The battle of the backbones

When two companies merged to form consulting and accounting firm Eide Bailly LLP in May 1998, the new management team mapped out plans to move employees into new corporate headquarters and to move up to a higher speed network.

The two firms had relied on 16Mbps token ring and 10Mbps Ethernet wiring hubs. But rather than go through a series of incremental bandwidth increases, management at the Fargo, N.D., firm took the bull by the horns and went for the top echelon of high-speed backbones. Officials began comparing Asynchronous Transfer Mode (ATM), which now has a top speed of 2.4Gbps, and Gigabit Ethernet, which operates at 1Gbps.

They arrived at a decision quickly. “We thought Gigabit Ethernet offered us a more familiar network environment and more configuration flexibility than ATM,” says David Stone, IS manager at Eide Bailly.

The buck goes to Gigabit Ethernet While worldwide ATM corporate backbone revenues are projected to increase gradually through 2002, Gigabit Ethernet revenues should explode. Source: Dell’Oro Group

IT officials at many other corporations are reaching the same conclusion. Even though vendors completed Gigabit Ethernet standards only in the summer of 1998, the technology is rapidly moving into corporate backbone networks. Worldwide Gigabit Ethernet revenue for enterprise networks is projected to reach $1.2 billion in 1999, surpassing ATM revenue, according to the Dell’Oro Group, a Portola Valley, Calif., market research firm (see chart, “The buck goes to Gigabit Ethernet”).

Suppliers also see momentum shifting from ATM to Gigabit Ethernet. “We are pumping more research and development dollars into our Gigabit Ethernet products than our ATM products because we think they will deliver a better return,” says Luc Roy, director of product marketing at Nortel Networks Inc., in Santa Clara, Calif.

Corporate interest in Gigabit Ethernet is growing for a number of reasons. Its lower pricing, simpler installation, and lesser training requirements, along with a clear migration path, head the list. While some companies are opting for ATM because it handles multimedia more adeptly, most feel more comfortable selecting Gigabit Ethernet for their backbones.

Gigabit Ethernet steps forward

Cost is always a factor in the corporate IT equation. Among networking options, Ethernet is less complex and generates higher volume sales than alternatives, leading to relatively low prices for Ethernet and Fast Ethernet wares.

AT A GLANCE: Eide Bailly LLP The company: Formed through the merger of two accounting firms, Eide Bailly offers consulting and accounting services to businesses and individuals through 10 offices in six states. The problem: After the merger, the firm needed a better option speed-wise than either the 10Mbps Ethernet or the 16Mbps token ring networks that had supported the individual operations. The solution: 3Com Corp.’s SuperStack II. Eide Bailly opted for a Gigabit Ethernet switch, which would be less expensive, simpler to install, and easier to maintain than an ATM option.

Adding to the appealing price is the fact that many companies have already selected Ethernet to support other networking needs. Several years ago, 10Mbps Ethernet became the de facto desktop technology and erased token ring from the corporate networking map. In the same timeframe, the delivery of 100Mbps Ethernet switches offered companies a clear migration path from lower speed versions of Ethernet. As a result, Fast Ethernet became the primary way corporations connected their servers and helped to push alternative technologies such as Fiber Distributed Data Interface (FDDI) into oblivion. Selecting Gigabit Ethernet for backbone connections means a company can stick with one network option across its entire enterprise, thereby simplifying installation and maintenance.

That flexibility appealed to Eide Bailly officials. “Once the higher speed connections were operating, we felt we could move our 10Mbps Ethernet hubs to our remote offices since they are relatively simple to maintain,” says Stone.

So IT officials looked at Gigabit Ethernet products from 3Com Corp., Cabletron Inc., Cisco Systems Inc., and Nortel Networks. They chose 3Com’s SuperStack II because it had a flexible design, and at $60,000, it cost 10% to 15% less than competitors’ products, notes Stone.

Moving to the higher-speed option required minimal training for Eide Bailly’s technicians. Many vendors have delivered management tools that examine Ethernet packets, which are the same for the 10Mbps, 100Mbps, and 1Gbps versions, so network administrators will have a good understanding of how higher-speed switches will work alongside their slower counterparts.

