LICENSED FOR

DISTRIBUTION
Magic Quadrant for Network Performance Monitoring and Diagnostics

Published: 21 February 2017 ID: G00301193
Analyst(s): Sanjit Ganguli, Vivek Bhalla
Summary
NPMD solutions are key in helping I&O leaders support more complex technologies and services with network visibility,
performance issue detection and root cause analysis. Vendors are innovating with cloud monitoring, support for
software-dened environments and more exible deployment models.
Market Denition/Description
This document was revised on 23 February 2017. The document you are viewing is the corrected version. For more
information, see the Corrections (http://www.gartner.com/technology/about/policies/current_corrections.jsp) page on
gartner.com.
Network performance monitoring and diagnostics (NPMD) tools allow IT operations to understand the performance of
application, network and infrastructure components via network instrumentation. These tools also provide insight into
the quality of the end-user experience. The goal of NPMD products is not only to monitor the network trafc and
infrastructure to facilitate outage and degradation resolution, but also to identify performance optimization
opportunities. This is conducted via diagnostics, analytics and root cause analysis capabilities to complement
monitoring of today's complex IT environments.
This market is a fast-growing segment of the larger network management space. Gartner estimates the size of the
NPMD tool market at $1.6 billion and growing at a compound annual growth rate (CAGR) of 20.7%, according to
Gartner's "Market Share Analysis: Performance Monitoring, Worldwide, 2015." The NPMD market overlaps slightly with
aspects of the application performance monitoring (APM) space and, to a lesser extent, the IT infrastructure monitoring
(ITIM) market.
This Magic Quadrant research period has seen continued reshufing within the NPMD vendor space, with the
completion of the leveraged buyout of SolarWinds by Silver Lake Partners and Thoma Bravo; the sale of InfoVista by
Thoma Bravo to private equity rm Apax Partners; the spinoff of Streamcore from Automic; the acquisition of Aternity
by Riverbed; and the pending spinoff/merger of HPE Software to U.K.-based software company Micro Focus.
Additionally, this year has seen innovation from network switch vendors, incorporating network analytics directly into
their switch fabric through enhancements in switch chip technology. These vendors include Cisco, with its introduction
of Tetration Analytics, but also Arista Networks, Brocade and Pluribus Networks. Additionally, NPMD vendors have
slowly been waking up to the reality of the cloud, with a few vendors actively investing in lling the visibility gaps left by
cloud migration.
Magic Quadrant
Figure1.MagicQuadrantforNetworkPerformanceMonitoringandDiagnostics
https://www.gartner.com/doc/reprints?id=13TZ0T2T&ct=170221&st=sb 1/32
Source: Gartner (February 2017)
Vendor Strengths and Cautions

AppNeta
Founded in 2011, Boston-based AppNeta focuses on APM; however, much of its intellectual property roots are based on
NPMD technology. AppNeta is back in the NPMD Magic Quadrant this year. AppNeta is focused on easy-to-deploy,
inexpensive SaaS-based solutions. The vendor is a re-entrant to the NPMD Magic Quadrant based on its decision to
reverse its cessation of ow-based data source support that only lasted approximately 12 months, throughout most of
2015.
AppNeta's core NPMD features come from its AppView product (for synthetic application availability monitoring),
enhanced with SaaS-specic monitoring for Amazon Web Services (AWS), Google Compute Engine, Microsoft Azure,
Salesforce, ServiceNow, Ofce 365 and Google Docs, among others. FlowView provides trafc analysis including both
deep packet inspection and ow analysis. The unique component of the offering is PathView, which provides deep path
analysis along with patented capacity measurement based on AppNeta's TruPath technology, an automated diagnostics
engine for fault isolation and root cause determination.
AppNeta has undergone realignment over the past 18 months (as its reinclusion in this Magic Quadrant suggests). In
August 2015, a new CMO was hired, and in April 2016, an agreement was reached with SevOne to resell AppNeta's
PathView technology. In September 2016, AppNeta's TraceView product, which monitors the application layer of web-
based infrastructures, was sold to SolarWinds.
AppNeta's NPMD revenue is between $11 million and $25 million per year.
STRENGTHS
A SaaS-focused model ensures lower operating costs.
The vendor offers high scalability for distributed environments, with up to 7,000 sites supported per client.
AppNeta has convenient unied communications (UC) and voice over IP (VoIP) monitoring without the overhead
normally associated with UC monitoring tools.
CAUTIONS
The vendor has no physical commercial presence beyond North America planned until the rst quarter of 2018.
The lack of 100G network support via physical monitoring point appliances is inhibiting AppNeta's ability to meet end-
user requirements to fulll future demands.
Security and privacy perception issues related to SaaS products persist among risk-averse end users. This is a sales
inhibitor when competing against traditional on-premises-based tools.
CA Technologies
Headquartered in New York City, CA Technologies has an extensive history and product set for NPMD that was built
over many years of acquisitions and organic development. CA has recently hired a new chief product ofcer and a
general manager of its Agile Operations business unit, both of whom are from Cisco, to oversee NPMD product
development.
The CA Technologies' NPMD offering is the organically developed CA Performance Management solution (which
includes Performance Center as its visualization element), and it is complemented by other offerings, including CA
Unied Infrastructure Management (CA UIM), CA Virtual Network Assurance (CA VNA), CA Network Flow Analysis, CA
Unied Communications Monitor, CA Application Delivery Analysis, CA Systems Performance for Infrastructure
Managers (physical systems agents) and CA Virtual Assurance for Infrastructure Managers (virtual systems agents).
CA VNA was released in December 2015, and provides visibility into performance bottlenecks and vulnerabilities in
software-dened networking (SDN) and network function virtualization (NFV) environments.
CA Performance Management forms the basis for the vendor's new network portfolio architecture strategy, which is a
departure from its previous strategy of leveraging CA UIM as its consolidation platform. According to the vendor, this
decision was driven by changing market conditions and customer feedback. CA UIM is being repositioned as the
solution for hybrid cloud, systems and storage monitoring, while CA Performance Management is targeted at network
monitoring, despite some overlapping capabilities.
CA's NPMD revenue is between $100 million and $250 million per year.
STRENGTHS
Positive nancial viability continues to show that there is limited risk to stability in doing business with CA.
Investments in monitoring cloud-based environments have outpaced other NPMD vendors.

