Endace Share Discussion Threads

[gargoyle2] 13/4/2012 12:52

Knackers, thanks for your posts on here. I'm a holder and welcome your insights. You seem to have your finger on the pulse as far as EDA is concerned.

[knackers] 13/4/2012 12:33

Ed, not sure on the exact balance outstanding at 31 Mar 12, but this settlement is a sizeable chunk of that and will draw a welcome line under this episode. Since that incident the Endace sales manager, Gary Woods, who joined Rsignia has moved onto two other orgs (one of them a brief stint at I/O card manufacturer Napatech).

Further, Endace have themselves, replaced their own US sales mgt team. Jason Moore (ex EMEA head) has been running things in the US since Sept/Oct time. Attention has clearly been given to getting the right team in situ in the US market which frankly will determine whether this is a $60m or a £100m t/o business in the next 3 years.

[edwardt] 12/4/2012 12:12

that settlement relates to debts from us govt related contract? from memory this has been hanging around for 2 years + - suppose management may have focused on sorting this out in an attempt to meet numbers... - is the figure less than originally sought??

[knackers] 12/4/2012 09:06

Well, well! Not wrong there, Aspex, that's an encouraging turnaround to say the least! My focus was on those cash balances and at $5.4m that's considerably above my best estimates. I know for a fact the forward pipeline is strong and obviously good to hear again about this growing interest from the enterprise sector. That's where the gravy is....but they'll still need help to fully exploit the US market. So who will the tie-up be with I wonder... ;o) This will also strengthen there hand in those discussions, with or without Deutsche Bank's involvement.

No question, this is really welcome news (even though those other deferrals still grate) but I sense there'll be plenty of excitement to look forward to in the near term - by that I mean before the middle of May.

[aspex] 12/4/2012 08:17

Not too many companies can give out a profits warning (however mild), and come back positively after just a few days.

[mikepompeyfan] 12/4/2012 08:08

... and not surprisingly the share price is back on the way up. I bet those who got stopped out by the original announcement are not best pleased.

[mikepompeyfan] 12/4/2012 07:18

How strange. Under a month ago we are told to expect profits of $1m and a cash balance of $4m. Now we are told it will be a profit of $2.2m and a cash balance of $5.4m. If the cash settlement with Rsignia and the good trading in the last two weeks were so close perhaps they should have held back the trading update for a few more weeks. Still, good news for us.

[knackers] 05/4/2012 16:30

New recruitment drive: 16 vacancies on the endace website

Amongst them the most notable are these new Channel Sales Manager roles for US, EMEA and Aus/NZ. Almost confirms the likely direction as a global channel partnership/strategic alliance. Should that be the case the big $xM question, will that partner be offered equity in Endace? I guess with Deutsche on board quite possibly...

Interesting times ahead. I think we'll know more within the month.

[knackers] 05/4/2012 10:18

Don't think it would be impossible, Aspex, but almost as tough as having a go building one yourself from scratch! The fact is the DAG technology is now proven/guaranteed and Endace have a reputation for doing this stuff very well. Further they've now built an optimised high throughput capability 40-100gb/s and analytics "solution" around that h/w.

Very, very few western companies genuinely have this 100% capture capability, understand it and are able to support it. It's niche stuff - not a mass market product by any means.

And to your point, would a Western Govt agency buy a network monitoring card from a chinese manufacturer - who didn't know how it worked and what exactly was behind the firmware. Not a chance.

[aspex] 05/4/2012 09:53

Just as expected when Selwyn sticks his head above the parapet in the NBR (read by the right side of the political spectrum in general) he is likely to be sprayed with random bullets.
All good for Endace but we have been told their system of firmware is almost impossible to back engineer. That is my only fear with the Chinese

[aspex] 05/4/2012 09:53

Just as expected when Selwyn sticks his head above the parapet in the NBR (read by the right side of the political spectrum in general) he is likely to be sprayed with random bullets.
All good for Endace but we have been told their system of firmware is almost impossible to back engineer. That is my only fear with the Chinese. On the other hand, even if they succeed in some way, no western organisations will buy it from them.

[knackers] 05/4/2012 09:11

What an interesting article, Mike! Of course Selwyn still has a healthy interest in Endace ;o)

I can see this debate is going to run and run, fact is the internet is seriously blurring national boundaries. To my mind there is good internet behaviour and there is criminal cyber activity - hacking, ID/IP theft etc. If the monitoring isn't there how do you safeguard and protect people, IP and internet reliant infrastructure. What is the mechanism for recourse? Then what happens to confidence in that network? But the monitoring MUST have appropriate oversight.

