Skip to main content

The Evolution of Application Centric Network Visibility in Public Cloud

Nadeem Zahid
cPacket Networks

Application or network downtime is expensive, and given the growing numbers and types of high-availability and mission-critical applications, systems and networks — and our increasing reliance on them — ensuring consistent access to mission-critical applications is essential for ensuring customer loyalty and keeping employees productive. Businesses must recognize that applications availability depends on the network and implement a strategy to ensure network-aware application performance monitoring.

As most enterprises go cloud-first and cloud-smart, a key component in providing full network-aware application and security monitoring is eliminating blind spots in the public cloud. A good network visibility solution must be able to reliably monitor traffic across an organization's current and future hybrid network architecture — with physical, virtual, and cloud-native elements deployed across the data centers, branch offices and multi-cloud environments.

Unfortunately for IT teams, up until mid-2019, every major public cloud platform was a black box from the above perspective. Companies could have rich insight into network and application performance across their private data center network, as well as into and out of the cloud, but what happened inside the cloud itself was a mystery. This made application performance monitoring and security assurance difficult and porting of on-premise investigation and resolution workflows virtually impossible.

Companies worked around this lack of visibility with a variety of compromised methods, including deploying traffic forwarding agents (or container-based sensors) and using log-based monitoring. Both have limitations. Feature-constrained forwarding agents and sensors must be deployed for every instance and every tool — a costly IT management headache — or there is a risk of blind spots and inconsistent insight. Event logging must be well-planned and instrumented in advance and can only prepare for anticipated issues as snapshots in time. Neither provides the high-quality and continuous data, such as packet data, that would provide the required depth needed to troubleshoot complex application, security or user experience issues.

To solve this problem, public clouds like AWS and Google Cloud have introduced game-changing features over the last year such as VPC traffic/packet mirroring that significantly impact the ability of IT departments to monitor cloud deployments. 

Microsoft Azure had introduced a virtual TAP feature for the same purpose, but it has been put on hold for now. It’s worth a closer look to assess what it means for network and application management, and security use cases.

In mid-2019 Amazon, followed by Google Cloud, introduced traffic mirroring (packet mirroring in case of Google) functionality as part of their respective Virtual Private Cloud (VPC) offerings. Simply stated, this traffic mirroring feature duplicates network traffic to and from the client’s applications and forwards it to cloud-native performance and security monitoring tool sets for assessment. This eliminates the need to deploy ad-hoc forwarding agents or sensors in each VPC instance for every monitoring tool and reduces complexity. Compared to log data, it delivers much richer and deeper situational awareness that’s needed for network and application monitoring or security investigations. The result is simplicity, elasticity and cost savings.

Traffic or packet mirroring isn’t enough on its own, however. Just like the agent or sensor approach, it simply provides the access to raw packet data (equivalent to TAPs in the physical world) which is not quite ready to feed directly into monitoring and security tools. The complete solution is to use traffic mirroring along with cloud-based virtual packet brokering, packet capture, flow generation and analytics middleware. This adds value in a variety of ways.

In Amazon or Google Cloud, virtual/cloud packet broker can multiply the value of VPC mirrored traffic by pre-processing operations such as header stripping, filtering, deduplicating and load-balancing the traffic feeds to cloud-native tools, which saves on costs while forwarding the right data to the right tools.

In Azure, if the virtual packet broker supports an "inline mode" it can be a viable alternative to VPC traffic mirroring or agent-based mirroring features. One or more of the feeds from the packet broker can be fed to a packet-to-flow gateway tier to generate flow data such as Netflow/IPFIX if certain tools prefer flow data. A virtual/cloud packet capture tier can take a feed from the packet broker as well to record interesting data to cloud storage for later retrieval, playback and analysis. This is particularly useful for security-centric Network Detection and Response, forensics and incident response.