Strong geographic diversity in the customer base proves the vendor's ability to support clients globally.
CAUTIONS
CA's NPMD solution is an amalgamation of various product lines from several acquisitions with limited integration,
which introduces some complexity in UI and workows.
Emergence of CA Performance Management as the vendor's NPMD solution has caused confusion as it conicts with
its previous CA UIM strategy, with uncertainty among end users regarding future development plans for either
product.
There has been limited development of ow and packet analysis capabilities, with CA Network Flow Analysis and CA
Application Delivery Analysis receiving little in the way of new features.
Cisco
San Jose-based Cisco, with its network-hardware-centric heritage, enjoys broad name recognition in the NPMD space.
The vendor has enhanced its offerings with the introduction of a scalable data center visibility solution, policy-based
automation and simplied product bundling options.
Cisco's NPMD solutions remain spread across multiple product lines. Its primary NPMD offering remains Prime
Infrastructure, and it is used for SNMP and ow monitoring, conguration management, and provisioning of Cisco
network devices. This is supplemented with Prime Network Analysis Module for packet analysis, and Prime
Collaboration Assurance for UC monitoring. Cisco Nexus Data Broker provides network packet broker (NPB)
functionality.
Cisco's latest offering is Tetration Analytics, a hardware and software agent-based network analytics platform that
leverages onboard switch-chip-based network analytics on its latest Nexus switches to provide scalable data center
visibility. Finally, Cisco offers Application Policy Infrastructure Controller Enterprise Module (APIC-EM), its policy-based
SDN controller providing path analytics along with workow automation capabilities.
The vendor has announced its Cisco One Foundation licensing in WAN, access and data center variants that bundle
various NPMD products into the broader hardware sale motion. This aims to simplify the pricing and licensing options
for its NPMD products, as well as accelerate the sales of its software products.
Cisco's NPMD revenue is between $51 million and $100 million per year.
STRENGTHS
Cisco provides a unique vision for highly scalable network analytics integrated into network hardware with Tetration
Analytics.
Cisco is in an exclusive position to support its pervasive networking installed base, offering in-depth support for Cisco
monitoring technologies.
New bundling of products allows broader availability of NPMD solutions to the vendor's customers.
CAUTIONS
While innovative, Tetration Analytics currently lacks broad market appeal, given its premium pricing, strict deployment
prerequisites, and burdensome hardware and agent requirements.
Gartner continues to observe that Cisco Prime Infrastructure is mostly used as a point solution, often requiring buyers
to purchase other management tools for comprehensive performance monitoring.
End users have cited dissatisfaction with Cisco Prime Infrastructure's product reliability, as well as its integration and
interoperability with third-party solutions.
Corvil
Founded in 2000, Dublin-based Corvil focuses on short-time scale network monitoring, providing comprehensive
multisegment and highly accurate packet analysis. These capabilities have always appealed to the vendor's nancial
services customer base's heritage; however, Corvil continues its transition based on its streaming analytics platform
to deliver machine-time data visibility (see Note) and operational intelligence to a broader target audience.
Product development progressed, with an 80 Gbps 8400 appliance released in July 2016. The August 2016 Tera+
Release delivered adaptive contextual enrichment to raw packet data based on preloaded rules and conditions. This
was coupled with autodiscovery and population of application metrics to an updated user interface that includes
greater drag-and-drop and workow aids than its predecessor. In September 2016, Corvil's VoIP App for Splunk was
released as a free download via Splunkbase.
Aside from product development, a new chief business development ofcer was hired in October 2015 to focus on
growing strategic partnerships and develop Corvil's channel partner program. Early results are the addition of Japanese
channel partner IWI and global service company WWT. Gartner has also observed customers being added to the
installed base in new regions such as Mexico, Colombia and Brazil.
Corvil's NPMD revenue is between $26 million and $50 million per year.
STRENGTHS
Corvil enjoys healthy sales performance and growth, with total revenue growing by 40% year over year.
The machine-time data analytics concept aligns well to end users with Internet of Things (IoT) initiatives.
Corvil's licensing model continues to cause pricing disruption in the market space, with a separation of software
pricing from the underlying hardware.
CAUTIONS
CAUTIONS
Corvil lacks virtual and cloud visibility for those customers that are migrating critical services into virtual
environments.
Conservative organizations may view Corvil's size, compared to larger vendors in this market, as a perceived risk due
to increased exposure to potential acquisition or market volatility.
SNMP and ow-based data source support remain comparatively weak.
ExtraHop
With global headquarters in Seattle, ExtraHop is new to the NPMD Magic Quadrant this year, and focuses on packet
analytics for performance and application insights. Over the last year, ExtraHop has doubled its head count and made
several key additions to the senior leadership team. This included a new CEO, who previously served as the president of
Fluke Networks. This year has also seen the departure of ExtraHop's senior VP of sales and the senior VP of marketing
and business development.
The vendor's solution consists of ExtraHop Discover Appliance, which provides real-time analysis on network data;
ExtraHop Explore Appliance, which provides indexing and storage of transaction records; ExtraHop Trace Appliance,
which provides continuous packet capture; and ExtraHop Command Appliance, which provides centralized
management. To achieve end-to-end workows that are common to NPMD, a combination of the Discover, Explore and
Trace Appliances must be deployed.
ExtraHop's recent focus has been on expanding supported data streams, which now include NetFlow and continuous
packet capture. ExtraHop has combined these new data streams into end-to-end troubleshooting workows, although
there is limited customer feedback on this, given the recent release of these new features. The vendor's solutions also
have integration with various IT operations management (ITOM) tool vendors, and it promotes its solutions as part of an
ecosystem of other best-of-breed products. ExtraHop has also invested in looking beyond the data center, investing in
cloud, IoT and virtual network monitoring.
ExtraHop's NPMD revenue is between $50 million and $100 million per year.
STRENGTHS
ExtraHop provides network-derived business intelligence data, allowing IT operations users to move closer to the
lines of business, with strong application visibility.
ExtraHop was an early pioneer among NPMD vendors to offer a monitoring solution for infrastructure as a service
(IaaS) environments like AWS and Azure.
The vendor is aggressively investing in marketing and expanding sales operations beyond its current North American
base, primarily in the Asia/Pacic region.
CAUTIONS
ExtraHop's products often appeal to buyers as a complementary solution to NPMD, as opposed to a core NPMD
offering.
The vendor provides a limited view of infrastructure health, compared to its NPMD competition.
ExtraHop's ability to derive and use application context from network data should not be confused with full
application performance monitoring (APM) capabilities.
Flowmon Networks
Flowmon Networks, based in the Czech Republic, specializes in scalable ow-based monitoring to meet NPMD and
network behavior analysis (NBA) disciplines. The vendor has been 100% self-funded, and has grown through sales of its
NPMD and NBA products. While ow-based monitoring is the focus, packet capture (via Flowmon Trafc Recorder) and
the Flowmon Application Performance Monitor component also contribute to Flowmon's NPMD capabilities.
The vendor augmented its existing agentless monitoring capabilities for HTTP and HTTPS trafc with the acquisition of
FerretApps in March 2016. New integrations with network tap manufacturer Garland Technology in June and IBM's
QRadar in October broadened its technology partnership program.
Flowmon Networks' plans to expand to new geographies have also seen new value-added reseller (VAR) partnerships
struck in June 2016, with Ingecom to cover Portugal and Spain, and Gintel to support Latin America, the Caribbean and
Florida. Concurrently, a new business development manager was appointed for the U.K. and Ireland region. Product
development has continued with a new version of Flowmon released in May 2016, providing proling of ow data with
30-second granularity to help reduce reaction times to service-affecting incidents. Triggered packet capture and a
mobile app for iOS and Android devices were also among the new features included.
Flowmon Networks' NPMD revenue is between $7.5 million and $10 million per year.
STRENGTHS
There is an aggressive product roadmap, with ow generation from PCAP, extended visibility into application layer
protocols and OpenStack virtualization support all anticipated before the fourth quarter of 2017.
Flowmon Networks is competitively priced, with cloud and virtual appliance options that would appeal to smaller and
midsize organizations with ow-based monitoring requirements.
Flowmon Networks is highly scalable, with the ability to support 100G environments and 250,000 ows per second
per appliance.
CAUTIONS
North American, Latin American and Asia/Pacic region end users should ensure that local resources are adequate
for their needs.
Despite continual improvements, the user interface remains below par compared to leading NPMD vendors, based on
Gartner's analysis.
Security operations features and capabilities dilute the focus of Flowmon's R&D on purely NPMD use cases and
scenarios.
Genie Networks
Genie Networks targets its solutions to the communications service provider (CSP) industry. Based in Taiwan, the
vendor's strategy is to provide scalable, yet competitively priced, solutions.
Building from a competency in traditional SNMP-based network fault and performance monitoring capabilities, Genie
Networks also incorporates deep packet inspection and ow analysis into its current offerings, GenieATM 6300 and
GenieATM VM Software Version. The vendor states that a single instance of the product supports up to 110,000 ows
per second, and up to 100 routers and/or switches. It also provides combined trafc analysis with policy conguration
for SDN environments.
Throughout 2016, Genie Networks has increasingly been positioned and deployed to address security operations use
cases and scenarios, primarily distributed denial of service (DDoS) attack mitigation and protection. The vendor has
also gained traction beyond its traditional China installed base, with new customers being won throughout 2016 in
Japan, Saudi Arabia and, most signicantly, the Netherlands.
Genie Networks did not respond to requests for supplemental information and/or to review the draft contents of this
document. Gartner's analysis for this vendor is therefore based on other credible sources, including previous vendor
briengs and interactions, the vendor's own marketing collateral, public information, and discussions with end users.
Genie Networks' NPMD revenue is between $11 million and $20 million per year.
STRENGTHS
Genie Networks has an improved presence in and focus toward EMEA.
The vendor offers attractive pricing, balanced with an aim to deliver carrier-grade scalability.
Appliance and virtual machine (VM)-based options offer customers multiple form factors.
CAUTIONS
The vendor's prole remains low, particularly from a marketing perspective, which limits lead generation
opportunities.
Positioning and messaging have shifted almost exclusively to security operations use cases and scenarios.
Genie Networks' focus on IT and network operations product features appears to have stagnated in favor of security
operations functionality.
HPE
One of the rst vendors to offer enterprise network monitoring tools, Hewlett Packard Enterprise (HPE; spun off from
HP Inc. in November 2015) has a long history of investment in the NPMD market. Based in Palo Alto, California, HPE
has a substantial portfolio and customer base, with thousands of installations worldwide.
HPE's NPMD solution is composed of Network Node Manager i (NNMi) and HPE Real User Monitoring (RUM). NNMi
provides a consolidated view of fault and performance data, while RUM monitors actual user interaction with a website
or application from client desktops and mobile devices.
In September 2016, HPE announced a spin-off/merger of its software business with U.K. rm Micro Focus as part of an
$8.8 billion deal. This came off the back of previous restructuring following the split of HPE from HP Inc. End users
report that implementation, training and professional services account for a greater proportion of total HPE NPMD
deployment costs than observed by Gartner for other vendors.
HPE's latest releases in July 2016 included updated support for Cisco Unied Communications Manager (UCM),
Common Criteria and FIPS140-2 encryption compliance, an Elastic Docker monitor, and a new HTML5-based
application health dashboard. Among other features, VXLAN support and a number of OpenStack integrations and plug-
ins are planned for 2017.
HPE's NPMD revenue is between $101 million and $250 million per year.
STRENGTHS
HPE has a broad portfolio of complementary availability and performance monitoring products, with integration with
products such as HPE Network Automation.
HPE's product roadmap cites the utilization of operations analytics. Execution against this roadmap will be key.
HPE Professional Services has a global presence, with a strong reputation for implementing and maintaining its
clients' solutions. (Note that HPE has announced the sale of its Enterprise Services segment to CSC, expected to
close in April 2017.)
CAUTIONS
With ongoing organizational changes, customers continue to express concern over HPE's direction and vision in the
NPMD space.
Execution against the roadmap is questionable, given that aims of monitoring converged infrastructure, SDN and NFV
frameworks have been deprioritized compared to previous plans.
Current messaging and product positioning fail to resonate with midmarket organizations.
InfoVista
With worldwide headquarters in France, InfoVista is a CSP and large-enterprise-focused NPMD provider, and is owned
by private equity rm Apax Partners. InfoVista's offerings span NPMD, wireless network design and planning, and
mobile network optimization.
Product offerings focused on NPMD include VistaInsight for Networks, which includes the Vista360 UI for visualization
across the interrelated components of the suite. Those components are 5View Service Data Manager for data
aggregation and analysis of the raw metric data, which feeds up to VistaInsight for Networks; 5View NetFlow
appliances for ow collection; and 5View Applications appliances, which provide deep packet inspection capabilities.
The nal module is 5View Mediation, which collects data from appliances doing packet and ow analysis for long-term,
analytical reporting purposes.
In March 2016, 5View Applications added new support for discovery of cloud and SSL-based applications, and VXLAN,
among other features. InfoVista then experienced a change of ownership as Thoma Bravo sold the company to Apax
Partners in May 2016. In October 2016, InfoVista acquired Ascom's mobile operator-oriented testing and optimization
TEMS business. In November 2016, InfoVista launched IpanemaGO, a cloud-based SD-WAN solution. Although the
solution is adjacent to NPMD itself, this will lower barriers of adoption for enterprises looking to SD-WAN as a means to
improve and protect the performance of applications on a per-session and per-user basis. 40G and 100G support is
cited by 3Q17.
InfoVista has also overhauled its Global Channel Program, focusing it around the delivery of its new SD-WAN solution,
including a partnership with ZTEsoft for the China region. Relationships with Ipanema-acquired channel partners
Orange Business Services and BT have also been developed further, with a "sell to, sell through" strategy having been
developed with both organizations.
InfoVista's NPMD revenue is between $26 million and $50 million per year.
STRENGTHS
End users recognize InfoVista's strong product roadmap and vision.
VistaInsight and the 5View suite are multitenant, carrier-grade solutions optimized to meet the specic requirements
of CSPs.
Extensibility of the InfoVista solution allows it to meet sophisticated use cases that many other vendors cannot meet.
CAUTIONS
2016 SDN and NFV API-related features have been deferred until mid-2017.
End users continue to report higher-than-average implementation and maintenance costs.
Extended service engagements are common to meet specic requirements of target service provider customers.
Ipswitch
Ipswitch, based in Lexington, Massachusetts, has been in the infrastructure monitoring arena since 1991 and makes its
debut in the NPMD Magic Quadrant. Ipswitch supports a large client base with its product WhatsUp Gold, which is
offered as BasicView, ProView, TotalView or TotalView Plus, reecting different assortments of modules. These
modules include Wireless Monitoring, Virtual Monitoring, Application Monitoring, Network Trafc Analysis and
Conguration Management.
The product provides a simple and easy-to-use networking monitoring solution, combining both SNMP-based
infrastructure health and availability monitoring with import of ow records. Packet data is handled via a packet to ow
converter agent called Flow Publisher. Ipswitch's plans for WhatsUp Gold include support for monitoring cloud IaaS
environments and increased support for storage and wireless LAN infrastructures.
Ipswitch sells in North America entirely through direct sales, and through partners in other regions. It has recently
opened a center of excellence in Ireland to lead expansion in EMEA. Expansion plans include additional partnerships
with system integrators, as well as managed service providers (MSPs) that use WhatsUp Gold to provide IT monitoring
services to their end customers. Notable MSPs using Ipswitch include Dimension Data, Cable & Wireless
Communications and NTT Communications.
Ipswitch's NPMD revenue is between $26 million and $50 million per year.
STRENGTHS
Ipswitch offers a low-cost and easy-to-license NPMD solution.
The vendor's low-friction sales model, with a "try and buy" option, has shown success in growing its customer base,
