Network Monitoring Equipment Market Report 2020

Network Monitoring Equipment
Annual Market Report
Publication Date: 24 June 2020
Matthias Machowinski
Table of Contents
Top takeaways: Monitoring equipment market back to stronger growth as service provider demand
recovers................................................................................................................................................... 4
Service notes ........................................................................................................................................... 4
Background ............................................................................................................................................. 5
Network monitoring equipment market accelerates in CY19 ................................................................ 6
Service provider demand is back ............................................................................................................ 7
Open switches stumble in CY20 .............................................................................................................. 9
Need for speed: 100G takes off, 40G hangs on, 400G enters the race ................................................ 10
Revenue per port continues to decline ................................................................................................ 12
North America, Asia Pacific drive growth in CY19 ................................................................................ 12
Market share ......................................................................................................................................... 14
Market drivers....................................................................................................................................... 19
Appendix ............................................................................................................................................... 21
© Omdia. All rights reserved. Unauthorized reproduction prohibited. Page 2

List of Tables
Table 1: Monitoring equipment by segment .......................................................................................... 6
Table 2: Monitoring switch ports by speed .......................................................................................... 11
Table 3: Average revenue per port ....................................................................................................... 12
Table 4: Monitoring equipment revenue by region (revenue) ............................................................. 13
Table 5: Monitoring equipment revenue by vendor ............................................................................ 17
List of Figures
Figure 1: Monitoring architectures ......................................................................................................... 5
Figure 2: Monitoring equipment forecast .............................................................................................. 7
Figure 3: Monitoring equipment revenue by vertical ............................................................................. 8
Figure 4: Monitoring switches: Advanced versus standard versus open ............................................. 10
Figure 5: Monitoring switches by port speed ....................................................................................... 11
Figure 6: Monitoring equipment revenue by region (percentage) ....................................................... 13
Figure 7: Monitoring equipment market share (revenue).................................................................... 17
Figure 8: Monitoring equipment market share by vertical (revenue) .................................................. 18
Figure 9: WAN changes, n=292 ............................................................................................................. 19
Figure 10: Top WLAN changes, n=169 .................................................................................................. 20

Top takeaways: Monitoring equipment market

back to stronger growth as service provider
demand recovers
After two muted years, the network monitoring equipment market returned to stronger growth in
CY19 with revenue up 5% to $624 million. Generally positive economic conditions, another strong
performance in the government vertical, and a return to growth in the service provider segment as
5G rollouts began in earnest all supported demand. North America was the top major growth
market, followed by Asia Pacific. The long-term driver of making networks more secure and reliable
remains intact, but CY20 will see a pause in growth caused by COVID-19, followed by reacceleration.
Omdia projects revenue of $760 million by CY24 for a five-year CAGR of 4%.
Key data points:
 Advanced switches accounted for 69% of monitoring switch sales in CY19 (flat from
CY18). Open switches didn’t make much progress in CY19 as startup Big Switch began
looking for a buyer and significantly lower price points limited revenue impact.
 Monitoring port shipments grew 11% in CY19 to almost 520,000. 10G ports are most
common and had a solid year owing to the availability of 10/25G ports. 40G began its
inevitable decline while 100G surpassed 40G for the first time. The next phase will be
the adoption of 400G. There were a few 400G shipments in CY19 to service providers in
Asia Pacific, but in general the 400G market has been delayed to 2021 because of low
availability, the cost of optics, and COVID-19. Still, Omdia expects 400G to expand
significantly over the coming years as data center operators upgrade from 25/100G to
100/400G.
 Government continued its strong performance from CY18 and grew at a double-digit
rate in CY19, up 12%. Enterprise returned to growth (up 1%) as did the service provider
segment (up 10%).
 North America is the largest region, accounting for almost two-thirds of total revenue.
North America recovered after a decline in CY18 as enterprise and service provider
demand came back. EMEA slowed sharply in CY19 as economic growth slowed in Europe
and the effects of Brexit started to have an impact. Asia Pacific grew again after a very
strong CY18 (up nearly 50%) as 5G deployments continue in the region.
 Gigamon is the largest network monitoring equipment vendor, accounting for 37.7% of
revenue market share in CY19; it was up 4.1 percentage points from CY18 and increased
its lead over the next closest competitor to 22 points. Ixia remains in second place with
15.9% of revenue (up 1.3 points), and NetScout rounded out the top three with 12.7% of
revenue (down 1 point).
Service notes
Since the last edition of this report, Omdia has extended forecasts through 2024.

