Protocol-analysis vendors, sensing weakness in market leader Sniffer since it was spun off from McAfee Inc. , have been ramping up efforts to steal away disgruntled customers. In July, Sniffer formed a new company called Network General Corp., in San Jose, Calif.
But is Sniffer really in a weak position? And what do competing vendors have to offer?
Stephen Elliott, senior analyst with International Data Corp., of Framingham, Mass., said the July transaction may have created some instability that led to a few customer wins for smaller vendors. But despite any customer losses -- Network General said there have been no major defections -- the spin-off is more of an opportunity than anything else for the company, Elliott said.
Debra Curtis, a research vice president at Stamford, Conn.-based Gartner Inc., said Sniffer may have been suffering from confused vision under the ownership of McAfee parent company Networks Associates Technology Inc., whose bread-and-butter products are McAfee security products.
"Network managers have a sense of relief about Sniffer, that it is going back to its roots," Curtis said. Now Network General can focus on Sniffer and not have to worry about security.
Sniffer still faces challenges that include repairing channel relationships and pricing issues that could open the door for the competition to chew away are more of the company's market share.
One challenge is a lack of differentiation in the protocol analysis market. Any of the main competitors to Sniffer, which include products from Network Instruments LLC, WildPackets Inc. and Fluke Networks offer products that in a broad sense are similar to Sniffer, said Elliott.
"With these other vendors, you can get 80% of the functionality [of Sniffer] for 75% of the price," Elliott said.
Or as Douglas Smith, president and co-founder of Network Instruments put it, "Sniffer is not worth twice the price."
Curtis, however, pointed out one of the biggest differentiators between Sniffer and its competitors is its expert analysis feature, which recommends fixes for network problems.
This was one of the deciding factors for the State of Indiana when it was evaluating protocol analysis products three years ago. The state's network supports 18,000 PCs.
Jeff Duke, the State of Indiana's senior network engineer, said he needed a product to monitor his core backbone links. Because of the critical nature of the monitoring, Sniffer's expert analysis feature was a must.
"We needed to have the expert analysis feature, and none of the competing vendors can touch it," he said.
The expert analysis feature remains one of the reasons that many customers are willing to pay more for Sniffer, Curtis said. But not every business needs that feature, she added, and for those that don't need it, other less expensive vendors may be able to provide the necessary tools.
Curtis said one key in evaluating a vendor is to look for hardware probes, especially as networks
While most vendors offer hardware-based protocol analyzers, not all products support all probes. For example, WildPackets does not support RMON probes.
And not all products are meant to cover both WAN and LAN traffic. WildPackets' product line also does not currently include a product to monitor traffic on ATM networks.
As WLANs have become more popular, many of the smaller vendors have jumped on that as a way to differentiate themselves from Sniffer. For example, Network Instruments offers a hardware probe with its WLAN package, something that Sniffer does not currently offer.
Network General's Sniffer has the broadest product line that covers the most technologies, followed by Network Instruments and then the others.
When picking a protocol analyzer, Curtis recommends balancing the company's needs and network growth with the vendor's offering. Many companies use multiple products on their networks. Some use one vendor for wireless, another for VoIP. Others want everything in a single package. It simply depends on what makes sense with the organization, she said.