While most of the above value on top of cloud traffic mirroring (inline or non-inline) involves data or network intelligence delivery, more value comes from correlating and analyzing the data to spit out something more meaningful, useful and actionable. This is where the rich network analytics tier comes in. These tools consume the fine-grain metadata extracted from the above middleware and turns that into visualizations and dashboards that enable IT NetOps, SecOps, AppOps and CloudOps teams to effectively perform their jobs. The high-quality metadata can be exported to other tools such as threat detection, behavioral analytics and service monitoring solutions to enrich their effectiveness. Features such as baselining, application dependency mapping and automated alerting, coupled with artificial intelligence (AI) and machine learning (ML) capabilities add the ultimate value for today’s demanding ITOps — headed to AIOps.

In summary, a cohesive hybrid visibility suite that integrates with the new VPC traffic mirroring capabilities offered by the leading cloud providers allows organizations to use a consistent mix of tools, workflows, data and insight when managing hybrid environments (the proverbial "single pane of glass"). The ability to gather the same deep insights across both private and public infrastructure is a game changer for application and network performance monitoring and security. Black boxes shouldn’t exist in corporate networks, making fully network-aware public cloud monitoring a welcome change. This simplifies network and application performance management and speeds up mean time to resolution — ultimately enhancing end-user experience and reducing customer churn — all by de-risking IT infrastructure and operations.

Nadeem Zahid is VP of Product Management & Marketing at cPacket Networks

Hot Topics

The Latest

According to Auvik's 2025 IT Trends Report, 60% of IT professionals feel at least moderately burned out on the job, with 43% stating that their workload is contributing to work stress. At the same time, many IT professionals are naming AI and machine learning as key areas they'd most like to upskill ...

Businesses that face downtime or outages risk financial and reputational damage, as well as reducing partner, shareholder, and customer trust. One of the major challenges that enterprises face is implementing a robust business continuity plan. What's the solution? The answer may lie in disaster recovery tactics such as truly immutable storage and regular disaster recovery testing ...

IT spending is expected to jump nearly 10% in 2025, and organizations are now facing pressure to manage costs without slowing down critical functions like observability. To meet the challenge, leaders are turning to smarter, more cost effective business strategies. Enter stage right: OpenTelemetry, the missing piece of the puzzle that is no longer just an option but rather a strategic advantage ...

Amidst the threat of cyberhacks and data breaches, companies install several security measures to keep their business safely afloat. These measures aim to protect businesses, employees, and crucial data. Yet, employees perceive them as burdensome. Frustrated with complex logins, slow access, and constant security checks, workers decide to completely bypass all security set-ups ...

Image
Cloudbrink's Personal SASE services provide last-mile acceleration and reduction in latency

In MEAN TIME TO INSIGHT Episode 13, Shamus McGillicuddy, VP of Research, Network Infrastructure and Operations, at EMA discusses hybrid multi-cloud networking strategy ... 

In high-traffic environments, the sheer volume and unpredictable nature of network incidents can quickly overwhelm even the most skilled teams, hindering their ability to react swiftly and effectively, potentially impacting service availability and overall business performance. This is where closed-loop remediation comes into the picture: an IT management concept designed to address the escalating complexity of modern networks ...

In 2025, enterprise workflows are undergoing a seismic shift. Propelled by breakthroughs in generative AI (GenAI), large language models (LLMs), and natural language processing (NLP), a new paradigm is emerging — agentic AI. This technology is not just automating tasks; it's reimagining how organizations make decisions, engage customers, and operate at scale ...

In the early days of the cloud revolution, business leaders perceived cloud services as a means of sidelining IT organizations. IT was too slow, too expensive, or incapable of supporting new technologies. With a team of developers, line of business managers could deploy new applications and services in the cloud. IT has been fighting to retake control ever since. Today, IT is back in the driver's seat, according to new research by Enterprise Management Associates (EMA) ...

In today's fast-paced and increasingly complex network environments, Network Operations Centers (NOCs) are the backbone of ensuring continuous uptime, smooth service delivery, and rapid issue resolution. However, the challenges faced by NOC teams are only growing. In a recent study, 78% state network complexity has grown significantly over the last few years while 84% regularly learn about network issues from users. It is imperative we adopt a new approach to managing today's network experiences ...

Image
Broadcom

From growing reliance on FinOps teams to the increasing attention on artificial intelligence (AI), and software licensing, the Flexera 2025 State of the Cloud Report digs into how organizations are improving cloud spend efficiency, while tackling the complexities of emerging technologies ...