focused on SMBs.
Network topology visualization is intuitive and easily navigable, with a useful path tracing capability.
CAUTIONS
There is limited packet support, application visibility and drill-downs for troubleshooting.
Scalability and granularity of data is below the level of leading NPMD solutions.
Despite its many years in the market, Ipswitch suffers from less market awareness when compared to similar NPMD
vendors.
LiveAction
LiveAction is a privately owned company founded in 2007, based in Palo Alto, California, and is new to the NPMD Magic
Quadrant this year. Its LiveNX product is focused on visibility and analytics to help simplify network management.
LiveUX is a complementary product to LiveNX, delivering end-user experience monitoring. For non-Cisco environments,
LiveAction uses its nProbe component for packet inspection and performance metrics collection.
The vendor's product development cadence has been healthy for the past 18 months. March 2015 brought a new virtual
appliance option, while reporting features to aid capacity planning tasks were also added. In November 2015, a new
HTML5-based interface was launched. Support was expanded to Cisco's Nexus 9000 series routers and QoS
conguration support was provided for Cisco Catalyst 3850 and 4500 devices. A free SaaS version of LiveUX,
monitoring availability and performance of web-based applications, was also made available during the same month. In
June 2016, SD-WAN visibility was delivered. Path changes are compared to precongured thresholds and validated
against policies to ensure that application performance over SD-WAN is maintained. Support for private and public
cloud, including AWS, Azure, Apache CloudStack and Rackspace, was also added in June 2016. Further site-to-site
analysis to aid capacity and resource planning was added in October 2016.
LiveAction raised $36 million in Series B funding in March 2016 to expand operations globally and accelerate product
development. Cisco Investments was one of the funding partners. LiveAction shares a close relationship with Cisco as
a SolutionsPlus partner, with the networking vendor including LiveNX on its global price list. Under this agreement,
Cisco resells LiveNX and provides training to end customers and partners, while also aiding marketing efforts. A reseller
agreement also is in place with Japan-based network conguration and change management (NCCM) vendor
LogicVein, which is the primary route to market for this region. The overall primary route to market for LiveAction is
through channel sales.
LiveAction's NPMD revenue is between $11 million and $25 million per year.
STRENGTHS
LiveAction customers report high satisfaction in terms of value, service and support offered.
The vendor has had strong growth over the last two years with a signicant ramp-up of customers and the total
installed base, partially driven by Cisco channel sales.
Unique SD-WAN trafc steering capabilities are coupled with overlay views of ows and control plane data to deliver
compelling visualization of network topologies, aiding troubleshooting and problem diagnosis.
CAUTIONS
LiveAction's in-house resources are almost exclusively focused on the North American region. Customers from other
regions should ensure the reseller resources made available are adequate and sufciently skilled to provide ongoing
support.
Heavy focus toward supporting Cisco infrastructure may inhibit opportunities where there is a requirement to manage
a more heterogeneous environment.
LiveNX is an on-premises-focused product and lacks a cloud-hosted deployment option.
NetScout
NetScout, based in Westford, Massachusetts, has the largest market share in the NPMD space, and boasts a large and
loyal customer base. NetScout's customers span the large enterprise, service provider and public-sector industry
verticals. In 2015, NetScout acquired parts of NPMD vendor Fluke Networks, along with several other assets, including
Tektronix Communications and VSS Monitoring.
NetScout's NPMD solution consists of nGeniusONE platform, Innistream platform and UC Performance Management.
These solutions are sold alongside various analysis modules, which can include NPBs or security analytics. NetScout
continues to list Fluke Networks' assets as products, including OptiView XG (handheld network diagnostics), AirMagnet
(wireless LAN planning and monitoring) and TruView. NetScout has announced that it is relaunching Fluke's TruView
Live as nGeniusPULSE, for synthetic-based monitoring of cloud environments.
NetScout has announced plans to invest in a dual strategy to introduce next-generation instrumentation coupled with
superior analytics. As part of this strategy, the vendor introduced InniStreamNG, with support for 40G and 100G line
rates, and offers a real-time analytics platform to take advantage of the packet data it is collecting. NetScout also
announced the release of nGenius for Flows, which brings its ow monitoring capability closer in line with competitors.
NetScout did not respond to requests for supplemental information and/or engage in Gartner's standard procedures to
address the contents of this document. Gartner's analysis for this vendor is therefore based on other credible sources,
including previous vendor briengs and interactions, the vendor's own marketing collateral, public information, and
discussions with end users that either have evaluated or deployed each NPMD product. NetScout has sued Gartner over
the content of the 2014 NPMD Magic Quadrant, and that lawsuit is pending.
NetScout's NPMD revenue is between $500 million and $750 million per year. This reects combined revenue from
NetScout and the acquired Danaher assets, including parts of Fluke Networks, VSS Monitoring and Tektronix
Communications.
STRENGTHS
NetScout's plans to develop nGeniusPULSE are an important initiative to ll network visibility gaps left by cloud
migrations.
NetScout's AirMagnet is a strong offering for the growing need for wireless LAN network monitoring and
troubleshooting.
NetScout's outward marketing has improved, with an overhaul of its website and an improved presence on social
media.
CAUTIONS
CAUTIONS
Gartner has observed end-user confusion (through client inquiries and one-on-one meetings at Gartner events)
regarding NetScout's future plans for the Fluke Visual TruView product line.
Cost-conscious NPMD buyers should be aware that NetScout continues to be described as a premium-priced solution
by end users that interact with Gartner (for example, in client inquiries and one-on-one meetings at Gartner events).
NetScout's ability to derive and use application context from network data should not be confused with APM
capabilities.
Paessler
Based in Nuremberg, Germany, Paessler focuses on infrastructure monitoring software to meet the needs of the
midmarket and SMBs through its unied PRTG Network Monitor offering. The solution covers monitoring of network
elements for fault, ow analysis and packet snifng in a single, simple solution. Additionally, the product supports
health monitoring of application instances, servers and virtual environments.
The vendor continues to prioritize simplied ease of use and transparent licensing. Paessler continues to release a
steady stream of new sensors at a regular cadence. In December 2015, cloud sensors were made available to monitor
Google Analytics, Google Drive, Microsoft OneDrive and Dropbox. January 2016 witnessed the delivery of a Business
Process Sensor that allows users to monitor the health of end-to-end business processes (or services) such as
websites, email and other business functions. A sensor to monitor Docker containers was made available in March
2016.
Aside from product development, Paessler has expanded its presence outside of its home EMEA geography. In August
2015, it revamped its partner program and this is starting to pay dividends, with the vendor reporting an increase of 36%
channel sales worldwide and the U.S. being the largest market. In May 2016, two senior sales managers were appointed
to cover the Australia and New Zealand (ANZ) and Asia/Pacic regions, respectively. In August 2016, North American
head count was increased by 50% to support the increase in sales. In October 2016, Paessler announced its rst
training partner for the Asia/Pacic region, based in Australia.
Paessler's NPMD revenue is between $26 million and $50 million per year.
STRENGTHS
Paessler's customers report high satisfaction in terms of value, service and support offered.
The vendor has had strong growth over the last two years with a signicant ramp-up of customers and the total
installed base.
Paessler's rapid development stream means that new and updated sensors are released frequently on a quarterly
basis.
CAUTIONS
Paessler targets midmarket enterprises and SMBs, limiting its ability to meet specic large-enterprise scaling
requirements.
The vendor does not currently offer its solution as a hosted service, a deployment option that may appeal to some of
its target market.
The packet sniffer and ow modules have limited capabilities, including an inability to save data to disk for historical
analysis.
Riverbed
Riverbed, headquartered in San Francisco, has assembled a broad set of NPMD capabilities through acquisition,
alongside its core WAN acceleration business and a newly formed SD-WAN offering. This has been augmented by
Riverbed's recent acquisition of Aternity to add an endpoint monitoring capability.
The suite, branded as SteelCentral Network Performance Management (NPM), includes several appliance lines and
software components that support network data collection, storage and analytics. SteelCentral NPM is headlined by
NetProler for ow analysis and AppResponse for packet analysis. These capabilities are supplemented by SteelCentral
Packet Analyzer Plus, Transaction Analyzer, NetSensor and UCExpert, which provides additional capability for packet
trace analysis, infrastructure monitoring and UC monitoring. Rounding out Riverbed's offering is SteelCentral Portal,
which provides a common visualization and analytics framework for the entire SteelCentral line, and SteelCentral
Aternity, a new agent-based endpoint monitoring capability.
In its latest release, Riverbed has brought further integration between its NPMD capabilities and its APM products, with
integrated network and application workows. The NetShark appliance, which was part of the SteelCentral NPM suite,
has been integrated into the AppResponse appliance, with now only a single packet collection appliance. Riverbed also
acquired Ocedo to enter the growing SD-WAN market, with a product called SteelConnect, and integration of
SteelCentral visibility with SteelConnect automation is expected.
Riverbed's NPMD revenue is between $100 million and $250 million per year.
STRENGTHS
The planned integration of SteelCentral and SteelConnect presents unique intent-based networking opportunities
coupling deep visibility with network control.
Riverbed's integration of AppResponse and NetShark, and dropping of the NetShark brand, represents a much needed
rationalization of the vendor's product suite.
Further SteelCentral integration and simplication will allow Riverbed to better leverage its strong partner and
distribution network to the benet of its customers.
CAUTIONS
The vendor's focus on improvements in suite integration and rationalization limits the introduction of innovative new
features.
Endpoint agent-based user experience monitoring, such as SteelCentral Aternity, may provide limited value to
network-focused NPMD buyers.
Despite more focus on its social media and marketing presence, Riverbed still has a gap in distinguishing its brand
outside of its WAN optimization roots.
SevOne
Headquartered in Boston, Massachusetts, SevOne focuses on infrastructure monitoring, complemented with
capabilities for ow and log monitoring. SevOne markets primarily to the large enterprise and service provider markets,
based on its scalability and a exible distributed architecture. The vendor had been increasing its head count since last
year, but signicant layoffs were publicly reported in August 2016, in addition to the resignation of SevOne's two
founders.
The vendor's NPMD solution consists of SevOne Performance Appliance Solution (PAS), Dedicated NetFlow Collector
(DNC), Performance Log Appliance (PLA) and the newly introduced End User Experience Appliance (EUE), the latter
through an OEM arrangement with AppNeta. EUE is offered as a SaaS capability.
SevOne has updated its offering with live maps, and support for infrastructure orchestration solutions, SD-WAN, hybrid
cloud and carrier network virtualization. Improvements have been made to log integration with standard SevOne
workows, but these log monitoring capabilities should not be confused with pure-play log monitoring vendors. SevOne
has also embarked on signicant updates to its user interface, as well as more exible deployment options for public
and private cloud infrastructures. The vendor announced a new program called SevOne Ready Alliance in July 2016 to
foster both integrations and go-to-market strategies.
SevOne's NPMD revenue is between $51 million and $100 million per year.
STRENGTHS
SevOne is the rst to integrate metric, ow, logs and synthetic end-user experience data into an enterprise-class,
carrier-grade platform, with one-second polling granularity.
SevOne is building a strong platform story with partnership announcements with innovative players in the SD-WAN
and storage space.
xStats adapters that are highly customizable and have very broad support continue to be a competitive differentiator
for clients looking for broad support of unique systems.
CAUTIONS
SevOne is very focused as an ITIM tool, with drill-downs into ow or log data, but is missing many of the capabilities
of NPMD leaders, derived from more holistic network performance monitoring based on packet data.
SevOne's continued focus is on large enterprises (primarily in the nancial services and technology sectors) and
CSPs, putting its solution out of reach of the broader NPMD buying market.
Given the recent reorganization and strategic changes, buyers should scrutinize product deliverables and roadmaps
to ensure that they meet requirements.
SolarWinds
SolarWinds, based in Austin, Texas, has a very large network management installed base and wide name recognition,
with a focus on infrastructure monitoring for small and midmarket enterprises. SolarWinds offers a low-cost and simple
solution that appeals to many IT organizations, but increasingly complex environments and problems often force users
to supplement with more sophisticated solutions. SolarWinds has hired the former general manager of HPE's ITOM
division to be its new executive VP of product.
SolarWinds' NPMD solution consists of SolarWinds Network Performance Monitor and NetFlow Trafc Analyzer (NTA).
The former is primarily an infrastructure monitoring platform, supplemented by ow data from NTA. SolarWinds
leverages its Quality of Experience (QoE) software agents for packet monitoring. The vendor offers a variety of
additional capabilities around conguration management, topology mapping and application monitoring that provide a
loosely integrated solution suite.
SolarWinds' new capabilities include NetPath, which delivers path discovery and analysis across hybrid IT
environments, and support for modern network appliances like load balancers, rewalls and web proxies. SolarWinds
also relies on an inside sales model only that focuses on digital marketing, and offers no professional services.
SolarWinds was acquired in a leveraged buyout by Silver Lake Partners and Thoma Bravo. Customers are encouraged to
do appropriate due diligence whenever a change of ownership occurs.
SolarWinds' NPMD revenue is between $250 million and $500 million per year.
STRENGTHS
SolarWinds' set of tools beyond NPMD provides useful complementary capabilities, including topology mapping and
network conguration management, and newly added APM capabilities.
SolarWinds boasts a large, active and passionate user community called Thwack.
The new release of NetPath provides visibility into path analytics and cloud visibility.
CAUTIONS
The vendor has a limited focus on introducing cutting-edge new features, specically in the area of network forensics.
While the vendor offers basic packet monitoring through its QoE agents, this feature is not used or known by much of
its customer base, nor has it seen signicant investment from SolarWinds.
SolarWinds' solutions are software-only, which can limit scalability when compared with hardware-based solutions.
Viavi
Viavi is based in Milpitas, California, and formerly known as JDSU. Its acquisition of Network Instruments brought its
NPMD solution onboard. Viavi has a long history in network performance monitoring. In the last year, the vendor hired
several industry veterans to lead its Enterprise and Cloud Business Unit, including a former executive from NetScout
and Fluke Networks.
The current Viavi NPMD solution set consists of the Observer Performance Management Platform, which includes
Observer Apex, Observer Analyzer, Observer Management Server, Observer GigaStor and Observer Probes. New to the
portfolio is Observer SightOps, which is an OEM arrangement with ScienceLogic that replaces Observer Infrastructure,
and is aimed at extending Viavi's monitoring reach into cloud and hybrid environments.
The Viavi performance management platform remains a technically comprehensive, packet-based NPMD tool.
Deployment options have improved with the delivery of a virtual appliance of GigaStor Software Edition that supports up
to 8TB of storage and provides visibility into east-west trafc. In addition, Viavi has introduced an integration with Cisco
FirePOWER to address an integrated security workow through GigaStor packet extraction.
Viavi is investing in bringing a self-service SaaS-based service assurance and troubleshooting delivery platform to
market in mid-2017. It has also introduced a new three-tier Velocity Channel Program late last year, including several
online tools to help enable partners.
Viavi's NPMD revenue is between $100 million and $250 million per year.
STRENGTHS
Packet capture and inspection (via GigaStor) capability continues to be well-regarded by Viavi clients, with in-house-
designed packet capture hardware.
Observer SightOps uniquely addresses the visibility challenges created by hybrid IT, by combining cloud infrastructure
monitoring with NPMD workows.
Viavi has restructured pricing for GigaStor to better serve the midmarket.
CAUTIONS
Viavi suffers from poor name recognition among the NPMD customer base, having gone through two name changes
over the last few years.
Viavi's primary corporate focus in the service provider vertical contrasts with Observer's enterprise user base, and
must continue to be aligned to nd synergies across these business units.
Support for ow monitoring is limited compared to the competition.
Vendors Added and Dropped