Background
This report tracks the network monitoring equipment market, which consists of network monitoring
switches and taps/bypass switches. Network monitoring equipment is used to build parallel
monitoring networks that coexist alongside production communication and data networks,
capturing network traffic and sending it to traffic analysis tools, such as network monitoring systems,
application performance tools, and security appliances.
Organizations that want to capture network traffic don’t need to use dedicated network monitoring
switches—alternatively, they can mirror traffic using the built-in SPAN (switched port analyzer) ports
on Ethernet switches or by inserting network taps on the links that need to be monitored and
sending the traffic directly to the analysis tools. This approach will serve the average organization
well and avoids the expenditure of a dedicated monitoring network. However, for organizations with
a more complex network infrastructure and for whom the performance of their network plays a
critical role in their day-to-day operations, a dedicated network monitoring solution provides a more
robust and scalable approach to traffic capture.
The act of monitoring should not impact the performance of the network, but mirroring traffic using
SPAN ports adds additional processing load to the switch ASIC, which can impact the performance of
the switch when links are highly utilized or result in dropped SPAN traffic, making monitoring more
difficult when it counts the most. Captured traffic may also need to be sent to several tools at the
same time (e.g., performance monitoring, security), not just a single tool. Not all switches support
this feature, and those that do end up allocating an even greater portion of processing resources to
network monitoring rather than the core task of moving production traffic. Network monitoring
switches solve these issues by providing an infrastructure dedicated to monitoring that does not
impact production traffic and is scalable as monitoring needs increase. Figure 1 shows the difference
between a network where tools receive traffic directly (left) and one where traffic is first tapped by a
monitoring fabric and then sent on to the tools (right). With a fabric, traffic is tapped once and
retransmitted to as many tools as needed.
Figure 1: Monitoring architectures
Source: Omdia

The adoption of modern IT architectures is creating new blind spots for network monitoring fabrics.
Server virtualization and OS containerization means that traffic between virtual machines and/or
containers may not leave a physical server at all, making it impossible to tap this traffic at the
network core or access layer. Many organizations are adopting infrastructure as a service, such as
compute and storage, which is delivered from the data centers of large public cloud services
providers, where organizations can’t physically place network taps. Vendors have responded by
implementing various software connectors for popular public and private cloud infrastructures,
including VMware, OpenStack, Amazon AWS, and Microsoft Azure, to extend visibility into these
cloud deployments and allow organizations to extract relevant traffic.
Network monitoring equipment market

accelerates in CY19
Network monitoring equipment revenue grew 5% in CY19, reaching $624 million, as a generally solid
economy coupled with a return in service provider spending and as growing government spending
accelerated demand (Table 1). Growth had been muted during the previous two years owing to
weak enterprise and service provider demand and the adoption of open switches, which carry
significantly lower price points.
Port shipments grew at over twice the rate of revenue owing to the adoption of open switches,
which carry a much lower price tag and reduce the revenue contribution of hardware. This isn’t
necessarily a negative development as vendors’ key differentiators are in their software, and
software has much higher margins. Still, during this transition vendors will find it difficult to grow
their top-line revenue.
Table 1: Monitoring equipment by segment
Revenue ($m) Change (%) CAGR
CY18 CY19 CY24 CY19 vs CY18 CY19–CY24
Switches $493 $530 $643 7.5% 4.0%
Taps/bypass $100 $95 $117 -5.4% 4.3%
Total $593 $624 $760 5.3% 4.0%
Source: Omdia
In the 2019 edition of this report, Omdia forecast network monitoring equipment revenue to grow
4% to $638 million. Actual results of $624 million came in more or less as expected, just 2% below
the forecast.
For CY20, Omdia expects the market to fall 1% to $615 million due to the impact of the COVID-19
pandemic and the resulting drop in economic output around the world. Much of the decline will
come from enterprises while government and service provider spending remain steady.
Fundamentally, this market is driven by the need for robust network monitoring capabilities to
ensure the performance of mission-critical network infrastructure, and this driver remains intact.
Over the long-term, Omdia projects revenue of $760 million by CY23, a five-year CAGR of 4% (versus

a CY14–19 CAGR of 9%), as shown in Figure 2. Since the 2019 edition of this service, Omdia has
reduced the five-year forecast by 6% owing to the impact of COVID-19.
Figure 2: Monitoring equipment forecast
Source: Omdia
Service provider demand is back

The government vertical continued its strong performance over the past few years, with network
monitoring equipment revenue once again growing at a double-digit rate in CY19. Enterprise
demand returned, driving slight growth and buoyed by generally positive economic conditions. The
majority of enterprise demand comes from large enterprises (with over 1,000 employees), which
have very large networks with hundreds of network elements dispersed around the globe
underpinning mission-critical business processes. The balance, about one-third, comes from medium
enterprises (with 100–1,000 employees), and Omdia expects this segment to be a growth area as
these companies have historically lagged in adoption but now seek to make their infrastructure as
secure and reliable as that of large organizations.
 Finance is the number-one vertical by far in network monitoring revenue, and Omdia
estimates that it is on par if not bigger than government. The finance industry is well
known for running extremely high-performing networks to ensure timely transmissions
of transactions, has the resources to invest, and must adhere to numerous regulations.
 The second-largest vertical is technology, which includes SaaS providers and other
companies that rely heavily on web technologies to deliver their services. Because
network performance directly impacts their customers’ experience, they invest heavily
in monitoring.
 Beyond the top two verticals, the field widens and includes healthcare, manufacturing
and industrial, higher education, transportation, energy, and retail.

