Cascade Family Overview

Application-aware network performance management

Riverbed® Cascade® is an application-aware network performance management (NPM) solution that provides IT operations the performance information they need to quickly find and fix network and application problems to keep business running at peak performance. It is the only solution to provide a single view across all networking architectures – traditional, desktop- and server-virtualized, and software-defined networks (SDN) – to meet the rapidly evolving needs of IT organizations.

Cascade products automate performance monitoring, enable smarter planning and decision-making, and facilitate problem diagnosis – up to 67% faster, according to third party analyst firm IDC. The elegant and simple design of Cascade products makes them easy to integrate with Riverbed Steelhead®and Stingray®products.


Cascade products integrate end-to-end network monitoring with deep packet capture and packet analysis for proactive alerting and robust network troubleshooting. As the only application-aware NPM solution to combine flow data and packet data into a single logical data store, Cascade products deliver a broad, yet detailed view into network and application performance.

The Cascade Difference
Available as an appliance or as fully virtualized software, Cascade products are the only application-aware NPM solution to provide end-to-end monitoring and troubleshooting across WAN, LAN, virtualized, and software-defined networks. Regardless of IT architectures in use, IT organizations can:

  • Speed problem identification and resolution
  • Protect user experience and productivity
  • Enhance IT collaboration and operational efficiency
  • Avoid or reduce IT costs

Cascade products ensure that the end-user experience is consistent and reliable, regardless of location or device. By providing a set of common views and metrics, Cascade products enhance cross-team collaboration and improve IT operational efficiency. Analytics-based early warning notification helps identify problems before they impact the business. And, when slowdowns or outages do occur, Cascade products speed problem identification and resolution, minimizing downtime. Finally, they help save money by identifying opportunities for consolidation, virtualization, and optimization, and by avoiding IT spending, such as unnecessary bandwidth upgrades.

An ROI study of Cascade customers conducted by IDC in 2012 found a remarkable three-year ROI of 519 percent, a payback period of just 5.1 months, and other major benefits:

  • Average annual savings of $43,601 per 100 users due to improvements in IT staff productivity, user productivity and other cost reductions
  • Reduction in network and application downtime by 67%, restoring 73 hours of productivity to each user and saving 26,057 per 100 users
  • Reduction in the average duration of help desk calls by 92%
  • Reduction of IT infrastructure costs by optimizing infrastructure through server consolidation, virtualization, and bandwidth management, annually saving $12,047 per 100 users
  • Enhanced IT productivity by automating and reducing management operations time by 12,000 hours or $5,497 per 100 users
[tab:Use Cases]

Customers use Cascade products in a variety of ways: to monitor and troubleshoot network and application performance; plan and troubleshoot new IT projects or application deployments such as virtual environments, VDI or VoIP; and, to assure the network meets security and compliance standards.

Application performance: Applications are the lifeblood of any organization. If end users cannot access an application, they typically cannot do their jobs effectively. Cascade products often provide the best vantage point for monitoring and troubleshooting application performance. End-to-end visibility and service-level dashboards based on powerful behavioral analytics enable IT organizations to proactively monitor, identify, and resolve emerging issues before end users call the help desk to complain.

Network monitoring and troubleshooting: As network demands and complexity increase, the need to monitor capacity, utilization, and other detailed information about traffic flowing on the network is essential. Cascade products monitor and troubleshoot network traffic from the data center to the remote branch and across a broad range of infrastructure, such as load-balanced or redundant configurations, virtualized networks, as well as 10G, QoS, MPLS, VPNs, SDN, and optimized WAN services.

Virtualization monitoring: The data center network is in the midst of a virtual transformation with virtual desktop infrastructure (VDI), server virtualization, and software defined networks (SDN). While these initiatives deliver business value, they also create blind spots that make it harder for IT operations to manage and troubleshoot network and application performance problems. Cascade products enable IT organizations to:

  • Understand and control SDNs using VMware VXLAN
  • Monitor and troubleshoot virtual data centers (VDC) and the physical network in a single solution
  • Deliver VDC owners isolated views into their own virtual data center performance and SLAs
  • Provide visibility into application performance across the virtual switch within virtualized server environments
  • Monitor VDI performance for VMware View (PCoIP) and Citrix XenDesktop and XenApp (ICA) protocols

Strategic IT initiatives: Cascade products can guide the success of IT projects such as consolidation, disaster recovery, cloud migration, and virtualization. Whether the IT organization is consolidating a few servers or entire data centers, Cascade products provide a cost-effective way to discover application servers and clients on the network and map the dependencies, without using agents or scanning.