The chinese are prolific and extremely talented hackers, frankly much of their work in acquiring boat-loads of IP from western Insts and companies has already been done. There's a war going on in cyber space and it's totally unregulated/unpoliced. Small wonder Western Govts need monitoring capabilities. The idea and ideal of a self-regulating and open internet was a lovely idea - but horribly 'naive'... If there are no rules and there is no oversight, I'm afraid people have a habit of misbehaving.

If I were a NZ Govt official I'd be less worried about Huawei's monitoring and much more concerned about targeted and highly effective state-sponsored hacking and criminal cyber activity targeting their critical infrastructure (Banks etc) and national Insts (Govt agencies). Action has to be taken and there will inevitably be a privacy impact...but the balance MUST be right.

[mikepompeyfan] 05/4/2012 05:37

Govt naïve about Huawei – security insider details Beijing experience
Chris Keall | Thursday April 05, 2012 |

Huawei operates "hand-in-glove" with the Chinese government and its military-heavy surveillance apparatus, according to a leading NZ tech entrepreneur who had rare opportunity to observe the company at close quarters.

He told NBR of a government and corporate culture in China where electronic eavesdropping is so taken for granted that no sensitive information is sent by email; of his surprise at heavy anti-Western sentiment; and his certainty that government and commercial secrets worldwide are at constant risk of exposure.

Anyone who followers Selwyn Pellett on Twitter will know he's skeptical of Huawei's involvement in the $1.35 billion public-private Ultrafast Broadband (UFB) project.

"As someone who sold internet 'monitoring' for a living (2001-2007) I'd be worried about having Huawei in my govt funded internet backbone," Mr Pellett tweeted on March 28.

Then, in reaction to an NBR story on the Judith Collins ACC email controversy, he commented:

"The good news is soon we can ask Huawei to do some [internet data packet] inspection on the fly to tell us who did the leak. Lucky we went that way!"

Yeah, yeah, whatever, you could say. Following the events of the past fortnight, every man and his dog has an opinion, or at least conspiracy theory, about Huawei, the Chinese telecommunications equipment maker that was recently barred from bidding on Australia's National Broadband Network following cyber-spying accusations. Huawei also faces an Australian government investigation into its proposed Perth-Singapore undersea cable. And in the US, lawmakers have blocked Huawei from bidding on a big telecommunications contracts, blocked its bid to takeover networking company 3Com, and pressured Huawei and US security company Symantec into dissolving a half billion dollar joint venture.

But Mr Pellet has had much closer access to Huawei than most, and has extensive experience in the global information technology security industry.

"My background is that I've sold network surveillance into probably 30 countries around the world," said the tech entrepreneur, speaking to NBR at the Newmarket, Auckland, offices of one of his current ventures, Imarda (which sells fleet-tracking technology).

He was the co-founder and, from 2001 to 2007, chief executive of computer network security company Endace (he resigned from the board in 2010 and has sold most of his shareholding. Endace is still headquartered in Auckland, but is listed on the London Stock Exchange's AIM Index - LSE:EDA - with a market cap of £77.38 million).

Endace emerged from the commercialisation arm of the University of Waikato.

Academics had developed clever ways to capture analyse data, which is sent over the internet in "packets" ( and indeed the university is still doing intriguing research into the way we use internet data, notably before and after the recently passed internet file sharing law).

"It was all about packet capture," Mr Pellett told NBR. The headers were analysed, but the payload (such as the content of a message) was ignored. Companies used the technology to make sure data traffic was flowing smoothly through their networks.

"Then 9/11 came along and suddenly people wanted more than packet capture – they wanted content analysis," Mr Pellett said.

"And that's when Endace's business went from network monitoring to network surveillance and we started dealing with national security agencies all around the world."

Between 2001 and 2007, Mr Pellett met and did business with more than 30 security agencies, or their governments, around the world. All were Western or Western-friendly, he told NBR.

Endace also sold its technology to Chinese universities and research institutions. Mr Pellett says he assumes promptly reversed engineered his company's network cards and the software that runs them (and some will note Endace's technology has been helped along by our government, both in its University of Waikato genesis, and more recently through a $6.7 million grant; Endace has reciprocated by keeping its corporate and R&D staff in Auckland and Hamilton, and moving manufacturing home from Asia back to Christchurch).