The service provider market as a whole remains challenging as service providers grapple with
bringing capex in line with revenue. According to Omdia’s Service Provider Revenue and Capex report
published in May 2020, service provider revenue fell 0.6% in CY19, and capex spending fell even
more, declining 1.6%. However, wireless capex is finally rising again (up 9%) after four years of
declines as service providers begin 5G upgrades in earnest, and that in turn is driving new service
provider demand for network monitoring equipment—revenue from service providers grew 10% in
CY19. Based on capex guidance, Omdia expects that CY20 will see an 8% bump in wireless capex—
even in light of COVID-19—to support network monitoring going forward. Service providers have
been early adopters of open switches, which have significantly lower average selling prices, and that
is a headwind to revenue growth.
There will be annual growth variations due to cyclical buying patterns, and long-term, we expect
government demand to lag enterprise and service provider (Figure 3). Enterprise growth will be
driven by down-market expansion (e.g., into medium enterprises). Service provider growth will be
driven in part by the next capex cycle, which is centered on spending on 5G networks. According to
Omdia’s Mobile Infrastructure Market Tracker, 5G investment started in 2018 at less than $1 billion
and is now taking off—revenue grew tenfold in CY19, will nearly double again in CY20, and is
expected to reach $29 billion by CY24. In general, monitoring is critical for service providers to
deliver their services, and they will need to upgrade monitoring infrastructure to keep up with the
significantly higher capacity and resulting traffic growth enabled by 5G. In addition, 5G is expected to
support new edge computing intensive use cases like autonomous vehicles, which will further drive
the need for pervasive monitoring as mobile networks begin to underpin mission-critical
communications.
Figure 3: Monitoring equipment revenue by vertical
Source: Omdia

Open switches stumble in CY20

Standard switches simply forward traffic to the relevant tools. Advanced switches have additional
packet processing capabilities built in that can be applied to captured traffic. These capabilities
include but are not limited to:
 Header modification
 Deep packet inspection
 Packet slicing
 Data masking
 Traffic deduplication
 Load balancing
 SSL decryption
 NetFlow statistics generation
Advanced switches prolong the longevity of tools by reducing the amount of traffic that is generated
by network monitoring and by offloading some of the processing from the tools to the monitoring
switch. For some deployments, advanced switches are also a necessity to remain compliant with
regulations, such as stripping sensitive personal data from monitored traffic. Advanced features
increase the utility of monitoring switches and drive even greater efficiency into the monitoring
infrastructure. For many buyers, investing in advanced switches will be cheaper than replacing
monitoring tools that no longer can handle the traffic loads directed at them.
Advanced switches account for the vast majority of monitoring switch sales (69% in CY19). Their
contribution has declined from a high in 2016 because of growing interest—particularly from service
providers—in open switches, which are based on standard commercially available Ethernet switches.
The trend toward open switches (15% of revenue in CY19, down 1 percentage point from CY18) has
manifested itself in a number of ways over the past few years. Initially, startups like Big Switch
developed proprietary monitoring software that leveraged standard Ethernet switches. This was
followed by traditional network monitoring vendors launching their own turnkey standard Ethernet
switch–based offerings (integrated hardware/software, rebranded, and fully supported) to offer a
lower cost monitoring alternative. More recently, traditional vendors have made their software
available on a standalone basis, allowing end users or system integrators to select their own
compatible hardware. Open switches don’t support advanced packet processing (yet), which is done
on external service nodes or advanced switches, but they will be sufficient for networks with less
complex needs or to serve as aggregation switches to feed traffic to advanced switches for further
processing. Open switches didn’t make much progress in CY19 as startup Big Switch, a key provider
in this segment, began looking for a buyer. In addition, significantly lower price points limit open
switches’ impact on revenue. Still, Omdia expects that over the long term, the revenue contribution
from from open switches will rise as revenue for standard switches declines (Figure 4).