In addition, many companies want to use one network protocol (TCP/IP) to carry all of their corporate traffic, and Gigabit Ethernet accommodates that desire. “When a company mixes ATM and TCP/IP, Ethernet packets have to be converted to ATM cells, which can decrease performance and increase network complexity,” says Nortel’s Roy.

Vendors are voicing the same interest in Gigabit Ethernet. Established vendors Cabletron, Cisco, Lucent Technologies Inc., Nortel, and 3Com joined start-ups Alteon WebSystems Inc., Extreme Networks and Foundry Networks Inc., to deliver such products. This intense competition is one of the reasons why the Dell’Oro Group expects Gigabit Ethernet pricing to drop from $1,600 per port in 1997 to less than $500 in 2000.

Even the healthiest people sometimes get sick. And even the best-protected companies can catch a virus. As with human health, the true test of a network’s well-being comes in how quickly it fights off or recovers from an illness.

To keep computer viruses, worms, Trojan Horses, and other nasties that fall under the umbrella title of “malicious code” away, most companies simply deploy anti-virus software.

But what happens if the anti-virus vendor gets sick? Just ask Symantec Corp., of Cupertino, Calif. Earlier this month, the company received a message from hackers threatening to unleash a worm via e-mail. Luckily, employees in the Netherlands perceived the threat quickly. Executives in San Jose then deleted the message and repelled the infection with Symantec’s security software, says company spokesperson Richard Saunders.

The lesson to be learned is that no network–no matter how secure–is totally immune. And while the best option is to avoid computer viruses, the next best alternative is to know how to quickly recover, as Symantec did, when your network does get sick. Remember to be aggressive. Deploying anti-virus software is a good start. Establishing and implementing a set of best practices and policies should be next on your agenda. If your network is compromised, having a plan can save time and a lot of headaches in the IT department.

Willamette Industries Inc. has taken this lesson to heart. The $4 billion integrated forest products company based in Portland, Ore., uses Symantec’s integrated Norton AntiVirus product, combined with regular updates, careful inspection of all incoming files, and end user education. This system has made for a more secure environment.

Despite these checks and balances, the company earlier this year caught the Melissa virus. A macro virus that made the rounds in March by getting into users’ systems through a Microsoft Corp. Office document, Melissa then replicated itself, and sent out copies via e-mail using Microsoft Outlook. Melissa propagated itself up to 50 times with each user it successfully infected. According to a recent survey conducted by Icsa Inc., a Reston, Va., provider of Internet security assurance services, there were 7.6 infections per 1,000 PCs during the week Melissa was released. The chance of encountering Melissa was around 30 per 1,000 PCs per month. Of the almost 5,000 PC users surveyed during or after Melissa, 3,650 reported having been infected.

Melissa managed to infect two servers at Willamette, one at corporate headquarters and one in a branch office in the Southwest, according to Robert Woods, PC systems manager for the company. “A few of our servers were slowed down by the volume of mail, but it was more of an annoyance than anything else,” Woods says.

Fortunately, the impact was minimal because IT officials identified the problem, isolated the systems, and got them fixed quickly.

Press and Internet warnings had alerted Willamette to the virus. “We were aware that Melissa was a possibility, so we sent out a notification to all users via e-mail, telling them what to look out for and reminding them of the policies we had in place,” says Woods.

Willamette’s early warning system kept Melissa in check until a cure was found. As a result, IT officials watched the virus–mostly inert–in its system for about two days, until Symantec issued the “inoculation” that would scrub the virus out. It was distributed, and that was that.

In 1993, the federally funded Computer Emergency Response Team handled 1,334 incidents. By 1998, it was up to 3,734 incidents, and in the first third of 1999, the number was 1,795.

Thus, quick response on the part of the company and the supplier averted what was for other companies a period of costly downtime. “Damages from viruses can range from mere annoyance … to the obliteration of critical data resources,” says Bill Pollak, a spokesperson for the federally funded Computer Emergency Response Team (CERT) Coordination Center at Carnegie Mellon University, in Pittsburgh.