Visibility into WAN optimized and virtual environments: Cascade products provide unparalleled reporting on Steelhead® optimized environments, and measure performance accurately in both optimized and non-optimized environments. This means network managers can get a level of detailed visibility into network and application performance that is incomparable to any other alternative.

Audit and compliance: Cascade products come with automated discovery capabilities that help with establishing and reviewing security and compliance policies. By understanding the location and dependencies of IT assets, Cascade products enable the IT organization to uncover all the moving parts of an application and identify and secure any gaps in coverage. Moreover, security analytics automatically monitor for unusual changes in behavior and proactively alert about changes that could indicate an emerging security issue. IT organizations can also use Cascade products to detect unusual surges in bandwidth that are characteristic of denial of service (DoS) attacks, host or port scans, the addition of new hosts or server ports, and suspicious connections.

[Tab:Product Family]

From the data center to branch offices, and even to employee laptops, the Cascade product family captures and monitors both flow and packet data including virtualized data across the entire network. Cascade products offer both software and appliance options to meet any deployment requirement.

Product Name Appliance Software Description Deployment
Cascade Profiler X X Centralized analysis and reporting console Data center
Cascade Shark X X Continuous packet capture and indexing Wherever packet capture is needed
Cascade Gateway X X Flow collection Data center or regionally
Cascade Sensor X   Layer 7 application classification and end-user experience Data center
Cascade Express X X All-in-one box that includes Cascade Profiler, Cascade Gateway, and Cascade Sensor capabilities Data center
Cascade Pilot X Packet, transaction and multi-segment analysis console Personal laptop
Steelhead, Virtual Steelhead, Cloud Steelhead, Steelhead Mobile X X WAN optimization that integrates with Cascade products to provide cost-effective remote site visibility and on-demand packet capture Branch offices, remote sites


Cascade® Profiler appliance: The centralized analysis and reporting console for the Cascade family, Cascade Profiler appliance correlates application-enriched network information collected by Cascade® Shark products, Cascade® Gateway appliances, Cascade® Sensor appliances, and even Riverbed Steelhead® products to enable enterprises to proactively monitor and troubleshoot both applications and the network, ensuring a consistent and reliable end-user experience.

Cascade® Profiler Virtual Edition: a virtualized version of the Cascade Profiler appliance that runs on VMware vSphere to provide added deployment flexibility for virtualized data centers and SDNs.

Cascade Gateway appliance: Cascade Gateway appliance collects flow data (NetFlow, sFlow, J-Flow, IPFIX and other popular flow statistics) from network devices, de-duplicates common information, and then forwards the data to the Cascade Profiler console for analysis. Deploying Cascade Gateway appliances in conjunction with Cascade Profiler appliance provides an easy and cost-effective way to gain end-to-end visibility into the types and usage of traffic on the network.

Cascade Gateway Virtual Edition: a virtualized version of the Cascade Gateway appliance that runs on VMware vSphere to provide added deployment flexibility for virtualized data centers and software-defined networks.

Cascade Shark appliance: Cascade Shark appliance delivers scalable, high-performance continuous packet capture and long-term storage, enabling real-time and back-in-time forensic analysis and reporting of network and security events. It is typically deployed wherever detailed and historical analysis is needed, such as within the data center, headquarters, or key branch offices. It can be used as an integral part of the Cascade visibility solution or as a standalone troubleshooting solution.

