Riverbed Advances Open Source Network Analysis with Wireshark

Monday Jun 13th 2011 by Sean Michael Kerner

Why is Riverbed keeping Wireshark open source and what does the future hold for open source tools at the networking vendor? -

Riverbed is known in the market as a leading vendor of WAN optimization hardware solutions. Riverbed is also a leading sponsor of one of the most popular open source network applications, the Wireshark packet and network analyzer.

Riverbed's involvement with Wireshark comes by way of its acquisition of CACE, a technology vendor whose executive team includes the founder of Wireshark, Gerald Combs. Riverbed's open source networking credibility however goes back even further than the CACE acquisition. Steve McCanne, the CTO of Riverbed is the co-creator of the tcpdump command line packet analyzer.

The tcpdump project in turn is also supplemented with the WinPcap effort for Windows, which was started by Loris Degioanni, who was also at CACE and is now part of Riverbed with McCanne and Combs. Wireshark supports 1,168 protocols and gets approximately 400,000 downloads a month.

"The project is one of the most successful in the open source world, that's based on the fact that the community has always been strong," Degioanni said.

The Wireshark community this week is gathering for the SharkFest conference, which is a proof point for the continuing strength of the community. Degionnia noted that the Wireshark network analyzer is a project that has fostered a great community, as developers around the world keep adding protocol support as new technologies emerge.

From a commercial perspective, CACE and now Riverbed do not directly monetize or commercialize the core open source Wireshark project.

"The model of CACE has been to enhance the Wireshark experience and build projects at the periphery with things that enhance the experience," Degioanni said.

To that end CACE built a network analyzer called Pilot and a packet recorder called Shark appliance. Those products have recently been integratedinto the larger Riverbed product portfolio. Now as part of Riverbed, the former CACE executives are continuing to push the open source Wireshark project forward.

"We are open source fanatics," Degioanni said "We picked Riverbed because they are the ones that understand open source and what it takes to keep the community happy and they understand that investing in something that is free makes good business sense."

As a proof point, Degioanni noted that Combs is working full time on open source Wireshark and the Sharkfest event is set to have the best attendance ever. "We don't view Wireshark as a corporate asset, it's the community's asset," Steve McCanne, the CTO of Riverbed told InternetNews.com. "What we value is the connection we have to that community and the fact that we can build our products in a way that complements Wireshark in a way that no other vendors had done."

Going a step further, McCanne noted that it makes sense to keep network packet capture in the open source community. He added that there is a community of developers ,where everyone knows that Wireshark is the place to go for packet capture.

"It's a great place for open source to live," McCanne said. "Where we have innovated is this whole area of being able to have visibility into the enterprise networks."

From a licensing perspective, Degioanni stressed that a dual-licensing model would not work for Wireshark and Riverbed. He noted that dual-licensing works when a vendor is trying to make money from an open source tool, which is not Riverbed's goal.

"Wireshark does a really good job at what it does," Wireshark founder, Gerald Combs told InternetNews.com. "Other companies have tried to bury Wireshark and then let features bubble up into a product, which is a really dumb approach."


Mobile Site | Full Site