Cisco Cisco Tetration Analytics G1 Data Sheet
© 2016 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information.
Page 2 of 10
Figure 1 shows the high-level architecture of the Cisco Tetration Analytics platform.
Figure 1. Cisco Tetration Analytics Platform Architecture
The Cisco Tetration Analytics platform has three main function layers:
●
Data collection layer: This layer consists primarily of lightweight sensors, which are the eyes and ears of
the analytics platform. Two types of sensors are used:
◦
Software sensors: These are lightweight sensors that run as user processes in an operating system and
can be installed on any server (virtualized or bare metal).
◦
Hardware sensors: These are embedded in Cisco Nexus
®
92160YC-X, 93180YC-EX, and 93108TC-EX
Switches.
These sensors collect three types of telemetry information:
◦
Flow information: This information contains data about endpoints, protocols, ports, when the flow
started, how long the flow was active, etc.
◦
Interpacket variation: This information captures the interpacket variation seen within the flow: variation
in time to live (TTL), IP/TCP flags, payload length, etc.
◦
Context details: Context information is derived outside the packet header. In the case of software
sensors, it includes details about processes: which process generated the flow, the process ID, the user
associated with the process, etc.
Sensors do not process any information from payloads, and no sampling is performed. Sensors are
designed to monitor every packet and every flow. In addition to the sensors, this layer includes
configuration information from third-party sources: load balancers, Domain Name Service (DNS) server
mappings, IP address management databases (AMD), etc. This configuration data is used to enrich the
information provided by the analytics platform.
●
Analytics layer: Data from the sensors is sent to the Cisco Tetration Analytics platform, which is the brain
that performs all the analysis. This multiserver big data platform processes the information from the sensors
and uses both unsupervised and guided machine learning, behavior analysis, and intelligent algorithms to
provide results that are ready to use:
◦
Pervasive visibility in real time across your data center infrastructure
◦
Accurate insight into application component communications based on behavior