Figure 4: Monitoring switches: Advanced versus standard versus open
Source: Omdia
Need for speed: 100G takes off, 40G hangs on,

400G enters the race
Unsurprisingly, 1G ports are on the way out, relegated to low-bandwidth applications and legacy
devices. The most common type of port on monitoring switches now is 10G by far, a reflection of the
fact that monitoring switches capture traffic from access switch uplinks and aggregation/core
switches, which usually run at speeds of 10G and higher. 10G had a solid year owing to the
availability of 10/25G ports (Omdia does not currently break these out and instead includes them
under 10G). 25G ports only have a small price premium (if any) over 10G and have proven very
popular in production networks (12 million shipped last year); these ports are the natural choice for
buyers even if they don’t yet have plans for 25G. Looking ahead, Omdia believes 10G-only ports will
decline as the market shifts to 25G-capable ports (Figure 5).
40G was a high-growth market until CY16, but growth has slowed dramatically since and turned
negative in CY19. This is in line with trends in production networks, where 40G port shipments have
been declining since CY17 as data center operators shift to 25/100G.
100G had a banner year in CY18 with ports nearly doubling, and growth continued in CY19,
surpassing 40G for the first time (Table 2). Service providers initially embraced 100G, and adoption is
expanding to enterprises and data center operators. The launch of QSFP28-based 100G technology
has improved the density and cost of 100G solutions and has driven a surge in 100G adoption in
production networks, which in turn is accelerating demand for 100G on monitoring switches.
The next phase in port speeds will be the adoption of 400G. 400G is in its very beginning in
production networks, and there were a few initial monitoring port shipments in CY18 and CY19 to
service providers in Asia Pacific. In general, the 400G market has been delayed because of low
availability and the cost of optics, and COVID-19 is delaying deployments further due to site closures,

which are pushing back lab tests and trials. Deployments likely won’t take off in earnest until 2021.
We expect deployments to broaden significantly over the next few years as data center operators go
through the next network upgrade cycle from 25/100G to 100/400G.
Finally, port shipments overall experienced healthy growth at roughly twice the rate of revenue
growth. Improving performance and security is a perennial goal of network operators, and
availability of lower cost solutions will enable companies and service providers to monitor their
networks more pervasively.
Table 2: Monitoring switch ports by speed
Port shipments Change (%) CAGR
1G 23,968 16,479 0 -31.2% -100.0%
10G 325,998 357,860 423,582 9.8% 3.4%
40G 62,180 57,215 4,744 -8.0% -39.2%
100G 55,856 88,064 391,099 58% 34.7%
400G 180 125 55,447 -31% 238.4%
Total 468,182 519,743 874,873 11.0% 11.0%
Source: Omdia
Figure 5: Monitoring switches by port speed
Source: Omdia

Revenue per port continues to decline

Average revenue per switch port declined 11% in CY18 and another 3% in CY19 (Table 3). This is
primarily owing to adoption of open monitoring switches, which jumped in CY17 and CY18 but
leveled off in CY19. Omdia expects continuing declines through CY24, with open switch adoption
offset by new or bundled features and the shift to higher value ports (e.g., 100G, 400G).
Taps/bypass switch revenue per port (or, more accurately, tapped link) is significantly lower than
switch revenue per port—in many cases, these are passive devices without any electronics that do
the job of splitting the optical signal. Tap/bypass switch revenue per port only slightly declined in
CY18, helped by a greater proportion of bypass switch sales. Taps do not benefit as much from the
move to higher speeds as the tap technology is determined primarily by the fiber type and laser used
and not the actual rate of the link. But, as a smaller segment, there is less focus on disruptive
technologies (relative to switches), which is keeping pricing steadier, at least for now. For many of
the network monitoring equipment vendors tracked in this report, taps are an important segment
but secondary to their core business of network monitoring switches, where there are more
opportunities for innovation and differentiation.
Table 3: Average revenue per port
Revenue per port Change (%) CAGR
Switches $1,053 $1,019 $735 -3.2% -6.3%
Taps/bypass $378 $357 $320 -5.6% -2.2%
Source: Omdia
North America, Asia Pacific drive growth in CY19

North America recovered after a decline in CY18, with CY19 revenue up 7% and monitoring ports up
16% as companies continue to make significant investments in monitoring infrastructure. North
America is the largest region for network monitoring equipment (approximately two-thirds of
worldwide revenue), home to some of the world’s largest companies, data centers operators, and
service providers. They operate critical communication networks, and their networking
requirements tend to be more advanced than in other regions, making them a natural fit for
network monitoring deployments. We don’t think that’s going to change anytime soon, ensuring
that North America will remain the top revenue contributor for network monitoring equipment for
the foreseeable future.
A secondary factor for the large dominance of North America is the fact that most of the vendors
tracked in this report are headquartered in North America, and the home region is typically the
primary target market. The home region also tends to have a higher proportion of direct sales, which
increases revenue for the vendor, whereas international markets are served through distribution
channels, which leaves a greater portion of end-user spending with the channel.