The Evolution of Application Centric Network Visibility in Public Cloud

Nadeem Zahid
cPacket Networks

Application or network downtime is expensive, and given the growing numbers and types of high-availability and mission-critical applications, systems and networks — and our increasing reliance on them — ensuring consistent access to mission-critical applications is essential for ensuring customer loyalty and keeping employees productive. Businesses must recognize that applications availability depends on the network and implement a strategy to ensure network-aware application performance monitoring.

As most enterprises go cloud-first and cloud-smart, a key component in providing full network-aware application and security monitoring is eliminating blind spots in the public cloud. A good network visibility solution must be able to reliably monitor traffic across an organization's current and future hybrid network architecture — with physical, virtual, and cloud-native elements deployed across the data centers, branch offices and multi-cloud environments.

Unfortunately for IT teams, up until mid-2019, every major public cloud platform was a black box from the above perspective. Companies could have rich insight into network and application performance across their private data center network, as well as into and out of the cloud, but what happened inside the cloud itself was a mystery. This made application performance monitoring and security assurance difficult and porting of on-premise investigation and resolution workflows virtually impossible.

Companies worked around this lack of visibility with a variety of compromised methods, including deploying traffic forwarding agents (or container-based sensors) and using log-based monitoring. Both have limitations. Feature-constrained forwarding agents and sensors must be deployed for every instance and every tool — a costly IT management headache — or there is a risk of blind spots and inconsistent insight. Event logging must be well-planned and instrumented in advance and can only prepare for anticipated issues as snapshots in time. Neither provides the high-quality and continuous data, such as packet data, that would provide the required depth needed to troubleshoot complex application, security or user experience issues.

To solve this problem, public clouds like AWS and Google Cloud have introduced game-changing features over the last year such as VPC traffic/packet mirroring that significantly impact the ability of IT departments to monitor cloud deployments. 

Microsoft Azure had introduced a virtual TAP feature for the same purpose, but it has been put on hold for now. It’s worth a closer look to assess what it means for network and application management, and security use cases.

In mid-2019 Amazon, followed by Google Cloud, introduced traffic mirroring (packet mirroring in case of Google) functionality as part of their respective Virtual Private Cloud (VPC) offerings. Simply stated, this traffic mirroring feature duplicates network traffic to and from the client’s applications and forwards it to cloud-native performance and security monitoring tool sets for assessment. This eliminates the need to deploy ad-hoc forwarding agents or sensors in each VPC instance for every monitoring tool and reduces complexity. Compared to log data, it delivers much richer and deeper situational awareness that’s needed for network and application monitoring or security investigations. The result is simplicity, elasticity and cost savings.

Traffic or packet mirroring isn’t enough on its own, however. Just like the agent or sensor approach, it simply provides the access to raw packet data (equivalent to TAPs in the physical world) which is not quite ready to feed directly into monitoring and security tools. The complete solution is to use traffic mirroring along with cloud-based virtual packet brokering, packet capture, flow generation and analytics middleware. This adds value in a variety of ways.

In Amazon or Google Cloud, virtual/cloud packet broker can multiply the value of VPC mirrored traffic by pre-processing operations such as header stripping, filtering, deduplicating and load-balancing the traffic feeds to cloud-native tools, which saves on costs while forwarding the right data to the right tools.

In Azure, if the virtual packet broker supports an "inline mode" it can be a viable alternative to VPC traffic mirroring or agent-based mirroring features. One or more of the feeds from the packet broker can be fed to a packet-to-flow gateway tier to generate flow data such as Netflow/IPFIX if certain tools prefer flow data. A virtual/cloud packet capture tier can take a feed from the packet broker as well to record interesting data to cloud storage for later retrieval, playback and analysis. This is particularly useful for security-centric Network Detection and Response, forensics and incident response.

