This article is based on analysis originally published on lightreading.com (January 2017). The core architectural principles remain relevant for any organization managing hybrid or multi-cloud monitoring strategies.
The Cloud Visibility Gap
The rapid migration to cloud infrastructure is driven by compelling advantages: elastic capacity, reduced operational overhead, and the business agility that comes from being able to provision and decommission resources on demand. Yet cloud adoption introduces a trade-off that many organizations underestimate until something goes wrong—the loss of deep network visibility and control that physical infrastructure naturally provides.
A survey of businesses on their virtualization practices found that only 37% monitored their virtualized environments with the same rigor as their physical networks. That gap is not a minor operational inconvenience. It represents a significant blind spot for security, performance management, and compliance.
Why Visibility Is Harder in Virtualized Environments
In a traditional data center, traffic between servers traverses physical links where taps and probes can be inserted at well-defined points. In a virtualized environment, a substantial portion of network traffic never hits a physical wire. Virtual machines on the same hypervisor host communicate over virtual switches entirely in software, invisible to hardware-based monitoring tools.
This East-West traffic—traffic moving laterally between workloads inside the data center—typically accounts for the majority of total traffic volume in virtualized environments, with estimates frequently cited in the 70–80% range. If you are not explicitly capturing it, you are missing most of what is happening on your network.
The risks are concrete:
- Malicious lateral movement between virtual machines can go entirely undetected by perimeter security tools.
- Software-defined networking layers introduce additional complexity and potential misconfiguration that is difficult to audit without traffic-level insight.
- Application performance issues between microservices are invisible without intra-environment monitoring.
The Fire-Hose Problem: Why Naive Tapping Fails
The instinctive solution—insert virtual network taps everywhere and forward all captured traffic to monitoring, analytics, and security tools—runs into an immediate scaling problem. Because East-West traffic volumes are enormous, blindly forwarding everything floods downstream tools. Those tools were typically dimensioned for a fraction of total traffic and cannot absorb the full firehose of virtual network data without degrading or dropping packets.
The answer is intelligent, selective capture: extract only the traffic that is relevant to a given monitoring or security use case, and broker that filtered traffic to the appropriate tool. Doing this correctly in a dynamic cloud environment requires the visibility infrastructure itself to be as elastic as the workloads it monitors.
Four Key Requirements for Cloud Monitoring Visibility
Whether you are operating a public cloud, a private cloud, or a software-defined wide-area network (SD-WAN), four architectural requirements determine whether your visibility solution will actually work at cloud scale.
1. Horizontal Scale
Cloud environments scale up and down rapidly in response to workload demand. Virtual taps and the capture infrastructure around them must follow suit automatically—without requiring manual IT intervention each time capacity changes. If an application expands to handle ten or a hundred times its baseline user load, the virtual taps monitoring it must scale elastically at the same time and at the same pace, without degrading the application’s own performance.
Taps that require static configuration or manual provisioning become operational bottlenecks in any environment that leverages auto-scaling.
2. Visibility Between Security Segments
Virtualized networks are commonly segmented using virtual firewalls and micro-segmentation policies to limit the blast radius of a compromise and enforce least-privilege communication between services. This is good security practice—but it also means that monitoring must extend into each segment and across the boundaries between them.
Virtual taps need to capture traffic flowing between segments so that security teams can verify that the policies governing each segment are actually being enforced. Without inter-segment visibility, a misconfigured rule or a policy bypass could go unnoticed indefinitely.
3. Container Traffic Coverage
Container adoption has grown alongside, and often faster than, virtual machine adoption. A single application may run across multiple containers, and an organization with hundreds of virtual machines may run thousands of containers. Each container represents a potential monitoring blind spot if the visibility solution was designed only with VMs in mind.
Virtual taps must be capable of accessing traffic at the container level, not just the hypervisor or VM level, to provide complete coverage of modern application architectures.
4. DevOps Elasticity and Fault Tolerance
In a DevOps environment, the state of the infrastructure is in constant flux. New builds deploy frequently, existing services update, and individual containers or VMs may exist for minutes rather than months. The monitoring infrastructure must accommodate this ephemerality without losing continuity.
Consider the challenge of retrieving captured traffic from a container that no longer exists—the tap must handle archiving and handoff gracefully when a monitored workload terminates. More critically, if a monitored application fails, the tap must not fail with it. The visibility layer must be fault-tolerant and decoupled from the lifecycle of the workloads it monitors so that it can provide a continuous, reliable record of network activity regardless of what happens to individual components.
Network Packet Brokers: Managing the Data Flow
Once virtual taps are deployed and capturing traffic, the captured data must be distributed intelligently to the appropriate tools. Network packet brokers (NPBs) sit between the taps and the monitoring or security tools and perform several critical functions:
- Deduplication – Removes duplicate packets that arise from capturing traffic at multiple points, preventing monitoring tools from processing the same flow twice.
- Filtering and grooming – Strips irrelevant traffic and forwards only the data that each downstream tool needs, preventing tool overload.
- Load balancing – Distributes traffic across multiple instances of a tool to maintain throughput as volumes grow.
- Protocol slicing and header stripping – Reduces packet sizes where full payloads are not required, further reducing downstream bandwidth requirements.
With a packet broker layer in place, security systems and analytics tools receive a clean, relevant, manageable subset of traffic rather than a raw firehose—enabling them to operate effectively at scale.
Environment-Agnostic Architecture
The four requirements above apply regardless of where virtualized workloads run—public cloud, private cloud, or SD-WAN. Locking visibility tooling to a single platform or cloud provider creates the same problem as the original visibility gap: parts of your environment become dark as workloads move or expand across providers.
A well-designed visibility solution is environment-agnostic: it abstracts the monitoring infrastructure from the underlying platform so that the same policies, tools, and workflows apply whether traffic is flowing inside a private VMware cluster, an AWS VPC, or a containerized Kubernetes environment.
Summary
Cloud agility and deep network visibility are not mutually exclusive—but achieving both requires deliberate architectural choices. The key principles are:
- Deploy virtual taps that scale automatically with workload changes.
- Ensure tap coverage extends across virtual security segment boundaries.
- Include container-level capture, not just VM-level capture.
- Make the monitoring layer fault-tolerant and decoupled from application lifecycles.
- Use network packet brokers to filter, deduplicate, and distribute traffic intelligently to downstream tools.
Organizations that invest in this architecture gain the cost and agility benefits of cloud migration without surrendering the visibility needed to maintain security, performance, and compliance across their entire infrastructure footprint.