We review and adjust our inclusion criteria for Magic Quadrants as markets change. As a result of these adjustments,
the mix of vendors in any Magic Quadrant may change over time. A vendor's appearance in a Magic Quadrant one year
and not the next does not necessarily indicate that we have changed our opinion of that vendor. It may be a reection of
a change in the market and, therefore, changed evaluation criteria, or of a change of focus by that vendor.
Added
AppNeta
ExtraHop
Ipswitch
LiveAction
Dropped
Automic Spun off NPMD solution, called Streamcore, which didn't meet minimum revenue requirement for
inclusion.
Niksun Focus is on security workows.
Inclusion and Exclusion Criteria

Product-Related Criteria
Vendors are required to meet the following criteria to be considered for the 2017 NPMD Magic Quadrant and Critical
Capabilities research:
The ability to monitor, diagnose and generate alerts for:
Network endpoints Servers, virtual machines, storage systems or anything with an IP address by measuring
these components directly, in combination with a network perspective. This includes cloud-hosted and wireless
endpoints.
Network components Routers, switches and other network devices. This includes SDN and NFV components.
Network links Connectivity between network-attached infrastructure.
The ability to monitor, diagnose and generate alerts for dynamic end-to-end network service delivery as it relates to:
End-user experience The capture of data about how end-to-end application availability, latency and quality appear
to the end user from a network perspective. This is limited to network trafc visibility and not within components,
such as what application performance monitoring is able to accomplish.
Business service delivery The speed and overall quality of network service and/or application delivery to the user
in support of key business activities, as dened by the operator of the NPMD product. These denitions may
overlap as services and applications are recombined into new applications.
Infrastructure component interactions The focus on infrastructure components as they interact via the network,
as well as the network delivery of services or applications.
Support for analysis of:
Real-time performance and behaviors Essential for troubleshooting in the current state of the environment.
Analysis of data must be done within three minutes under normal network loads and conditions.
Historical performance and behaviors To help understand what occurred or what is trending over time.
Predictive behaviors by leveraging algorithmic IT operations (AIOps) technologies The ability to distill and create
actionable advice from the large dataset collected across the various data sources.
Leverage the following data sources:

Network-device-generated trafc data, including ow-based data sources inclusive of NetFlow and IPFIX.
Network-device-generated health data.
Network packet analysis to identify application types and performance characteristics.
The ability to support the following scalability and performance requirements:

Real-time monitoring of 10 Gigabit Ethernet networks at full line rate.
Ingesting of sampled ow records at a rate of 75,000 ows per second via a single instance of the product.
Non-Product-Related Criteria
Total NPMD product revenue (including new licenses, updates, maintenance, subscriptions, SaaS, hosting and
technical support) must have exceeded $7.5 million for 3Q15 through 2Q16, excluding revenue derived from security-
related buying centers.
The vendor must have at least 75 customers that use its NPMD product actively in a production environment.
The vendor must have at least 10 customers located in at least two of the following geographic locations: North
America, Latin America, EMEA and/or APAC that use its NPMD product actively in a production environment.
Honorable Mentions
The following sample vendors were unable to meet the inclusion criteria to be included in this research, but do come up
in NPMD-related inquiries:
Dynatrace
Pluribus Networks
Empirix
Extreme Networks
FixStream
Kentik
Netis (Crossow)
Nyansa
Performance Vision
ThousandEyes
Splunk
Statseeker
Evaluation Criteria
Ability to Execute
Product or Service: Gartner makes judgments from a variety of inputs to evaluate the capabilities, quality, usability,
integration and feature set of the solution, including the following functions:
Data source support, including application visibility
Algorithmic IT operations analytics
Diagnostic workows
Real-time monitoring
Day-to-day maintenance and management of the product

Ease and simplicity of deployment and conguration

Ease of use and richness of functions within the product
Product deployment options and usability
Overall Viability: We consider the vendor's company size, market share and nancial performance (such as revenue
growth and protability). We also investigate any investments and ownership, and any other data related to the health
of the corporate entity. Our analysis reects the vendor's capability to ensure the continued vitality of its NPMD
offering.
Sales Execution/Pricing: We evaluate the vendor's capability to provide global sales support that aligns with its
marketing messages; its market presence in terms of installed base, new customers and partnerships; and exibility
and pricing within licensing model options, including packaging.
Market Responsiveness/Record: We evaluate the execution in delivering and upgrading products consistently, in a
timely fashion, and meeting roadmap timelines. We also evaluate the vendor's agility in terms of meeting new market
demands, and how well the vendor receives customer feedback and quickly builds it into the product.
Marketing Execution: This is a measure of brand and mind share through client, reference and channel partner
feedback. We evaluate the degree to which customers and partners have positive identication with the product, and
whether the vendor has credibility in this market.
Customer Experience: We evaluate the vendor's reputation in the market, based on customers' feedback regarding
their experiences working with the vendor, whether they were glad they chose the vendor's product and whether they
planned to continue working with the vendor. Additionally, we look at the various ways in which the vendor can be
engaged, including social media, message boards and other support avenues.
Operations: We evaluate the ability of the organization to meet goals and commitments. Factors include quality of the
organizational structure, skills, experiences, programs, systems and other vehicles that enable the organization to
operate effectively and efciently.
Table 1. Ability to Execute Evaluation Criteria
Evaluation Criteria Weighting
Product or Service High
Overall Viability High
Sales Execution/Pricing Medium
Market Responsiveness/Record High
Marketing Execution Medium
Customer Experience High
Operations Not Rated
Completeness of Vision
Market Understanding: This criterion evaluates vendor capabilities against future market requirements. The market
requirements map to the Market Overview discussion and look for the following functionality:
Data source support, including application visibility
Algorithmic IT operations analytics