Cascade Shark Virtual Edition: This virtualized version of the Cascade Shark appliance runs in VMware vSphere environments. It taps into the virtual switch in the hypervisor to monitor the performance of all inter-VM traffic. It can both simultaneously and continuously capture and store packet data on the local server or on a storage area network (SAN) for back-in-time analysis with Cascade® Pilot software while also sending packet meta data to the Cascade Profiler console for analysis and reporting. It can also be used to “build your own” packet capture appliance. Leverage any virtualized server running VMware vSphere – such as an existing virtualized branch office server or a Cisco SRE blade on a Cisco Integrated Services Router (ISR G2) – to gain cost-effective remote visibility. Monitor branch LAN traffic by spanning from the switch to the physical NIC on the server in addition to monitoring intra-server (VM-to-VM) traffic.

Cascade Sensor appliance: This appliance performs deep packet inspection to supplement flow-based data with Layer 7 application classification, end-user experience, and performance metrics.

Cascade Pilot software: A robust packet and transaction analysis console, Cascade Pilot software provides fast analysis of multi-terabyte packet recordings on remote Cascade Shark and Steelhead products without having to transfer large trace files across the network. Fully integrated with Wireshark® software, the leading open source protocol analyzer (sponsored by Riverbed), Cascade Pilot software has an intuitive graphical user interface that maximizes user productivity by rapidly isolating the packets needed to diagnose and troubleshoot complex performance issues.

Steelhead products: All Steelhead models (Steelhead appliances, Steelhead® Virtual Edition, Steelhead® Cloud Edition, and Steelhead® Mobile software) can provide remote site visibility for the Cascade solution, enabling continuous monitoring of the optimized WAN environment and performing on-demand packet capture of application traffic on the WAN and branch LAN.

Cascade® Express appliance: This appliance is an all-in-one box that includes Cascade Profiler, Cascade Gateway, and Cascade Sensor capabilities. It combines flow collection, deep packet inspection, analysis, and reporting into a single appliance to provide an “instant-on” monitoring and troubleshooting solution for small to mid-size enterprises.


There are four primary deployment scenarios that can be achieved with the Cascade product family. Ask a Riverbed sales person to help determine what’s most appropriate for your organization’s needs.

Scenario 1: Application-aware network performance management. This scenario uses every product in the Cascade product family: Cascade Gateway appliance for flow collection from network devices distributed throughout the network, including non-optimized branch offices; Cascade Sensor appliance for Layer 7 application identification; Cascade Shark software that is embedded on Steelhead appliances for branch LAN visibility; Cascade Shark appliance in the data center for deep packet capture and analysis; and, Cascade Shark Virtual Edition for monitoring and troubleshooting virtualized environments. Cascade Profiler appliance provides the console that brings the disparate data sources together for analysis and reporting. Cascade Pilot software is the analysis console for packet analysis for Cascade Shark products.


Scenario 2: End-to-end flow visibility. Cascade Profiler appliance analyzes and reports on performance metrics provided by Cascade Gateway appliance (flow collection of the end-to-end network, including non-optimized branch offices) and Cascade Sensor appliance for Layer 7 application identification. This scenario provides proactive monitoring and troubleshooting, discovery and dependency mapping, network security, and WAN optimization analysis.


Scenario 3: Standalone packet capture and analysis. For customers who do not require the use of flow metrics for monitoring and troubleshooting, Cascade Shark appliance and Cascade Pilot software can be deployed with Cascade Profiler appliance for packet-based monitoring and troubleshooting. Steelhead appliances and Steelhead Mobile software also provide CascadeFlow to Cascade Profiler appliances as well as initiate on-demand packet capture for analysis by Cascade Pilot software.


Scenario 4: Fully virtualized environment monitoring. Cascade products support virtualization efforts, no matter how much or how little of an infrastructure is virtualized. They enable IT operations to find and fix network and application performance issues across the entire spectrum of virtualization, from the virtual desktop, to server virtualization, to the software-defined data center using software-defined networking. Only Cascade products can monitor and troubleshoot:

  • Application performance across the virtual switch within virtualized server environments using Cascade Shark Virtual Edition
  • VDI performance for VMware View and Citrix XenDesktop and XenApp protocols
  • SDN using VMware VXLAN


For customers seeking a fully-virtualized solution, the new Cascade 10.0 completes the virtualization of the product line with Cascade Profiler Virtual Edition, Cascade Gateway Virtual Edition, and Cascade Shark Virtual Edition for complete deployment flexibility.