Enough to make you sick

Know your enemy Types of “malicious software” Virus: A computer program that makes copies of itself and needs a host program. It may be destructive, but that isn’t the primary goal of the program. It may try to hide to avoid detection. Worm: A computer program that copies itself from one computer to another. It doesn’t try to hide, and doesn’t need a host. Typically, it spreads through a network. Spam: A mass e-mail mailing, which can clog up a system almost as much as a worm. More annoying than dangerous, spam wastes time and systems resources. It can often be filtered out by the corporate server or firewall. Other sniffles Bug: Programming error that causes computer software to misbehave–or, more often, not work at all. Bugs are not intentionally malicious, but can cause damage nonetheless. Also, virus writers can sometimes exploit known bugs for their own purposes. Virus hoax: A message warning of a nonexistent virus. These warnings propagate quickly, like all rumors. They frequently spread over e-mail. They cause panic among users and force IT to waste time squelching the rumors. Some anti-virus vendors are considering adding known hoax e-mail filters to their software. Spam: A mass e-mail mailing, which can clog up a system almost as much as a worm. More annoying than dangerous, spam wastes time and systems resources. It can often be filtered out by the corporate server or firewall.

The use of the term virus is somewhat inaccurate, since a computer virus is only one of several types of malicious programs that can wreak havoc with a company’s network. But colloquially, virus can be used interchangeably with mal-ware, or malicious software.

“A virus is any type of malicious code that can be used to cause disruption of the information infrastructure,” according to a spokesperson for the Defense Intelligence Agency (DIA), which is part of the U.S. Department of Defense. “The disruption can entail attacking the system’s integrity, circumventing security capabilities, and causing adverse operation action, or exploiting and taking advantage of the information system.”

Viruses are classified by the way they infect systems, says CERT’s Pollak. File viruses attack executable files, boot viruses infect boot sectors of hard and floppy disks, and macro viruses are data files written to exploit the macro commands available to Microsoft Word and other applications.

Today, 80% of all viruses are macro viruses, according to Carie Nachenberg, chief researcher for Symantec’s Anti-virus Resource Center. “It used to be the floppy disk, but today, a machine can get infected surfing the net, or from executables from Usenet [news] groups.”

“It’s way beyond the benign stage,” adds Michael Erbschloe, vice president of research for Computer Economics Inc., an independent research firm in Carlsbad, Calif. According to the company’s survey of about 2,000 customers using computers, from which it received about 150 responses, Erbschloe figures that companies worldwide lost $7.6 billion in the first half of 1999 because of computer viruses–that’s more than five times the losses for all of 1998. “That includes about $1.4 billion to clean up results of the virus,” he explains. “And the rest was lost productivity.”

QoS is best for multimedia connections

An engineering axiom states that it’s easier to add features early in the design rather than retrofit them later. Ethernet and TCP/IP were designed to handle data transmissions, which are more forgiving than video or voice connections, so enhancing TCP/IP to support multimedia transmissions has been challenging.

Currently, information travels across most Ethernet networks in a random fashion. In a series of 10 packets, packet No. 8 may arrive at the destination before packet No. 6. The computer at the receiving end reorders the packets so the information is presented correctly to an end user.

Packet arrival order is not important with most data applications, but it is vital with video and voice transmissions. If packets arrive out of sequence, a video transmission may jumble or a voice connection may become garbled.

Bandwidth contention is a related problem. On an Ethernet network, bandwidth is parceled out on the fly. Suppose a user begins sending a large file when no one else is using the network and the transmission starts out fine. If a neighbor then starts to access a database, the transmission could slow to a crawl. With a file transfer, the only impact is that the user has to wait a bit longer.

Video and voice applications cannot tolerate such fluctuations. If two users are conversing and the available bandwidth shrinks, a transmission will jar or possibly break completely. So these applications require bandwidth to be available throughout the session.

Quality of service (QoS) solves these problems by opening up a clear communication line between two end points so packets can move unencumbered. ATM was designed from the ground up to support this capability.

In recent years, vendors have worked to retrofit QoS for Ethernet. While they’ve made progress, the options are not as robust as those found with ATM. “ATM now offers users four classes of services with three widely deployed; that is not the case with TCP/IP,” says Carl Engineer, director of marketing at Cisco Systems Inc.’s eWan Business Unit, in San Jose, Calif.

It’s not clear whether IP proponents will be able to match the level of QoS functionality that ATM offers. “IP equipment vendors must overcome a series of significant technical challenges to match ATM QoS,” notes Tim Hale, senior product marketing manager at 3Com Corp.’s Marlboro, Mass., office. “Can they be solved? I don’t see how it will be done, but I’ve learned in this business never to say never.” —P.K.