Savvius Insight Plus Review – mini network appliance for small or branch office network performance monitoring and troubleshooting. Managed Service Providers (MSP) and network administrators managing multiple sites will find the Insight to be very useful – better remote support, troubleshooting and reduced travel.

Full disclosure: I was asked by Savvius to write review and provided a loaner unit for evaluation. I was not compensated in any way and returned the loaner.

Savvius Insight Plus Review

The Savvius Insight is an Ubuntu (Linux) packet capture box that features an Elastic Stack, Logstash, Kibana (ELK) – search & analytics engine with preconfigured dashboards:

Savvius Insight Mini Network Appliance

Savvius Insight Mini Network Appliance

The Insight has no moving parts. The sturdy metal housing is a heatsink so there’s no cooling fan and it has a Solid State Disk (SSD). Status LEDs and network ports are located on the front panel for easy access. Six Gigabit Ethernet ports are available:

  • Port 0 MGMT – management port for accessing the Insight via a web browser or SSH, network performance dashboard, retrieving packet captures via Omnipeek or forwarding data to a remote Elastic Search (ELK) or Splunk server.
  • Port 1, 2 and 3 – additional GigE ports network captures. Connect these to a mirror port on your network switch. For example, to capture LAN in addition to WAN/Internet traffic.
  • Bridge Ports 4 & 5 – Passive capture between any two networks. For remote site monitoring, connect the Internet cable to Port 4 and your LAN-side cable to Port 5. A great feature is the bridge ports “fail to wire” and will pass traffic even if the Insight loses power so it will never be a failure point.
Savvius Insight - Front Panel

Savvius Insight – Front Panel

Two Insight models (.pdf) are available and externally identical. Both models are preloaded with Ubuntu server, ELK dashboard and Capture Engine for Omnipeek software.

  • Savvius Insight (standard model)
    256 GB SSD Storage, 8 GB RAM, $1,995
  • Savvius Insight Plus
    1 TB Storage / 16 GB RAM, $4,395 (with VoIP analysis)

The key difference is the Plus model supports VoIP analysis and more disk capacity. Network users may not notice transient data connection problems but they will complain if there are voice quality or connection issues.

The Savvius Insight installs between the Internet connection and LAN network by connecting to bridge ports 4 and 5. In my case between the cable modem and router as illustrated in the following diagram. Management (MGMT) port 0 is connected to the switch or you can connect a laptop directly to the Insight:

Savvius Insight Network Diagram

Savvius Insight Network Diagram

And the Insight installed in my network wall rack:

Savvius Insight - SOHO Network Installation

Savvius Insight – SOHO Network Installation

The Insight configuration is very simple per the Quick Start Guide (.pdf) and I was literally up & running in 5 minutes.

Savvius Insight Network Performance Dashboard

The Insight dashboard is built on Kibana and displays a wealth of information, including a Calls, Media, Applications, Flows, Network, Protocols, etc. that you won’t find in router and server logs.

The Utilization Map concerned me due to the numerous foreign countries hitting my network. Everything on the Internet is constantly probed for vulnerabilities so this isn’t surprising, but I usually don’t see this because my firewall silently drops unsolicited Internet traffic:

Savvius Insight Dashboard - Utilization Map

Savvius Insight Dashboard – Utilization Map

I clicked on the Nodes by Country & City pie chart to inspect Argentina because it looks suspicious:

Savvius Insight Utilization Map - Argentina Intrusion Attempt

Savvius Insight Utilization Map – Argentina Intrusion Attempt

Then I clicked “Discover” on the main menu and searched for the suspect IP address 181.25.20.2 in the logs. The log reveals the Argentina IP is trying to telnet into my router:

Savvius Insight - Kibana Discover Log Search - Telnet Intrusion Attempts

Savvius Insight – Kibana Discover Log Search – Telnet Intrusion Attempts

I probed the Argentina IP address and found it’s a hacked router in a botnet network.

Exploring a different intrusion attempt from Mexico, I found a Digital Video Recorder (DVR) at a warehouse with three cameras. It’s an older system with factory default login credentials that’s been enslaved in a botnet. Maybe it was part of the Mirai botnet?