But in , in retrospect, does it seem like a mistake?

No, Mr Pellett said. Universities all around the world attempted to reverse-engineer the technology and learn who it worked. Endace provided the technology to efficiently capture data – the needle in a haystack of packets – but it was up to the customer what they did with it, and whether they paired it with surveillance tools or other software (and as 9/11 paranoia eases and the company expands, Mr Pellett emphasises Endace now sells most of its product to the likes of banks and financial services companies).

The thinking at the time was that it was best to make a few sales for a small amount of money rather than be ripped off

In 2007, he Endace and Huawei were the two principal sponsors of a security conference held in Beijing.

Mr Pellet showed NBR a series of photos and documentation from the event.

The attendee list was heavy on Huawei staff, government officials and military representatives.

"Bear in mind that this was 2007, so it's a long time ago. But the relationship between Huawei and the government was hand-in-glove and nothing happens in China without the government's approval."

There was obviously and relationship between the Huawei and the Chinese government.

Beyond that, Mr Pellett was surprised by the whole tone of the event.

"I sat in that room as one of two Western faces amongst hundreds of people and I listened for hour on end," Mr Pellot said.

"[It] was an eye opener to me to see how anti-Western the Chinese are."

He did not speak Chinese, but was sitting by an Endace salesman who – reluctantly, at times – interpreted for him.

"To be in a room full of hundreds of people and have them screaming on stage ... They were ranting and raving saying they would not and the government should not buy Western technology. They could do it all."

But surely – if a little over-enthusiastic – this was essentially the same "buy local" sentiment expressed by patriotic or protectionist factions in every country?

Are we talking economic nationalism, or a desire to push security interests?

Mainly the former, but a bit of both, Mr Pellet said.

Many for economic, but it's both

He noted that at the time the Chinese government was building what is known as new Great Wall of China, a huge firewall – involving 50,000 servers, according to documentation from the 2007 Beijing conference – designed to monitor internet traffic moving in and out of country.

The government was seeking better network technology, and better surveillance technology.

Mr Pellett noted the accusation by Cisco (the largest US maker of network gear) claimed Huawei had pirated the software code that runs Cisco hardware, using it as the foundation of its own routers.

The Chinese government could have done something about the Cisco case but chose not to, Mr Pellet said.

(Huawei said the copying was inadvertent, less than Cisco claimed, and the code since removed from its products.)

One of Mr Pellet's key points is that many governments are now working closely with large technology companies to monitor internet traffic.

"We have a very naïve view," he told NBR.

"What was going on in the decade between 2001 and 2011, and certainly after 9/11, was governments didn't give a damn about their internal laws. Stuff was going on all over the world that nobody knew about."

In the US, the Patriot Act extended state surveillance power, but elsewhere, things were less official.

"There are countries around the world that have got laws against monitoring their own citizens and those laws were broken," Mr Pellet said.

"I've been in countries around the world were people have told me it doesn't happened.

"And I've thought that's interesting, because I know your government's bought all this kit and how it's probably being used."

And the persuasive surveillance culture goes beyond borders, Mr Pellett said.

What would Mr Pellett have done about Huawei's proposed transtasman undersea cable, or its involvement, already underway, in supplying fibre and network management services for around 30% of the Ultrafast Broadband (UFB) project (though being one of several companies enjoying preferred supplier status with state-owned Crown Fibre Holdings, and its subsequent contracts with Christchurch UFB winner Enable and Ultrafast Fibre, which hold the UFB contracts for Hamilton, Tauranga, Whanganui and other North Island towns).

I'd just say to the government, "Do you want to feel comfortable with your national security, yes or no?," Mr Pellet sid.

"You're choosing partners to align with. If [US company] Cisco is 5% more expensive does it matter?"

"And if you're leaking information, would you rather be leaking it to the US or leaking it to China.

There are choices that governments can make.

"I suspect the citizens of the New Zealand would be more comfortable with the information leaking back to a US source than leaking back to a Chinese source."

Certainly, were US and Australian authorities have actively blocked Huawei from bidding on public or private projects, our government has actively played match maker. For example, in 2010, then ICT Steven Joyce included 2degrees staff on trade mission to China, which included a meeting with Huawei. 2degrees – which already used Huawei as its main network partner – later expanded its relationship to include a $100 million credit line from the Chinese company.

