Level 3's Ewert on Customer-Defined Networking

DENVER -- NFV & Carrier SDN -- Thanks to the likes of Google and Amazon, among others, business customers want deeper insights into the products and services that are provisioned by carriers.

With the advent of SDN and better analytics, service provider customers no longer need rudimentary widgets or user interfaces to see what's going on. In order to offer more programmability for its business customers, Level 3 Communications Inc. (NYSE: LVLT) has evolved from on-demand services to "customer-defined networking," according to Travis Ewert, senior vice president of global network software.

"The whole point there is give them the ability to custom define their experience," Ewert said after taking part in a panel at last week's NFV & Carrier SDN event in Denver. "Everything we're doing is very much about showing them what is going on."

By using SDN, orchestration, analytics and automation, Level 3 is able to create a feedback loop for its customers that can be very granular or a big-picture snapshot depending on how they want to define their usage.

Level 3 provides business customers with an inventory list of what they want to know about their services and whether they want to take action themselves or have Level 3 step in.

"What do you want us to do about it? Do you want human action, automated action or control action?" he said. "If the vision is a heavy emphasis on being able to show them whether it's a threat, a performance thing, a flow, or any of those type of things, we give them the means to custom define how it all works."

With an SDN-enabled service such as dynamic capacity, a customer may decide to set and forget a maintenance schedule for the same day and time each week, Ewert said. They could also pre-set bandwidth levels to scale up or scale down during certain timeframes.

"If we can get the action ability down to the things that really matter for the customer and let them have a role in defining it, that's back to the customer-defined experience," Ewert said. "Sometime back we introduced the capability where they can see on a segment-by-segment basis performance data like latency loss, jitter, utilization and flow data.

"We give the customer the ability to define what's important to them, whether it's alerting like 'Tell me when this link hits this latency,' or when something else happens. It's the ability to program the alerting piece, or to tell them what is going on, with the control layer piece that might be tied to that."

Service providers have been on their own self-discovery journey of not just gathering large pools data, but using it to create meaningful information that translates into actionable items across networks and services. It wasn't that long ago that service providers relied on hardware at the edge of their networks that used probes to collect data from streams before collating it with other information that would then take days or weeks to process.

"The biggest problem with service providers going back is that we've been data rich and action poor," Ewert said.

There are a host of vendors that are helping service providers come up with meaningful data, but carriers can differentiate their services and applications by making that data actionable for their customers. It boils down to a better customer experience for those end users.

"If we can get the actionability down to the things that really matter for the customer and let them have a role in defining it, that's the customer-defined experience," he said. "We think that there's a whole lot more opportunity for customers who want access to actionable data, but some don't want to see all of it."

Too much information without context can be an anchor for a customer, but Level 3 does have some large enterprises that want it all. Ewert said that Level 3 has Fortune 100 companies that want everything in order to do their own analysis of the data.

"I can't name names, but think of some of the biggest cloud guys or biggest smartphone suppliers," Ewert said. "We provide native feeds where they get it all, but those are folks that have their own data analytics and AI groups where they doing something unique with that information.

"In the CDN, it's really interesting to see where some of these guys out there -- whether its folks providing Game of Thrones streams, or folks from an Amazon perspective -- are doing with real-time load balancing across providers based on performance. Don't be surprised when you see enterprises start do the same thing."

With all of the improvements for data analytics, Ewert said service providers still needed to be more proactive, including across individual domains with better actionability on basic threshold crossings. "When I say individual domains that could be across flow data, active metrics, passive metrics, or other domains to be able to take action ahead of a customer issue," he said. "Along with that, the nut I think a lot of us service providers are still trying to crack is to be able to correlate all of those domains. So when I say correlate I mean the ability to take log data, latency data, ticket data, fault data, jitter -- all of those data sets -- and be able to look for anomaly intersections, threshold crossings, whatever, across all of those data feeds at once."

Ewert said a data point could include active metrics, log data and flow data, all of which can add up to millions of events per minute. To date, artificial intelligence and machine learning aren't up to processing that mountain of data.

Ewert said that machine learning "gets interesting" around exception-based or anomaly-based traffic patterns. When anything out of the normal pattern occurs, machine learning can be used to throw off an alert.

"It could also be telemetry algorithms for something that is outside of the norm. There are things that are always driven by capacity where there's some usage pattern from a customer," Ewert said. "But there are also things that might not fit a signature. For example a DDoS attack where all of a sudden you've got links saturated. Is it a throughput usage issue or did they get bombarded by the latest IoT botnet?"

As service providers have migrated to virtualization in their networks, they need a different type of analytics for understanding inventory, Ewert said.

"Now all of a sudden that inventory is not a static port here, or port there with a record in the middle," he said. "Now it's a function that sits on a container and moves from one place to another place. Not just the telemetry around things like VNF management, but how do you manage that asset, have an inventory of where it is and what happened to it performance-wise if there's a change? There's a whole bunch of things that I think us service providers need to get a better understanding of."

— Mike Robuck, Editor, Telco Transformation