Savvius Insight Utilization Map - Hacked DVR Enslaved in Botnet

Savvius Insight Utilization Map – Hacked DVR Enslaved in Botnet

Savvius Insight VoIP Performance Dashboard

The Insight VoIP Calls dashboard displays a tremendous amount of data with just about every performance metric imaginable, including call volume, signaling, media, quality and call dispositions. By segmenting the WAN and LAN sides of the call it’s easy to determine if the problem originated on the local or far end of the network.

Savvius Insight Plus - VoIP Call Performance Dashboard

Savvius Insight Plus – VoIP Call Performance Dashboard

Scrolling down displays the Call List which itemizes individual calls with dozens of SIP signal and media performance metrics:

Savvius Insight Plus - VoIP Call List Performance Statistics

Savvius Insight Plus – VoIP Call List Performance Statistics

Filtering based on From (originating number) and/or To (dialed number) is simple. This is important when troubleshooting phone users or problem destinations:

Savvius Insight - VoIP Call List Filter

Savvius Insight – VoIP Call List Filter

The Insight Plus can store a large history of call records given the 1TB disk capacity.

Omnipeek for Savvius Insight

Omnipeek Insight is a network performance and troubleshooting packet analyzer application for Windows. Omnipeek is optimized for task-oriented investigations and troubleshooting with it’s many dashboards, advanced packet filtering and manipulation features. A license is included with the Savvius Insight. The workflow relationship between the Insight ELK dashboard and Omnipeek is illustrated in the following diagram:

  • Insight ELK dashboard for performance, trends and inspection.
  • Omnipeek for expert analysis and troubleshooting of packets, flows, calls, etc. on the wire.
Savvius Insight Workflow Diagram

Savvius Insight Workflow Diagram

Omnipeek connects to the Savvius Insight and pulls packet captures in realtime. Packet capture (.pcap) files can be saved to the PC hard disk for long term storage and forensics. Pcap files are standard format and compatible with WireShark.

See this 5 minute tutorial and Get Started with Omnipeek:

Omnipeek VoIP Dashboard

The Omnipeek VoIP dashboard is similar to the Insight VoIP Call dashboard and used when you need to zero-in on events for troubleshooting:

Omnipeek for Savvius Insight - VoIP Dashboard

Omnipeek for Savvius Insight – VoIP Dashboard

The following Expert Events for a SIP INVITE displays the packet sequence, protocol decode and raw bytes:

Omnipeek for Savvius Insight - Vonage VoIP Call Flow

Omnipeek for Savvius Insight – Vonage VoIP Call Flow

Omnipeek can also display SIP signaling ladder diagrams.

Omnipeek Expert Events – Clients/Servers

The Clients/Servers view shows traffic patterns between two clients or clients and servers. Given my preoccupation with network security and intrusion attempts, unusual traffic patterns tend to catch my eye. In this screen grab, a Chinese source is probing for open TCP ports to exploit. Fortunately, the server – my EdgeRouter firewall – drops the packets per the zero (0) server Packets Sent:

Omnipeek for Savvius - China Network Probes Dropped by EdgeRouter Firewall

Omnipeek for Savvius – China Network Probes Dropped by EdgeRouter Firewall

Omnipeek IPv6 Peer Map

Savvius Insight and Omnipeek support IPv4 and IPv6. I haven’t enabled IPv6 on my EdgeRouter but it supported by my ISP. I found it interesting the EdgeRouter created a v6 link-local address (fe80::/64) and responds to v6 Neighbor Discovery Protocol messages. The Omnipeek Peer Map displays the v6 nodes on the Comcast cable modem termination system (CMTS):

Omnipeek for Savvius Insight - IPv6 Peer Map

Omnipeek for Savvius Insight – IPv6 Peer Map

Savvius Insight Snort Integration

The Snort Network Intrusion & Detection System can be installed on Savvius Insight. A key issue with Snort is it requires a network tap, which is conveniently provided by the Insight bridge ports. See the Insnort Wiki for instructions and preconfigured dashboards:

Snort Integration into Savvius Insight Network Appliance

Snort Integration into Savvius Insight Network Appliance

Review Summary

Savvius Insight is the only mini network appliance to include an Ubuntu server, pre-installed ELK stack/dashboards and real-time packet capture engine for Omnipeek for troubleshooting. The Plus model features VoIP analysis to monitor call performance and quality. Insight can be deployed in standalone mode or as a forwarder to a remote Elastic Search or Splunk server for centralized monitoring and SIEM integration.

Best,

Bob Jackson

Copyright © 2017 HandymanHowTo.com   Reproduction strictly prohibited.