[tab:What’s New]

With the announcement of Cascade 10.0, the Cascade product family is the leader in virtualization monitoring. The Cascade product family is the first and only application-aware network performance management (NPM) solution to provide comprehensive and unified visibility across the WAN, LAN, virtualized desktop and server environments, and software-defined networks (SDN) to meet the rapidly changing needs of IT organizations. Cascade 10.0 adds the ability to monitor and troubleshoot Citrix and VMware View virtual desktop infrastructure (VDI) and also embraces VMware VXLAN-based software-defined networking without sacrificing operational control. It meets the growing needs of IT organizations in enterprises, government, and public cloud and managed service providers for network visibility into load balanced applications, virtualized infrastructure, and software defined networks.

  • First-to-market performance management solution for SDNs – Cascade 10.0 now supports VMware® Virtual eXtensible Local Area Networks™ (VXLAN), providing the industry’s only application-aware NPM solution for SDN performance management. Realizing that companies that adopt VXLAN need the ability to monitor, troubleshoot, and report on network and application performance, Riverbed Technology and VMware have partnered to develop the new VXLAN-aware IPFIX format. The new format enables organizations to embrace software-defined networking without sacrificing operational control. Cascade products are the first and only to provide comprehensive and unified visibility across the WAN, LAN, virtual overlay networks, and cloud-based data centers.
  • Support for Citrix XenDesktop and VMware View – VDI holds the promise of dramatically simplified IT infrastructure, management, and security for enterprise data. Cascade 10.0 adds support for ICA and PCoIP, two popular VDI protocols used by Citrix XenDesktop and VMware View, respectively. With Cascade 10.0, customers gain insight into the usage and performance of VDI applications, which is not only critical to troubleshooting issues, but is also essential for optimizing the performance of these applications across both the WAN and LAN.
  • CIFS protocol support – the Common Internet File System (CIFS) is a network protocol that is commonly used for sharing files across the network. It is used by Microsoft operating systems and applications like SharePoint. While widely used, CIFS can be very “chatty” and inefficient especially across the WAN. Cascade 10.0 provides visibility into CIFS transactions, enabling customers to measure and analyze CIFS end-user activity, monitor application-level transactions, and provide metrics on commonly used files, transfer times, and errors. Customers using Riverbed Steelhead® products to optimize CIFS will benefit from understanding file transfer times and optimization benefits.
  • Virtualizing the Cascade product line – Cascade 10.0 completes the virtualization of the Cascade family. The new Cascade Profiler Virtual Edition, Cascade Gateway Virtual Edition, and Cascade Shark Virtual Edition provide deployment flexibility for managed service providers or enterprises looking to embrace virtualization and software-defined networks.
  • Additional Cascade 10.0 enhancements
    • Cascade Pilot View Editor – Cascade Pilot views are rich, visual representations of application and network data that streamline packet analysis and troubleshooting. Cascade Pilot View Editor introduces the ability to customize existing views or build new ones.
    • Pcap-ng support – Pcap-ng is the new default packet capture file format for Wireshark. Along with multiple interface types and annotations, pcap-ng can store host information, extend interface information, support nano-second granularity, and much more. Cascade 10.0 now supports pcap-ng files by default, allowing users to better leverage these new Wireshark capabilities.
    • 95th percentile reporting – New bandwidth-intensive applications such as video and social media are stressing the network and network administrators need an accurate way to identify high link utilization. 95th percentile is a widely used calculation for evaluating the regular and sustained utilization of a network connection and is useful for capacity planning and billing. Although 95th percentile reporting is the most commonly used metric, this feature is easily configurable to support other thresholds.
    • 1Gigabit Fiber NIC card – A new SFP-based 4-port 1-gigabit card that supports both SX and LX transceivers is now available for use with all Cascade Shark appliances.
    • Cascade Shark system diagnostics – Cascade Shark system diagnostics provides disk status, SNMP polling, and email alerting on Cascade Shark device, disk, and management interface health, alerting organizations immediately in the rare event of a system problem