Diagnostic workows
Real-time monitoring
Virtualization (NFV and SDN)
Hybrid IT support
Marketing Strategy: We evaluate the vendor's capability to deliver a clear and differentiated message that maps to
current and future market demands, and, most importantly, the vendor's marketing effectiveness to the NPMD market
through its website, advertising programs, social media, collaborative message boards, tradeshows, training and
positioning statements.
Sales Strategy: We evaluate the vendor's approach to selling NPMD in the appropriate distribution channels, including
channel sales, inside sales and outside sales.
Offering (Product) Strategy: We evaluate product scalability, usability, functionality and delivery model innovation. We
also evaluate the innovation related to the delivery of products and services.
Business Model: This is our evaluation of whether the vendor continuously manages a well-balanced business case
that demonstrates appropriate funding and alignment of stafng resources to succeed in this market. Delivery
methods will also be evaluated as business model decisions, including the strength and coherence of on-premises
and SaaS solutions.
Vertical/Industry Strategy: We evaluate the targeted approaches in marketing and selling into specic vertical
industries.
Innovation: This criterion includes product leadership and the ability to deliver NPMD features and functions that
distinguish the vendor from its competitors. Specic considerations include resources available for R&D and the
innovation process.
Geographic Strategy: This is our evaluation of the vendor's ability to meet the sales and support requirements of IT
organizations worldwide. In this way, we assess the vendor's strategy to penetrate emerging markets.
Table 2. Completeness of Vision Evaluation Criteria

Evaluation Criteria Weighting
Market Understanding High
Marketing Strategy Medium
Sales Strategy Medium
Offering (Product) Strategy High
Business Model Low
Vertical/Industry Strategy Low
Innovation High
Geographic Strategy Low
Quadrant Descriptions
Leaders
The Leaders quadrant represents those vendors that are pushing the NPMD market forward, including those with
comprehensive portfolios and the ability to handle broad sets of data inputs and analytics techniques. They offer a
choice of hardware or software appliances for optimum exibility, while making formerly premium-priced NPMD
solutions attainable to the broader market. All Leaders offer a high degree of application-aware insight and visibility,
along with advanced troubleshooting and diagnostics workows.
Challengers
Challengers consist of those vendors with high market reach and large deployments. Stalwarts in the network
performance monitoring and diagnostics market, they are currently striving to deal with new technical demands and
rising expectations. These established NPMD vendors generally bring a substantial installed base, but also
architectures, feature sets and pricing structures that require modernization (often in progress) to better compete with
those in the Leaders quadrant.
Visionaries
Visionaries have built a compelling plan to competitively address current and future NPMD customer demands. The
Visionaries are combining elements of AIOps and NPMD in ways that provide deeper visibility than is currently available
from other vendors. Presently, execution is limited either by insufcient market reach, or by the extent of existing tools
and technology capabilities that are not initially designed, or able, to meet these needs.
Niche Players
Niche Players are those vendors with solutions catering to specic audiences or with limited use-case support today.
They have often been unable to address the needs of larger enterprises, or have only done so within specic verticals or
market segments. Each of these vendors is working to appeal to the broader NPMD buying community, versus the
targeted use cases they serve today. With the right changes to their product plans, positioning and/or business
execution strategies, any of these vendors could successfully shift their differentiated technologies to address use
cases in ways that today's Leaders might have a hard time matching.
Context
NPMD solutions should be considered as part of an overall network management initiative included in a larger
availability and performance monitoring strategy. Utilizing these additional points of reference will yield further unique
criteria (such as existing investments, investment plans and vendor relationships) that, when combined with Gartner
analysis, can prove critical to proper solution selection.
In the course of this research, several key observations emerged that should be carefully considered during NPMD
strategy formulation and solution selection, including:
The end-user survey showed an increase in the percentage of respondents leveraging packet data for network
analytics.
When asked to name other vendors considered in NPMD buying decisions, end users from the survey listed the
following vendors most often: SolarWinds, NetScout, Cisco and CA.
A larger-than-usual number of network monitoring industry veterans have left their positions to join other NPMD
vendors, as compared to previous years.
Industry consolidation through acquisition and activist investors has led to changes of ownership affecting several
NPMD vendors.
Normalization of UI and workows across several vendors' toolsets has shown some progress, but much work must
still be done.
Ease of use remains an area that needs improvement, and it varies signicantly both across vendors and within
solutions.
Support for monitoring cloud and hybrid IT environments remains limited; however, slow progress is being made.
Increasingly, vendors are expanding support for nontraditional NPMD data sources like API and log data into their
NPMD workows.
Path analytics, as part of a cloud monitoring strategy, has seen some investment from NPMD vendors.
Vendors have increasingly begun to leverage big data back ends or have built operational analytics overlays to
facilitate data analytics across all captured data.
There is increasing synergy between IT operations and security operations using NPMD data for both performance
and security analytics.
Support for monitoring SDN environments is limited in most NPMD solutions, but many NPMD vendors now offer
virtual instances of their products for instantiation in an SDN environment.
NPMD solutions have a primary data source (SNMP, ow or packet), and have a difcult time leveraging the benets
of each data source for the maximum value to the user.
Pricing and product/capability packaging vary signicantly across vendors.
On-premises software and appliances are the dominant delivery model, but SaaS offerings are slowly becoming
available, although they have not been adopted widely.
Increasing overlaps with IT infrastructure monitoring, APM and AIOps tools are impacting buying decisions.
Many NPMD solutions are assembled from multiple products, which can enable modular adoption of NPMD
capabilities, but also can add signicant complexity to procurement and ongoing maintenance.
It remains imperative that organizations purchase tools that closely match their current maturity levels. Many network
monitoring teams have yet to successfully make the leap from basic, reactive network availability management to
proactive performance management. While tool investment can play a part in this maturation, it is clear that simply
investing in NPMD tooling without similar investments in training, integration and processes will yield limited results, at
best. Gartner recommends that IT operations assess its current state of maturity on a regular basis, both individually
and at the organizational level, to provide this perspective. To help, teams can utilize Gartner's ITScore for Infrastructure
and Operations (ITSIO; see "How to Improve I&O Maturity by Using the ITScore" ).
I&O leaders should not utilize the Leaders quadrant as a shortlist of appropriate vendors, but instead should build a list
of criteria describing their current and future needs, and then select from vendors that best meet those requirements
(see 2017 NPMD Critical Capabilities). They should select a vendor that has both a history of and future plans for
focusing on this market. Careful consideration should be given to required skills, training, process and deployment
investments, because these factors will have a much greater impact on the overall value realized from an NPMD
investment than any specic functional capability found in a given tool.
Market Overview
NPMD: A Mature Market Evolves in Response to New Demands
For decades, the well-established practice of network management has enjoyed no shortage of available monitoring
technologies, tools and vendors; however, the vast majority of those solutions, both acquired and implemented over the
years, have been designed to support isolated, reactive resolution of availability issues by network specialists. There
have also been many investments in tools and skills, with the specic goal of monitoring the performance of network
infrastructure in addition to its availability; however, these efforts have typically been hampered by technology
limitations and isolated implementation. This approach, while delivering moderately satisfactory results for many years,
has seen several key shifts, including:
Increasing recognition that network trafc is a critical source of information about the behavior of the holistic IT stack
Migration toward cloud-hosted workloads and applications fundamentally changing the ow of network trafc (see
"Network Performance Monitoring Tools Leave Gaps in Cloud Monitoring" )
Increasing virtualization and the explosion of east-west trafc within the data center presenting a data capture
challenge
Exponential growth in application and infrastructure dynamism and complexity forcing network instrumentation as
the key piece of the visibility puzzle
Rising demand for network services and end-user expectations of their quality
Growing appreciation of the network as a critical component of IT services and as an agnostic, trusted source of
cross-domain availability and performance data
Closer alignment between IT and the business, with an appreciation that network data can provide value through
business intelligence
Each of these shifts has pressured network teams to rethink their tooling strategy, so that they can get the visibility they
need to truly monitor and troubleshoot the performance of their network resources in the context of the applications
and services they support.
NPMD tools provide this required breadth and depth of visibility in both real-time and historical perspectives by uniquely
analyzing data from all three of the following techniques: device polling, ow-based technology and packet-based
technology. Previous approaches that only take into account one or two of these data sources have proven to be
inadequate, so all three must be supported for a tool to be considered an NPMD solution (see the Product-Related
Criteria section).
Device Polling Technology
Period polling is one method that looks to quantify network usage of network elements to gauge the requirements of
the infrastructure. Each network device has embedded agents that "speak SNMP." These agents can then be
interrogated with a polling-based approach, returning metrics from the embedded agent. These collected metrics can
be stored, reported on, analyzed for troubleshooting or used for capacity planning. SNMP polling can also be used to
gather information about hardware or software errors (faults) and capacity data (for example, triggering an alert when a
hardware fault occurs, or the device CPU is above a threshold or the interface capacity is abnormal when compared to a
baseline). Based on the metrics gathered, the network team can estimate the delta between existing and required
bandwidth needs on a per-location basis. A limitation with this method is the minimal granularity it offers, which
matches the frequency of the polling and the overhead it may put on the devices being polled, especially if other tools
are also polling. In most NPMD technologies, SNMP is used during troubleshooting to collect additional data, whereas
in infrastructure monitoring, it's used more regularly to understand the health of the network devices. In addition to
SNMP, the use of APIs as a polling data source is also a common technique to collect health data, and is often used for
information from IaaS providers or SDN controllers.
While polling provides information on interface utilization and trafc, it is unable to provide a view into application and
end-user usage patterns. To meet this need, consider solutions that provide ow- and packet-based technology.
Flow-Based Technology
Summarized data is generated by the network devices, including characteristics of the IP conversation between two
network nodes, and these characteristics are embedded within ows. Flow data is exported from the network devices
to the NPMD technologies, which then collect and process this data stream to provide insight into which devices and
applications are consuming bandwidth, how long the conversations are lasting, and who is participating in them. Since
the data is summarized, a degree of detail is removed to simplify processing and extract meaning from the actual
network data.
There are several ow collection standards, such as Cisco's NetFlow (v.5/v.9), Juniper Networks' J-Flow, Huawei's
NetStream, Citrix's AppFlow, the Internet Engineering Task Force's (IETF's) Internet Protocol Flow Information Export
(IPFIX, which is based on NetFlow v.9) and sFlow from the sFlow.org consortium. Vendor-derived standards are
predominant, which hinders integration and comparisons. Flow data collection is a function embedded in the network
devices themselves. The device analyzes the network trafc traversing from one interface to another, with the primary
purpose of assessing bandwidth consumption, and the level of data being sent and received between various source
and destination ports across the network. That data is then summarized into a stream-of-ow record that is sent to the
monitoring tools that collect and assess the ow records.
Additionally, the quality and granularity of ow information are always evolving. Many vendors embed additional data
within their ows, especially those implementing exible record types, such as Cisco's IOS Flexible NetFlow, which
allows the user to congure the exported data format. Example data embedded in ows contains wireless protocols,
link aggregation, URLs, latency information, and other application or infrastructure monitoring data. With such open
standards in ow technologies, the architecture varies among network equipment vendors, but most tools collect and
process the data regardless of the network equipment implementation. In addition, it can have a performance impact
on the devices exporting ow data.
Flow-based data does not provide details down to a specic set of network packets going between the source and
destination, nor does it provide any timing information about the conversation itself or the delay components. For this
capability, users must consider packet-based technologies.
Packet-Based Technology
Examining the current infrastructure in detail on a per-packet basis provides the necessary real-time and historical
visibility into volatile trafc behavior from "bursty" modern application types, like today's chatty web applications, UC
services (such as voice and video delivery) and the growing footprint of virtual desktop infrastructure (VDI)
technologies. Because only raw, unmanipulated packet data is collected, a vendor-agnostic view of performance can be
preserved throughout the analysis. This approach affords far greater insight and precision, but it comes with potentially
costly (and for some, impossibly costly) appliance or "probe" implementation requirements. Software-based packet
capture capabilities have been introduced as cost-sensitive alternatives, but with obvious limitations in scalability and
storage.
Analysis offered by packet-based technology is packet-timing-based, allowing vendors to identify sources of delay,
measure user response time and ultimately pinpoint the root cause of performance problems. The packet analysis
vendors range from those providing measurements from a TCP connection perspective to those reporting on timing on
a TCP request/response basis. Other vendors move up the stack to measuring at the application layer, providing
measurements from an application session perspective and a much closer representation to real end-user experience.
Through the years, these high-end proprietary packet analysis technologies have commoditized and moved into open
source, with tools such as Wireshark, tcpdump and libpcap providing the underpinnings of this technique. These
particular open-source technologies have, in turn, been incorporated into countless numbers of other critical open-
source projects, such as ntop or Snort (intrusion detection). These technologies continue to evolve, most recently into
enabling real-time visibility and, in many cases, supporting the archiving of packet data for forensics and debugging
without requiring the issue to be reproduced for diagnosis.
As the NPMD market continues to grow and develop, Gartner expects that future tool enhancements will center on
usability, advanced IT operations analytics and virtualization/SDN support. Additional vendors are expected to enter the
NPMD market, as well as vendors participating in the larger network performance monitoring market, but they did not
meet the criteria specic to the 2017 NPMD Magic Quadrant.
Adjacent and Overlapping Markets

