CloudShield Predicts Bright Future With New Investment

With a carrier class investor, and a flexible product, the company aims for cash flow positive next year.

by Alex Goldman ISP-Planet Managing Editor [September 17, 2007]

Sunnyvale, Calif.-based CloudShield's system doesn't come cheap. It's modular, so it can come in a bewildering variety of configurations, and can be customized, but a basic starting price could be $100,000.

Today, the company is announcing a new round of funding led by Tektronix, a massive company that specializes in the monitoring of network and computer performance.

According to Bill Scull, CloudShield vice president of marketing, Tektronix sees in CloudShield a best of breed deep packet inspection (DPI) platform for its service. He says Tektronix has carrier customers in over 100 carriers in over 40 nations, and that can only be good for CloudShield.

In its latest presentation to investors [.pdf], page 9, Tektronix claims to be number one in the network diagnostics and network management markets, which it says are each worth over $400 million (but a plurality of its sales are more basic items: oscilloscopes).

Selling to carriers
"When we talk to service providers, we talk to one of four groups," says Scull. "We talk to Network Engineering, Marketing, Network Operations, and Network Security."

Although each has slightly different concerns, each starts with wanting to know what's going on in the network, and that requires DPI, the basis on the CloudShield product.

You can do so many things with DPI that the CloudShield replaces many boxes at a typical large service provider, Scull claims. "Often, they buy a box for each problem. They have a box for call detail records, a box to monitor VoIP, a box to stop DOS attacks, but that's a solution that doesn't scale. It has a lot of issues, but the biggest issue is training people on all these boxes. So people start to look at a multi-application box like ours. Carriers are sensitive to OPEX, and the multiple pizza box approach is 2x to 10x more expensive."

Convergence of services
We normally think of convergence as the joining of voice and data networks. For CloudShield, security and bandwidth management are converging around its core competence, DPI.

"Historically, we thought about security as separate from service control," says Scull. "But, along with our customers, we see a blurring. Let's say [you've got a customer with bandwidth issues]. It could be Bit Torrent, or it could be a botnet."

It's one problem, and you don't need two boxes to do DPI and then allocate the problem to one of them. "Savvy operators see they need only one box to look at packets and do both service control and security," says Scull.

CloudShield touts three services on the section of its website devoted to service providers: P2P management, DNS protection, and DDOS prevention. But Scull says that the company's carrier customers deploy over 50 services using its DPI platform.

So how do you make it easier for carriers to develop their own services? "At the development environment and software level, we have a language called RAVE. It's a high level language optimized for working with packets. We've build modules that developers can use as building blocks, such as an analysis can reporting module, a CDR module, etc."

Scull takes the opportunity to tout the benefits of the rest of the system, too. He says that analysis, while detailed, results in latency in microseconds, "unlike Linux boxes, which add milliseconds."

He says CloudShield offers carrier class reliability and remote management. He adds that the data plane and control plane are physically separate, like the separation between service and control in a traditional carrier SS7 network. Finally, he says that you can add, subtract, update, and reconfigure applications on the fly.

If you've got a network that needs the sort of high performance features CloudShield offers (ability to process 2.5 Gbps Ethernet on one box, 16 million simultaneous flows, etc.), check out CloudShield.

— End