And Prime Minister John Key played cheerleader for Huawei, talking up the company's ability, and pricing, on TVNZ's Q&A as it angled for UFB-related supplier contracts.

Could it be that the government is aware of our allies' security fears over Huawei, but, as with the Crafar Farms deal, sees potential advantage for New Zealand's struggling economy if it's seen as the most China-friendly Western country?

Are we simply seeing hard-nosed pragmatism?

"They're playing a dangerous game," Mr Pellet replied.

"I remember Labour celebrating the free trade deal with China and I was thinking Do you realise what you've done?"

The free trade deal was a disaster for intellectual property, from agriculture to technology, Mr Pellett said.

" We're sitting here playing by purist rules, but the same rules do not apply [elsewhere]."

"They're being incredibly naïve – this government and the last.

"I don't care who reads my emails, but if I were the government I'd care who reads theirs."

[knackers] 03/4/2012 11:58

Interesting and of course it was Dr Ian Graham who developed the DAG card as a Waikato Uni project to timestamp ATM transactions. Though not sure of Endace's involvement here, am aware that they've been working on a mobile security solution for the past year or so with a few confidential pilots underway. Back in Sept there was still a wee bit more investigative and development work to do on that, sounded like another 6-12 months min - I got the sense it was a fairly significant dev.

FWIW I think from a dev perspective EndaceVision has been the priority, then EndaceExtreme (100gb/s).

[edwardt] 03/4/2012 11:32

ARM Holdings PLC (ARM.LN), Gemalto N.V (GTO.FR), and Giesecke & Devrient Tuesday announced the creation of a joint venture dedicated to delivering a trusted, secure environment for advanced services running on smartphones, tablets and other smart connected devices.

apparently new zealand is trialling nfc technology so that the 'mobile wallet' can become a reality. the logic being that if it works in nz then the rest of the world will adopt. Apparently nz was the first place to adopt the atm machine!

anyway, note arm has a tie up with gemalto which covers the security aspect of this. Vodafone are leading the trial in nz...

[mikepompeyfan] 28/3/2012 16:26

Endace: The 'Google of Packets'
Networking monitoring provider offers 100% packet capture with zero latency or loss but it will cost you.

By Paul Rubens | Mar 28, 2012
Fast networks are harder to monitor than slow ones, and if monitoring systems can't handle the speed they will end up dropping packets. It's a simple fact, but one which is becoming increasingly relevant as organizations move from 1Gb Ethernet (GbE) networks to 10GbE, 40GbE and even 100GbE infrastructure.

Related Articles

Network Security Essentials: Deep Packet Inspection
Cisco Expands Next Gen Firewall Capabilities
Next-Generation Firewall Buyer's Guide: SonicWALL
Intel Preps New Networking Processor
Next-Generation Firewall Buying Guide
"There is increasing demand for products that can do very rapid packet capture," said Dianna Kelley, a partner at security consultancy SecurityCurve. "Network pipes are getting bigger than ever, and companies need to monitor their networks for compliance reasons, to ensure that policies are being followed and, above all, for security reasons. If they can't capture all their traffic then they simply can't do that."

One company that is addressing this problem is New Zealand-based Endace. The company sells network monitoring appliances equipped with its own data acquisition and generation (DAG) cards, which the company claims guarantees 100 percent packet capture at full line rate.

Traditional NIC cards are unable to do this, but DAG cards' on-board field-programmable gate arrays enable smart packet-processing to be managed in the hardware. A large first in, first out (FIFO) memory buffer allows packets to be captured off the wire at full line rate without a single packet being dropped, according to Tim Nichols, Endace's vice president of Marketing. The company's appliances have been proven to work without dropping packets at speeds of 12Gbps, he said.

Endace appliances rely on the company's Linux-based OSm operating system, and can run monitoring and security applications from Endace's bundled Application Suite, or most other applications that customers want, running in a virtualized environment, which the company calls the Endace Application Dock.

"This Application Dock is very important as it allows Endace customers to use their own software if they want," said Kelley. "Configuration can be very hard and takes a long time, so if a company buys an Endace appliance they can keep all the nice rules they have written. They don't need to rip and replace."