NPMD is, and will likely continue to be, frequently confused with adjacent and component technologies, as it is both a
reasonably recent addition to the dynamic availability and performance monitoring market and a superset of multiple
network performance monitoring technologies. Because vendors will both intentionally and unintentionally exacerbate
this confusion to their benet, IT leaders are advised to utilize the following denitions to add clarity to their evaluation
efforts.
Application Performance Monitoring
APM tracks the end-user performance of application components, and provides granular troubleshooting tools for the
application and its components through server-based instrumentation. It provides this insight by monitoring three main
functional dimensions: digital experience monitoring; application discovery, tracing and diagnostics; and application
analytics. APM differs from NPMD primarily in its focus on monitoring the quality of the end-user experience via
application interactions across all application and infrastructure tiers, including (but not limited to) the network
perspective. There are several vendors in the NPMD space that offer accompanying APM solutions, and several vendors
offer integrated APM and NPMD solutions. See "Magic Quadrant for Application Performance Monitoring Suites" for
further details.
IT Infrastructure Monitoring
IT infrastructure monitoring (ITIM) tools focus exclusively on monitoring the infrastructure topology composed of
compute systems, storage, virtualization and network devices, using agent-based or agentless polling technologies,
such as SNMP, Windows Management Instrumentation (WMI) or API integration-based data collection. These solutions
focus on the availability and health of these systems, as opposed to the performance insight offered by APM and NPMD
solutions. The difference between these tools and APM products is that they look at server-level metrics and processes,
while also looking at the way servers interact with one another, versus living within the application logic and seeing the
code execute. Unlike NPMD products, which cater to network professional use cases and speak in protocols and packet
data that those buyers best understand, IT infrastructure monitoring products focus on IT operations generalists and
often don't include support for packet- and ow-based technologies. These generalists need to determine which part of
the infrastructure is contributing to poor performance, as well as understand the application's topology from an
infrastructure perspective. Some ITIM tool vendors have moved partially into the NPMD space with the introduction of
ow and packet support. Infrastructure monitoring should be supplemented by log analytics, NPMD and APM tooling to
support complex troubleshooting and performance monitoring. See "Market Guide for IT Infrastructure Monitoring
Tools" for more information.
Algorithmic IT Operations Platforms (Formerly IT Operations Analytics)
The coordinated deployment of AIOps technologies is used to discover complex patterns in high volumes of "noisy" IT
data by providing a real, automated inference capability not available in most tools. These technologies include
complex operations event processing (COEP), machine learning/statistical pattern discovery and recognition
(ML/SPDR), unstructured text indexing search and inference (UTISI), topological analysis (TA), and multidimensional
database search and analysis (MDSA).
IT operations' future as a big data analysis entity has been cemented by an exponential, continual growth of data (IT and
business) generated by highly adaptive systems composed of large numbers of moving parts whose interactions are
increasingly transient and complex. These systems' behaviors cannot be characterized, much less managed, by
inferring the behavior of the whole from the behavior of any individual part, necessitating the use of AIOps' advanced
capabilities (see "Innovation Insight for Algorithmic IT Operations Platforms" ).
Digital Experience Monitoring (Formerly End-User Experience Monitoring)
Digital experience monitoring (DEM) is an availability and performance monitoring discipline that supports the
optimization of the operational experience and behavior of a digital agent, human or machine, with the application and
service portfolio of enterprises. This discipline also seeks to observe, model and manage the behavior of digital agent
communities as they collectively engage with enterprise application and service portfolios. Several NPMD solutions
provide DEM capabilities as part of their solution offerings.
Network Packet Brokers

NPBs assist with trafc aggregation, visibility and overall management of the data being sent to monitoring tools.
Vendors in the NPB space often partner and collaborate with NPMD and security vendors as a go-to-market strategy,
resulting in marketing messages that can make it difcult to determine which tool is actually performing the monitoring
(network performance monitoring or security) and which is facilitating the monitoring by managing the data to be
monitored (network packet brokering). Vendors such as NetScout and Viavi, both of which are included in this Magic
Quadrant, offer NPB solutions as part of their solution set. See "Market Guide for Network Packet Brokers" for further
details.
Evidence
Press release: "SolarWinds Acquires AppNeta TraceView Solution."
(http://www.solarwinds.com/company/newsroom/press_releases/solarwinds-acquires-appneta-traceview-solution.aspx)
Press release: "ExtraHop Appoints Former Fluke Networks President, Arif Kareem, as CEO on the Heels of Most Successful
Quarter to Date." (https://www.extrahop.com/company/press-releases/extrahop-appoints-former-uke-president-as-ceo/)
"SevOne Begins 'Brutal' Round of Layoffs." (http://www.delawareonline.com/story/money/business/2016/08/01/sevone-begins-

brutal-round-layoffs/87912724/) Delaware Online/The News Journal.
"SevOne Founders Vess and Tanya Bakalov Leaving Company."