While most of the above value on top of cloud traffic mirroring (inline or non-inline) involves data or network intelligence delivery, more value comes from correlating and analyzing the data to spit out something more meaningful, useful and actionable. This is where the rich network analytics tier comes in. These tools consume the fine-grain metadata extracted from the above middleware and turns that into visualizations and dashboards that enable IT NetOps, SecOps, AppOps and CloudOps teams to effectively perform their jobs. The high-quality metadata can be exported to other tools such as threat detection, behavioral analytics and service monitoring solutions to enrich their effectiveness. Features such as baselining, application dependency mapping and automated alerting, coupled with artificial intelligence (AI) and machine learning (ML) capabilities add the ultimate value for today’s demanding ITOps — headed to AIOps.

In summary, a cohesive hybrid visibility suite that integrates with the new VPC traffic mirroring capabilities offered by the leading cloud providers allows organizations to use a consistent mix of tools, workflows, data and insight when managing hybrid environments (the proverbial "single pane of glass"). The ability to gather the same deep insights across both private and public infrastructure is a game changer for application and network performance monitoring and security. Black boxes shouldn’t exist in corporate networks, making fully network-aware public cloud monitoring a welcome change. This simplifies network and application performance management and speeds up mean time to resolution — ultimately enhancing end-user experience and reducing customer churn — all by de-risking IT infrastructure and operations.

Nadeem Zahid is VP of Product Management & Marketing at cPacket Networks

Hot Topics

The Latest

According to Auvik's 2025 IT Trends Report, 60% of IT professionals feel at least moderately burned out on the job, with 43% stating that their workload is contributing to work stress. At the same time, many IT professionals are naming AI and machine learning as key areas they'd most like to upskill ...

Businesses that face downtime or outages risk financial and reputational damage, as well as reducing partner, shareholder, and customer trust. One of the major challenges that enterprises face is implementing a robust business continuity plan. What's the solution? The answer may lie in disaster recovery tactics such as truly immutable storage and regular disaster recovery testing ...

IT spending is expected to jump nearly 10% in 2025, and organizations are now facing pressure to manage costs without slowing down critical functions like observability. To meet the challenge, leaders are turning to smarter, more cost effective business strategies. Enter stage right: OpenTelemetry, the missing piece of the puzzle that is no longer just an option but rather a strategic advantage ...

Amidst the threat of cyberhacks and data breaches, companies install several security measures to keep their business safely afloat. These measures aim to protect businesses, employees, and crucial data. Yet, employees perceive them as burdensome. Frustrated with complex logins, slow access, and constant security checks, workers decide to completely bypass all security set-ups ...

Image
Cloudbrink's Personal SASE services provide last-mile acceleration and reduction in latency

In MEAN TIME TO INSIGHT Episode 13, Shamus McGillicuddy, VP of Research, Network Infrastructure and Operations, at EMA discusses hybrid multi-cloud networking strategy ... 

In high-traffic environments, the sheer volume and unpredictable nature of network incidents can quickly overwhelm even the most skilled teams, hindering their ability to react swiftly and effectively, potentially impacting service availability and overall business performance. This is where closed-loop remediation comes into the picture: an IT management concept designed to address the escalating complexity of modern networks ...

In 2025, enterprise workflows are undergoing a seismic shift. Propelled by breakthroughs in generative AI (GenAI), large language models (LLMs), and natural language processing (NLP), a new paradigm is emerging — agentic AI. This technology is not just automating tasks; it's reimagining how organizations make decisions, engage customers, and operate at scale ...

In the early days of the cloud revolution, business leaders perceived cloud services as a means of sidelining IT organizations. IT was too slow, too expensive, or incapable of supporting new technologies. With a team of developers, line of business managers could deploy new applications and services in the cloud. IT has been fighting to retake control ever since. Today, IT is back in the driver's seat, according to new research by Enterprise Management Associates (EMA) ...

In today's fast-paced and increasingly complex network environments, Network Operations Centers (NOCs) are the backbone of ensuring continuous uptime, smooth service delivery, and rapid issue resolution. However, the challenges faced by NOC teams are only growing. In a recent study, 78% state network complexity has grown significantly over the last few years while 84% regularly learn about network issues from users. It is imperative we adopt a new approach to managing today's network experiences ...

Image
Broadcom

From growing reliance on FinOps teams to the increasing attention on artificial intelligence (AI), and software licensing, the Flexera 2025 State of the Cloud Report digs into how organizations are improving cloud spend efficiency, while tackling the complexities of emerging technologies ...