It's a testing time for network testing. Not only are a host of new traffic types moving onto IP, but the competitive environment is changing fast too - open source is eating away at commercial developers' share of key areas such as protocol analysis, forcing the latter to work hard to rejuvenate themselves.

If you want to know what's currently driving their development efforts, look to Voice over IP, says Douglas Smith, the CEO and co-founder of Network Instruments, which develops the Observer protocol analyser, among other tools. When NI released the latest version of Observer last month, Smith says that VoIP support was the key area it enhanced.

"I don't think anyone believes the protocol analysis market is growing by leaps and bounds. The one thing that will make it grow is VoIP - I think VoIP will be added for free across the industry," he says.

"We always did VoIP - we decoded H.323 and had experts [analysis tools] for it. But we looked at what was out there and noticed a sea change over the last year - people were actually implementing VoIP, and not just in the lab."

This is true for NI itself, too, he says: "We purchased a new building and moved in July. Our engineers had used VoIP but the question was should we move to VoIP for everyone. We talked to all the major telephony suppliers and VoIP is the only option now - they don't have anything new to show that's not VoIP.

"The tools available were very technical and scientific though, they gave lots of statistics that were useless because they were about the sound, not telephony or the network."

So in Observer 11, NI added a set of VoIP-specific features, such as R-Factor and MOS scoring schemes for call quality - R-Factor is predominantly objective and MOS is predominantly subjective, so it is possible for one to be high (good) and the other low (bad) for the same call.

Smith adds, "We also show precedence - have you set QoS? Which ports are setting QoS incorrectly?"

Traffic types a-changing
VoIP is just one of a set of new traffic types which are beginning to impact network usage, and the next big one will probably be video-based.

"There are three types of data - data tolerant to delay, streaming one-way data, and two-way data that's intolerant of delay," Smith says, pointing out that most networks are tuned to handle the first type, which includes the likes of web and e-mail. It's the other two - streaming video, and applications such as VoIP and videoconferencing - that will be the disruptive ones.

He says that as well as handling new data types, Observer will also support more network types: "You'll see 10Gig first quarter next year, and we've doing more work with Fibre Channel too.

"We will continually increase our experts too. Even for someone knowledgeable, there's just too much to sort through, but the computer can automate that. All the expert does is look for patterns. "

He adds that his developers are also looking at new ways to apply expert assistance. For example, one possible future development might be a system that learns from the user's behaviour to auto-baseline the target network, although it could be risky if it guesses wrong!

Converging the code-bases
Smith reckons that the hardest part for his competitors will be getting all their tools onto common platforms. For example, he says Network General has good technology in the Sniffer analyser and its InfiniStream data logger, but the fact that the former is Windows-based and the latter is Linux means that the same device can't both log and analyse data.

He adds that some other companies also have a legacy of multiple different tools - for example, a portable analyser and a distributed version, which means that every time they add a feature or a new protocol it must be implemented individually on each platform.

"We are the only analyser company that has one single console for all its products - we unified them in 1995," he claims. "It means that when we add a feature it's added across the range.

"We released Observer in '94 and a distributed product, Analyst Probe, in November that same year. Then we had a new release of Observer and immediately got bombarded with requests for the same features in Analyst Probe. So we had the idea of killing the local product and only having one product that can talk locally or over the network - Observer today is actually the distributed product renamed, so you can connect from one laptop to a probe on another."

To some software companies, giving away that distributed functionality would have been anathema, but NI instead tried to "licence around it", Smith says. "The ability to interconnect is just part of our feature set."

He claims the company has also tried to avoid fighting the onrush of open source tools, such as the Ethereal protocol analyser, instead trying to work around it and look for new opportunities.

"We saw Ethereal coming a long time ago, it has pretty much destroyed low-end Observer sales," he says. "Where we saw opportunity is in two areas, the first is expert systems - they are very hard to write, it needs a lot of co-operative development and that's where Ethereal is going to be weak.

Heading into hardware
"The other is that four years ago we sold 95 percent software, now we sell 40 percent hardware - we developed appliances. You won't see Ethereal developing its own Gigabit card, so you will never get tight integration of hardware and software.

"Another piece that will be extremely difficult for Ethereal to do is remote processing at the probe, where you only transfer the screen across - a thin client method. Then you have the option to grab the raw data or a summary over the network."

Smith echoes his opposite number at Network General, Mike Pope, in saying what a boon the Network Associates years were for Sniffer's rivals.

"It was a wonderful seven years for us - they are our biggest competitor, we aim to replace them," he says. "We have sold 35,000 consoles, we figure there's 10,000 to 12,000 being used and 5500 under maintenance - we have around a 50 percent renewal rate. Se we figure we have about 7000 active users versus 13,000 for Sniffer."

He's combative too when asked about the threat posed by Network General's venture capital funding and its big R&D budget.

"What they don't fully understand is that during that time we exceeded them in technology," he claims. "They've got a long way to go to catch up.

"Also, VCs aren't in there for the long term, they get in there to get out. There will be a lot of pressure on them to produce the numbers to go public or sell out - in essence they're servicing $217 million of debt."

Looking forward, he says that one thing everyone in network analysis has realised is the importance of investing in training.

"We find if you train people on your software, they use it more and they get more from it," he concludes.