Architecture and ownership of the enterprise packet capture estate: the initial GigaStor probe deployment in 2009, and the 2022 upgrade onto the Viavi Observer platform with APEX, taking retention past thirty days of complete packet data across eight capture points on the critical path of the enterprise network.
The question monitoring cannot answer
Monitoring tells you that something broke. It is very good at that, and it is not much help afterward. Full packet capture answers the other question — what was actually on the wire in the seconds before, during and after — and it is the only source that can answer it once the moment has passed.
Retention is therefore the design, not a setting. The interval between an event happening and somebody deciding it is worth investigating is usually days, not minutes, so a platform holding a few hours of traffic is an expensive way to miss the thing it was bought for. Thirty-plus days is the number that makes the platform useful to an investigation that starts late, which is how investigations normally start.
Three constituencies, one dataset
The platform served three groups of people who would otherwise have bought three tools:
- Security — forensics and incident reconstruction, where the packets are the evidence.
- Network operations — troubleshooting driven to root cause rather than to a plausible theory that survives until it recurs.
- Architecture — routine validation that the estate was behaving the way the design said it should, which is a question almost nobody asks and almost everybody should.
That third use is the one that justifies the capture points being where they are. A design document asserts how traffic moves. The capture tells you whether it does.
The business case
Arguing for this in a public body means arguing on the terms a public body responds to, and “we would have better visibility” is not one of them. The case was made on resolution time: without it, events take longer to isolate, and some of them are never resolved at all — which is a cost that is already being paid, just not on a line item anyone can see.
Outcome
One dataset answering three different questions — forensic, operational and architectural — instead of three tools that each half-answer one.