The Application Suite that is bundled with every device includes a latency monitor, a NetFlow generator, a packet access program, and a SNORT based intrusion detection system. A gap detector application that monitors multi-cast market data feeds for duplicate packets, out of sequence packets and other anomalies is also available at an extra cost.

Later this quarter, the company intends to introduce a new version of OSm. This will come with Endace Vision, a tablet optimized, browser-based application that replaces most of the functionality of the Application Suite. Nichols said this will enable customers to:

Set up and monitor a range of alarms for network performance, network latency and security anomalies through a single consolidated dashboard.
Visualize traffic related to any kind of event or anomaly by bandwidth utilization down to 100 microsecond resolution and application type.
Drill down into traffic to access higher resolution information about a particular host, user or application.
Overlay detected anomalies on top of traffic visualizations to add color and context to an investigation.
Share visualizations among users utilizing integrated screen sharing capabilities and save standard visualizations for future reference.
Download packets of interest associated with an event from any point across the network for a full forensic investigation inside a protocol decoder.
The company sells two appliances: EndaceSensors and EndaceProbes. The Sensors can run a single application, contain no on-board traffic storage, and are designed for deployment near the network edge. The more complex Probes are designed for deployment nearer the network core, and enable captured traffic to be written to disk. They can also run multiple applications at once: ones from the Endace Application Suite as well as third party and custom applications. Both the Sensors and the Probes come in a range of different models with varying port and storage configurations.

"After a security breach, in order to work out what has happened, you need the packets, and you need them quickly," said Nichols. "We are selling the ability to search and mine packets on high speed networks with a high level of accuracy and get any packets in a few seconds. We are the 'Google of packets', if you like."

Endace doesn't have the market to itself, however. It competes with other products from established vendors like Solera Networks , Niksun, NetWitness and NetScout Systems. But Kelley believes Endace's strength is hardware; ensuring that its DAG cards are optimized to work with the rest of the appliance.

"Hardware is very important and Endace's focus on it makes them unique," she said.

The cheapest EndaceSensor costs $20,000, while more highly spec 'ed appliances can cost over $250,000. Companies typically start by buying a couple, Nichols said. "What generally happens is that they plug them in to the network and say, 'Holy Cow, I never knew that that was going on my network,' and they buy more."

The actually number of appliances that a given organization might need depends on what it needs to monitor and the size and topography of its network, but spending over $1 million on the devices is not unusual, he said.

That might seem like a lot of money, but the cost of network downtime for some organizations can be millions of dollars per hour. Put in that context, spending a few hundred thousand dollars on devices which can provide tools for minimizing downtime due to security problems starts to look very attractive indeed.

Paul Rubens has been covering IT security for over 20 years. In that time he has written for leading UK and international publications including The Economist, The Times, Financial Times, the BBC, Computing and ServerWatch.

[knackers] 28/3/2012 14:42

FBI's top cyber cop, "we're not winning"

[knackers] 28/3/2012 13:28

28 Mar 12: Senior Management Appointment

Confirmation of ex-Fortinet VP of corporate development joining Endace. Looks increasingly (more) likely we have a strategic tie-up in the wings, esp given Atherton's legal background. Good hire.

So he's starting his tenure in PA and then moving to Chantilly, Virginia idc. Some urgent business to attend to in PA with Spencer p'haps...?

[edwardt] 28/3/2012 13:28

"What generally happens is that they plug them in to the network and say, 'Holy Cow, I never knew that that was going on my network,' and they buy more."

this quote kind of sums up the offering!

[knackers] 28/3/2012 13:06

28 Mar 12: Endace - The 'Google of packets'

[knackers] 28/3/2012 08:19

Of course Huawei provides much of today's global telecom and web infrastructure...

[knackers] 26/3/2012 19:20

That's poss Edward, either way that hire's another mini coup (and what timing!) - but if I were Endace I'd be casting the net far and wide.

They have the product, now, who really has the most complementary CTM; 1) Cyber security vendors (Sourcefire) 2) Network vendors (Juniper) 3) System integrators (IBM)...or APMs/NPM vendors (take yr pick)?

The more I look at things the more I think we could have a strategic tie-up on our hands (and a take being taken) rather than an outright sale. All depends on what's in that sales pipleine (likely v good) the acquisition terms offered vs the patience of the principle Inst'l investors.

I think I know what outcome mgt would favour (call me old fashioned). I'd second that too. Hate to see these guys go cheaply.