(http://www.delawareonline.com/story/money/business/2016/08/25/sevone-founders-vess-and-tanya-bakalov-leaving-
company/89339432/) Delaware Online/The News Journal.
Press release: "NetScout Strengthens Its Powerful Business Assurance Lineup for the Enterprise With nGenius for Flows."
(http://www.netscout.com/press-release/netscout-strengthens-its-powerful-business-assurance-lineup-for-the-enterprise-with-
ngenius-for-ows/)
Press release: "NetScout Unveils Industry's First Real-Time Information Platform for Service Assurance, Cybersecurity and Big
Data." (http://www.netscout.com/press-release/netscout-unveils-industrys-rst-real-time-information-platform-for-service-
assurance-cybersecurity-and-big-data/)
"NetScout Systems' (NTCT) CEO Anil Singhal on Q2 2017 Results Earnings Call Transcript."
(http://seekingalpha.com/article/4015802-netscout-systems-ntct-ceo-anil-singhal-q2-2017-results-earnings-call-transcript?
part=single) Seeking Alpha.
Press release: "Micro Focus Announces Intent to Merge With Hewlett Packard Enterprise's Software Business Segment."
(https://www.microfocus.com/about/press-room/article/2016/micro-focus-announces-intent-to-merge-with-hewlett-packard-
enterprise-software-business-segment/)
Press release: "Thoma Bravo Completes Sale of InfoVista to Apax Partners" (https://thomabravo.com/2016/05/02/thoma-
bravo-completes-sale-of-infovista-to-apax-partners/)
Press release: "SolarWinds Completes Take-Private Acquisition by Silver Lake and Thoma Bravo."
(http://www.solarwinds.com/company/newsroom/press_releases/solarwinds_completes_take_private_acquisition.aspx)
Note
Denition of Machine-Time Data
Machine-time data is the ow of communication that is handled without human operators or intervention. The data is
exclusive on a machine-to-machine basis in an autonomous fashion. The perception of "real time" in such scenarios is
more ne-grained, given that machines can react and respond to situations in microseconds (generally 1 to 2
microseconds), whereas human real-time responsiveness is generally measured in seconds (or tenths of seconds in the
most demanding of instances).
Evaluation Criteria Denitions

Ability to Execute
Product/Service: Core goods and services offered by the vendor for the dened market. This includes current
product/service capabilities, quality, feature sets, skills and so on, whether offered natively or through OEM
agreements/partnerships as dened in the market denition and detailed in the subcriteria.
Overall Viability: Viability includes an assessment of the overall organization's nancial health, the nancial and
practical success of the business unit, and the likelihood that the individual business unit will continue investing in the
product, will continue offering the product and will advance the state of the art within the organization's portfolio of
products.
Sales Execution/Pricing: The vendor's capabilities in all presales activities and the structure that supports them. This
includes deal management, pricing and negotiation, presales support, and the overall effectiveness of the sales
channel.
Market Responsiveness/Record: Ability to respond, change direction, be exible and achieve competitive success as
opportunities develop, competitors act, customer needs evolve and market dynamics change. This criterion also
considers the vendor's history of responsiveness.
Marketing Execution: The clarity, quality, creativity and efcacy of programs designed to deliver the organization's
message to inuence the market, promote the brand and business, increase awareness of the products, and establish a
positive identication with the product/brand and organization in the minds of buyers. This "mind share" can be driven
by a combination of publicity, promotional initiatives, thought leadership, word of mouth and sales activities.
Customer Experience: Relationships, products and services/programs that enable clients to be successful with the
products evaluated. Specically, this includes the ways customers receive technical support or account support. This
can also include ancillary tools, customer support programs (and the quality thereof), availability of user groups,
service-level agreements and so on.
Operations: The ability of the organization to meet its goals and commitments. Factors include the quality of the
organizational structure, including skills, experiences, programs, systems and other vehicles that enable the
organization to operate effectively and efciently on an ongoing basis.
Completeness of Vision
Market Understanding: Ability of the vendor to understand buyers' wants and needs and to translate those into
products and services. Vendors that show the highest degree of vision listen to and understand buyers' wants and
needs, and can shape or enhance those with their added vision.
Marketing Strategy: A clear, differentiated set of messages consistently communicated throughout the organization
and externalized through the website, advertising, customer programs and positioning statements.
Sales Strategy: The strategy for selling products that uses the appropriate network of direct and indirect sales,
marketing, service, and communication afliates that extend the scope and depth of market reach, skills, expertise,
technologies, services and the customer base.
Offering (Product) Strategy: The vendor's approach to product development and delivery that emphasizes
differentiation, functionality, methodology and feature sets as they map to current and future requirements.
Business Model: The soundness and logic of the vendor's underlying business proposition.
Vertical/Industry Strategy: The vendor's strategy to direct resources, skills and offerings to meet the specic needs of
individual market segments, including vertical markets.
Innovation: Direct, related, complementary and synergistic layouts of resources, expertise or capital for investment,
consolidation, defensive or pre-emptive purposes.
Geographic Strategy: The vendor's strategy to direct resources, skills and offerings to meet the specic needs of
geographies outside the "home" or native geography, either directly or through partners, channels and subsidiaries as
appropriate for that geography and market.
(https://www.gartner.com/technology/contact/become-a-client.jsp?cm_sp=bac-_-reprint-_-banner)
2017 Gartner, Inc. and/or its afliates. All rights reserved. Gartner is a registered trademark of Gartner, Inc. or its afliates. This
publication may not be reproduced or distributed in any form without Gartner's prior written permission. If you are authorized to access
this publication, your use of it is subject to the Usage Guidelines for Gartner Services
(/technology/about/policies/usage_guidelines.jsp) posted on gartner.com. The information contained in this publication has been
obtained from sources believed to be reliable. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such
information and shall have no liability for errors, omissions or inadequacies in such information. This publication consists of the opinions
of Gartner's research organization and should not be construed as statements of fact. The opinions expressed herein are subject to
change without notice. Gartner provides information technology research and advisory services to a wide range of technology
consumers, manufacturers and sellers, and may have client relationships with, and derive revenues from, companies discussed herein.
Although Gartner research may include a discussion of related legal issues, Gartner does not provide legal advice or services and its
research should not be construed or used as such. Gartner is a public company, and its shareholders may include rms and funds that
have nancial interests in entities covered in Gartner research. Gartner's Board of Directors may include senior managers of these rms
or funds. Gartner research is produced independently by its research organization without input or inuence from these rms, funds or
their managers. For further information on the independence and integrity of Gartner research, see "Guiding Principles on
Independence and Objectivity. (/technology/about/ombudsman/omb_guide2.jsp)"
About (http://www.gartner.com/technology/about.jsp)
Careers (http://www.gartner.com/technology/careers/)
Newsroom (http://www.gartner.com/newsroom/)
Policies (http://www.gartner.com/technology/about/policies/guidelines_ov.jsp)
Privacy (https://www.gartner.com/privacy)
Site Index (http://www.gartner.com/technology/site-index.jsp)
IT Glossary (http://www.gartner.com/it-glossary/)
Contact Gartner (http://www.gartner.com/technology/contact/contact_gartner.jsp)

Gartner Reprint PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Gartner Reprint PDF

Uploaded by

Copyright:

Available Formats

28/02/2017 GartnerReprint

(https://www.gartner.com/home) LICENSED FOR

Magic Quadrant for Network Performance Monitoring and Diagnostics

Source: Gartner (February 2017)

Vendor Strengths and Cautions

Investments in monitoring cloud-based environments have outpaced other NPMD vendors.

SNMP and ow-based data source support remain comparatively weak.

Support for ow monitoring is limited compared to the competition.

Vendors Added and Dropped

Niksun Focus is on security workows.

Inclusion and Exclusion Criteria

Support for analysis of:

Leverage the following data sources:

Network-device-generated health data.

Network packet analysis to identify application types and performance characteristics.

The ability to support the following scalability and performance requirements:

Algorithmic IT operations analytics

Day-to-day maintenance and management of the product

Ease and simplicity of deployment and conguration

Product deployment options and usability

Product or Service High

Overall Viability High

Sales Execution/Pricing Medium

Market Responsiveness/Record High

Marketing Execution Medium

Customer Experience High

Operations Not Rated

Source: Gartner (February 2017)

Data source support, including application visibility

Algorithmic IT operations analytics

Virtualization (NFV and SDN)

Table 2. Completeness of Vision Evaluation Criteria

Market Understanding High

Marketing Strategy Medium

Sales Strategy Medium

Offering (Product) Strategy High

Business Model Low

Vertical/Industry Strategy Low

Geographic Strategy Low

Source: Gartner (February 2017)

Pricing and product/capability packaging vary signicantly across vendors.

Adjacent and Overlapping Markets

Digital Experience Monitoring (Formerly End-User Experience Monitoring)

Network Packet Brokers

"SevOne Begins 'Brutal' Round of Layoffs." (http://www.delawareonline.com/story/money/business/2016/08/01/sevone-begins-

"SevOne Founders Vess and Tanya Bakalov Leaving Company."

Evaluation Criteria Denitions

You might also like