EMEA and Asia Pacific are the two other major regions for network monitoring equipment sales.
Growth in EMEA slowed sharply after growing at a double-digit rate in CY17 and CY18 as economic
growth slowed in Europe and Brexit began to have an impact. Asia Pacific grew again after a very
strong CY18 (up nearly 50%) as 5G deployments continue in the region.
Table 4: Monitoring equipment revenue by region (revenue)
Revenue ($m) Change (%) CAGR
North America $384.6 $409.9 $483.6 6.6% 3.4%
EMEA $106.4 $108.3 $126.5 1.8% 3.2%
Asia Pacific $88.0 $91.1 $128.0 3.5% 7.0%
CALA $13.8 $15.0 $21.9 8.3% 7.9%
Worldwide $592.9 $624.3 $760.1 5.3% 4.0%
Source: Omdia
Looking ahead, we expect Asia Pacific to continue its growth leadership as economists forecast
above average GDP growth in the region. Asia Pacific will grow faster than North America,
benefitting from the adoption of critical communication and networking technologies that will drive
companies to deploy network monitoring equipment, as well as vendors looking beyond their home
markets to drive new growth.
Figure 6: Monitoring equipment revenue by region (percentage)
Source: Omdia

Market share
Gigamon is dedicated to the network monitoring equipment market and is perhaps the best-known
vendor in this space. The company was founded in 2004, went public in 2013, and was taken private
by Elliott Management in 2017. Gigamon has over 3,500 customers, including 83 of the Fortune 100
companies; the 10 largest US Federal Government agencies; and 7 of the top 10 global banks. Key
enterprise customers come from the financial services, healthcare, and technology industries.
Gigamon has a full portfolio of network monitoring equipment, addressing the whole range of
deployments from small to very large.
Gigamon’s Visibility and Analytics Fabric enables network and/or security operations teams to
extract network data from key network points, apply intelligence, transform the captured data, and
send it on to security and monitoring tools. At the core of this platform is the GigaVUE HC series, its
latest generation of visibility appliances, all of which support advanced transformation features
(GigaSMART), such as packet filtering, header stripping, load balancing, packet slicing/masking, SSL
decryption, deduplication, metadata generation, and NetFlow generation. Application intelligence,
NetFlow, and deduplication are among the top-selling GigaSMART applications. To cost effectively
broaden the reach of monitoring fabrics, Gigamon offers traffic aggregation nodes (GigaVUE TA
series) based on standard Ethernet switch designs.
As organizations migrate their applications to cloud architectures, Gigamon has implemented
various software connectors for private and public cloud environments, including AWS, Microsoft
Azure, VMware, OpenStack, and Docker/Kubernetes containers (added in 2019) to help customers
maintain complete visibility, including into their virtual and cloud environments. Gigamon also offers
RESTful APIs that allow third-party applications (e.g. Ansible), SDN controllers, and monitoring tools
to program the visibility fabric (e.g., to change traffic forwarding policies).
Over the past few years Gigamon has expanded on its core focus of data acquisition, transformation,
and delivery by adding more analytics capabilities. In May 2019, it launched its Application
Intelligence framework, which can identify over 3,000 IT applications, create application metadata
(e.g., protocol or application attributes), visualize network usage of applications, and forward
specific application traffic to operational tools for further analysis. And in October 2019, Gigamon
launched ThreatINSIGHT (based on its 2018 acquisition of ICEBRG), a cloud-based application that
uses machine learning to detect and rank network security threats and gives administrators tools to
investigate and respond to threats.
Gigamon’s network monitoring equipment revenue grew 18% in CY19 on strong US federal
government sales and service provider demand in North America and Asia Pacific. Gigamon reported
high customer interest in its application intelligence capabilities (application visualization, filtering,
and metadata), inline TLS decryption, 100G solutions, and high-end monitoring products such as the
GigaVUE-HC3. Gigamon also reported its first 5G design win in North America. Gigamon is the largest
network monitoring equipment vendor by a solid margin, accounting for 37.7% of revenue in CY19,
up 4.1 percentage points from CY18 and increasing its lead over the next closest competitor to 22
points. In the government market, Gigamon’s lead is even bigger at 58% of CY19 revenue; Gigamon
also leads the service provider market with 27% share.

