| Legacy Monitoring Tools | Deploy it when existing intrusion detection, packet capture, or protocol analysis tools cannot natively decode VXLAN encapsulation. | Presents the inner Ethernet and IP packets in a format that conventional monitoring tools can inspect. | Confirm that the broker preserves inner-packet headers, timestamps, VLAN information, and required tunnel metadata. | IDS/IPS, packet analyzers, network probes, and forensic capture systems. |
| East-West Traffic Visibility | Use it in data centers where workloads communicate across virtual network segments through VXLAN tunnels. | Improves visibility into application-to-application traffic that may not be apparent from underlay transport headers alone. | Traffic must be sourced from appropriate tap or mirror points, including relevant tunnel endpoints when required. | Virtualized workloads, microservices, database flows, and internal API traffic. |
| Security Inspection | Deploy it when security tools need to inspect the encapsulated tenant traffic rather than only the outer transport headers. | Allows policy engines and detection tools to evaluate inner source, destination, protocol, and application context. | Stripping does not decrypt encrypted payloads; separate TLS or application-layer decryption may still be necessary and must follow policy. | Network detection and response, firewalls, malware analysis, and security analytics. |
| Multi-Tenant Network Monitoring | Use it where several logical networks share a physical underlay and monitoring teams need tenant-aware visibility. | Separates overlay traffic from the transport network and simplifies analysis of tenant-specific flows. | Apply filtering and tool assignment carefully to prevent unintended exposure of traffic between tenants. | Cloud platforms, hosted services, private clouds, and segmented enterprise environments. |
| Performance and Capacity Planning | Deploy it when operations teams need to measure the behavior of inner application flows instead of only underlay link utilization. | Supports more meaningful latency, packet-loss, throughput, and conversation-level analysis. | Packet-rate limits, oversubscription, hashing behavior, and tool capacity should be validated before production deployment. | Flow monitoring, application performance monitoring, and capacity analysis tools. |
| Troubleshooting and Incident Response | Use it when troubleshooting requires direct access to the original inner packet conversation carried inside VXLAN. | Reduces analysis complexity by removing tunnel overhead before packets reach the diagnostic tool. | Retain enough metadata to correlate inner flows with tunnel endpoints, virtual segments, and event timestamps. | Packet capture, root-cause analysis, service assurance, and incident investigation. |
| Tool Consolidation | Deploy it when multiple monitoring tools require the same VXLAN traffic in different formats or filtered subsets. | Centralizes decapsulation, filtering, replication, and traffic distribution instead of duplicating those functions across tools. | The broker should support granular filtering, traffic-load balancing, and failover appropriate to the monitoring architecture. | Security, performance, compliance, and packet-capture tool chains. |
| When VXLAN Stripping May Not Be Needed | Avoid unnecessary stripping when the monitoring platform already supports VXLAN decoding and requires the original encapsulation for correlation. | Preserves tunnel context and avoids an additional processing stage in the monitoring path. | Evaluate tool compatibility, regulatory requirements, packet-recording needs, and troubleshooting workflows first. | VXLAN-aware analyzers, overlay-focused telemetry systems, and tunnel-level diagnostics. |