Ixia is a subsidiary of electronics design and testing company Keysight Technologies with ~$450M in
annual revenue and has its heritage in network testing. In 2012, Ixia expanded into network
monitoring through 2 acquisitions: Anue Systems (monitoring switches) in June 2012 and Net Optics
(taps, tap aggregators, and bypass switches) in December 2013. Ixia counts 77 of the Fortune 100
and 47 of the top 50 carriers among its customers, and monitoring is a natural extension of Ixia’s
core testing business, making up one-quarter of Ixia’s annual revenue. Ixia was acquired by Keysight
in April 2017 and is now fully integrated into Keysight, operating as the Ixia Solutions Group.
Keysight views Ixia as fully complementary as it increases its software and testing capabilities and
expects its sales channels to help drive broader adoption of Ixia’s offerings.
Ixia gets a majority of its business (about 70%) from security deployments (the balance comes from
application/network performance deals) and as such is seeing high demand for its bypass switches,
where it has made investments to stay at the forefront of new technologies (for instance, Ixia
started shipping 100GE bypass switches at the end of 2019).
In 2017, Ixia launched the Vision Edge series, a standard Ethernet switch–based monitoring switch
with Ixia branding and support and also made Vision Edge OS available for certain Edgecore
switches. Ixia offers software-based monitoring (CloudLens) for private and public cloud
deployments, including AWS, Azure, Google, Alibaba, VMware, and containers.
In 2019, Ixia refreshed its high-end portfolio with the Vision X, a 100G platform with modular ports.
In 2020, Ixia followed this up with a smaller 2RU system (up to 64 100G ports) and an application
module, which is Docker-based and can host Ixia’s AppStack (application identification, filtering) as
well as other capabilities that Ixia is currently developing.
Revenue was up 15% in CY19 as the service provider market recovered and North America and Asia
Pacific delivered strong growth; enterprise demand and EMEA were steady. Ixia reported strong
demand for 100G monitoring and expects 400G demand to materialize in CY21—a delay of about
one year, in-line with industry trends. Ixia became the number-two provider of network monitoring
equipment in CY18 and grew share further in CY19 with 15.9% of revenue (up 1.3 points).
NetScout has been in business for more than 30 years and focuses on application and network
performance management, where they have amassed over 20K enterprise customers, including two-
thirds of the Fortune 1000 and 165 service provider customers across 48 countries. At the core of its
offering is the nGeniusONE service assurance platform, which provides an overarching view of all IP-
based services infrastructure and applications, real-time monitoring, historical reporting, analysis,
and troubleshooting tools. nGeniusONE collects a variety of metrics from local servers, embedded
agents, and network taps.
In 2011, NetScout entered the monitoring switch market with its acquisition of Simena (fixed
monitoring switches), followed by the 2012 acquisition of ONPATH (modular switches and advanced
management). In 2015, NetScout acquired Danaher’s communication business to increase scale and
enter the cyber intelligence market, and as part of the deal, NetScout took ownership of VSS
Monitoring. VSS has helped NetScout grow its presence in EMEA and fill out its switching portfolio at
the high end.
In 2017, NetScout revamped its monitoring switch strategy, embracing hardware adhering to Open
Compute Project (OCP) specifications. Although NetScout will continue to offer its traditional
products, the emphasis going forward will be on OCP-based products, which will be offered in three

ways: as a turnkey, NetScout-branded and supported appliance (the PFS 5000 series); certified,
where approved resellers offer and support a bundled hardware/software solution; and qualified,
where customer purchase software from NetScout and install it on the OCP hardware of their
choice. OCP-based products are generating significant interest and account for more than half of
NetScout’s packet flow switch revenue. In 2019, NetScout added support for VMware NSX
environments to its vStream virtual appliances and achieved FIPS certification for nGenius, which will
help address US federal government requirements and regulated verticals such as healthcare and
finance. NetScout also launched the PFS7000 packet flow switch with in-line packet forwarding
capabilities (e.g., for active inline security applications).
NetScout is the number-three provider of network monitoring equipment (12.7% of total market
revenue in CY19, down 1 points) and is second in the service provider (21.5%) and government
(10.3%) segments. NetScout’s monitoring equipment revenue has been declining over the past few
years, in part due to the shift to lower cost switches based on OCP certified hardware designs and
pure software sales; port shipments, on the other hand, continue to grow. Although this may appear
to be a negative development, it fits with NetScout’s push into software and its use of monitoring
switches to improve the effectiveness of its core service assurance business. Service provider
revenue grew while enterprise and government declined, owing in part to a tripling in software
sales.
APCON is a privately held company that was established in 1993 and focuses exclusively on the
network monitoring equipment market. APCON differentiates on ease of use and scalability—it
offers a range of switching hardware from 1RU to 14RU chassis that use a common set of software
and blades. APCON is active in 40 countries and targets Fortune 1000 companies; it is also expanding
into the mid-size enterprise market. APCON’s customer base includes 26 of the Fortune 100
companies and 9 of the top 10 US banks. Its customers hail from the financial industry (its number-
one vertical), service providers (number two), government, healthcare, and manufacturing.
In 2018, APCON launched its next generation of appliances, the Series 4000, targeting high
performance networks. In 2019, APCON added a 9RU version for higher port density as well as
advanced packet processing features. APCON has on-premises private cloud support (VMware, KVM)
and public cloud support for Amazon AWS; Microsoft Azure support is in the works. APCON is the
fourth-largest network monitoring equipment vendor with 8.0% of total market revenue in CY19
(down 0.5 points) and is third in the enterprise segment.
Cubro is a private company founded in 2003 and headquartered in Austria, with offices in North
America and Asia Pacific. Cubro works closely with leading mobile infrastructure providers to provide
the monitoring function in mobile networks and has experienced significant growth over the past
few years. Cubro’s offerings include the EX (up to L4) and EXA (up to L7) series of packet brokers,
complemented by network TAPs and probes. Cubro caters to the high performance requirements of
its service provider heavy customer base. Over the past year, Cubro has implemented software
consistency across the various CPUs in its offering (it now has Tofina-based switches) and is rolling
out a controller-based solution (Asteria Visibility Controller) in 2020 to enable automation across
large-scale networks. Cubro now offers virtual tapping for Kubernetes, Openstack, and VMware. It
was the first vendor to introduce 400G products (in CY18), which make a small contribution. Cubro is
the fifth-place vendor with 4.3% of total market revenue in CY19, down 1.6 points, and is in second
place in Asia Pacific.

Table 5: Monitoring equipment revenue by vendor

Revenue ($m) Change (%)
CY18 CY19 CY19 vs CY18
Gigamon $199.7 $235.7 18.0%
Ixia $86.3 $99.2 15.0%
NetScout $80.9 $79.3 -2.0%
APCON $50.3 $50.1 -0.4%
Cubro $35.0 $27.0 -22.9%
Niagara Other $15.2 N/A
cPacket $11.4 $13.1 14.5%
Worldwide $592.9 $624.3 5.3%
Source: Omdia
Figure 7: Monitoring equipment market share (revenue)
Source: Omdia

Figure 8: Monitoring equipment market share by vertical (revenue)
Source: Omdia

Market drivers
When Omdia surveys organizations about the major changes they are planning to make to their
networks, time and again, the top unprompted responses revolve around improving network
security and network performance. Security is a major concern for companies as hacking has evolved
from hobby into a multi-billion-dollar industry. Security breaches are not some obscure event but
affect millions of people, cost significant resources to remedy, and can lead to loss of customer
confidence, lost revenue, fines, and in some cases bankruptcy. Security threats have reportedly
increased during COVID-19, making enterprises’ need for improved security even more urgent. New
applications and changes in IT architectures are driving significant growth in network traffic, driving
organizations to make upgrades to ensure adequate network performance.
The next two charts are taken from our February 2019 Enterprise Edge Connectivity Strategies and
our July 2019 WLAN Strategies and Vendor Leadership studies and show the top three changes
companies plan to make to their WAN and LAN, respectively, over the next 12 months, and the
relative importance of security and performance.
Figure 9: WAN changes, n=292
Source: Omdia

Figure 10: Top WLAN changes, n=169
Source: Omdia
Improving the security and reliability of networks are the key drivers of the network monitoring
equipment market. As a critical component of IT and communication infrastructure, network
outages or degradations have a widespread impact on the availability of IT applications, which in
turn reduces productivity and leads to lost revenue. When outages and degradations are caught
early on, their impact on the organization can be minimized. Organizations understand this
relationship, which is why they are making network performance and security a priority.
In our 2016 study The Cost of Server, Application, and Network Downtime, which examined the
frequency, length, cost, and causes of information and communication technology (ICT) downtime,
such as servers, applications, and the network, we found that the cost of ICT downtime is
substantial, from $1 million a year for a typical mid-size company to over $60 million for a large
enterprise. In aggregate, downtime is costing North American organizations $700 billion per year.
Network interruptions are the top source of downtime, and the top strategy to reduce downtime is
to implement network monitoring. This allows IT staff to quickly be alerted when performance
metrics aren’t met, allowing them to work on a solution immediately and shave crucial minutes or
hours off the length of each downtime event.

Appendix
Methodology
Below are the definitions for the products included in this service. Please see Methodology in the
market size/share/forecasts Excel file, located in the service portal section for this report.
Network monitoring equipment: Used to build parallel monitoring networks that coexist alongside
production communication and data networks; consists of the following segments
 Monitoring switches: Dedicated switches that duplicate and forward network traffic to
network management, monitoring, and/or security systems for network visibility and
traffic analysis
 Standard: Monitoring switches that only forward traffic; may have filtering capabilities
 Advanced: Proprietary switches with additional packet processing capabilities such as
header modification, deep packet inspection, packet slicing, data masking,
deduplication, SSL decryption, etc.
 Open: Based on off-the-shelf Ethernet switch hardware designs; includes both the
switch hardware and switch operating system software (if sold separately)
 Taps/bypass switches: Devices that are inserted into network links; taps send copies of
network traffic to out of band monitoring devices; bypass switches can redirect traffic to
in-line monitoring/security appliances or let traffic flow unimpeded, depending on the
health of the appliance
Customer types: Network monitoring equipment sold to the following types of organizations:
 Service provider: Provide IT and communication services; includes telcos, competitive
and mobile carriers, and cloud services providers
 Enterprise: Small, medium, and large businesses
 Government: Governmental organizations
Author
Matthias Machowinski, Senior Research Director, Enterprise Networks and Video
Citation Policy
Request external citation and usage of Omdia research and data via citations@omdia.com.
Omdia Consulting
We hope that this analysis will help you make informed and imaginative business decisions. If you
have further requirements, Omdia’s consulting team may be able to help you. For more information
about Omdia’s consulting capabilities, please contact us directly at consulting@omdia.com.

Copyright notice and disclaimer

The Omdia research, data and information referenced herein (the “Omdia Materials”) are the
copyrighted property of Informa Tech and its subsidiaries or affiliates (together “Informa Tech”) and
represent data, research, opinions or viewpoints published by Informa Tech, and are not
representations of fact.
The Omdia Materials reflect information and opinions from the original publication date and not
from the date of this document. The information and opinions expressed in the Omdia Materials are
subject to change without notice and Informa Tech does not have any duty or responsibility to
update the Omdia Materials or this publication as a result.
Omdia Materials are delivered on an “as-is” and “as-available” basis. No representation or warranty,
express or implied, is made as to the fairness, accuracy, completeness or correctness of the
information, opinions and conclusions contained in Omdia Materials.
To the maximum extent permitted by law, Informa Tech and its affiliates, officers, directors,
employees and agents, disclaim any liability (including, without limitation, any liability arising from
fault or negligence) as to the accuracy or completeness or use of the Omdia Materials. Informa Tech
will not, under any circumstance whatsoever, be liable for any trading, investment, commercial or
other decisions based on or made in reliance of the Omdia Materials.

CONTACT US
omdia.com
askananalyst@omdia.com

Network Monitoring Equipment Market Report 2020

Uploaded by

Copyright:

Available Formats

You might also like

Network Monitoring Equipment Market Report 2020

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Network Monitoring Equipment Market Report 2020

Uploaded by

Copyright:

Available Formats

Network Monitoring Equipment

Annual Market Report

Publication Date: 24 June 2020

© Omdia. All rights reserved. Unauthorized reproduction prohibited. Page 2

© Omdia. All rights reserved. Unauthorized reproduction prohibited. Page 3

Top takeaways: Monitoring equipment market

© Omdia. All rights reserved. Unauthorized reproduction prohibited. Page 4

© Omdia. All rights reserved. Unauthorized reproduction prohibited. Page 5

Network monitoring equipment market

© Omdia. All rights reserved. Unauthorized reproduction prohibited. Page 6

Service provider demand is back

© Omdia. All rights reserved. Unauthorized reproduction prohibited. Page 7

© Omdia. All rights reserved. Unauthorized reproduction prohibited. Page 8

Open switches stumble in CY20

© Omdia. All rights reserved. Unauthorized reproduction prohibited. Page 9

Figure 4: Monitoring switches: Advanced versus standard versus open

Need for speed: 100G takes off, 40G hangs on,

© Omdia. All rights reserved. Unauthorized reproduction prohibited. Page 10

Figure 5: Monitoring switches by port speed

© Omdia. All rights reserved. Unauthorized reproduction prohibited. Page 11

Revenue per port continues to decline

North America, Asia Pacific drive growth in CY19

© Omdia. All rights reserved. Unauthorized reproduction prohibited. Page 12

© Omdia. All rights reserved. Unauthorized reproduction prohibited. Page 13

© Omdia. All rights reserved. Unauthorized reproduction prohibited. Page 14

© Omdia. All rights reserved. Unauthorized reproduction prohibited. Page 15

© Omdia. All rights reserved. Unauthorized reproduction prohibited. Page 16

Table 5: Monitoring equipment revenue by vendor

Figure 7: Monitoring equipment market share (revenue)

© Omdia. All rights reserved. Unauthorized reproduction prohibited. Page 17

Figure 8: Monitoring equipment market share by vertical (revenue)

© Omdia. All rights reserved. Unauthorized reproduction prohibited. Page 18

© Omdia. All rights reserved. Unauthorized reproduction prohibited. Page 19

Figure 10: Top WLAN changes, n=169

© Omdia. All rights reserved. Unauthorized reproduction prohibited. Page 20

© Omdia. All rights reserved. Unauthorized reproduction prohibited. Page 21

Copyright notice and disclaimer

© Omdia. All rights reserved. Unauthorized reproduction prohibited. Page 22

You might also like