I attended the Global Broadband Traffic Management Congress in London for a half-day on November 15th. This was a well-run conference with fact-based presentations from a customer perspective.
As discussed in my previous articles, carrier traffic grew exponentially faster than revenue growth, due to the proliferation of smart phones and related data and video traffic. Vodaphone (NASDAQ:VOD) mentioned that smart phone traffic penetration has gone from almost nothing a few years ago to one-quarter of total traffic last year, and is even higher today. Mark Newman, Chief Research Officer of Informa Telecoms and Media, stated that bit traffic on the carrier networks "is doubling every year". Mobile operator Orange, a subsidiary of France Telecom (FTE), stated that usage (i.e. traffic) grew 50% year-over-year, but that the cost of bandwidth has stopped decreasing in proportion to traffic growth, adversely impacting operating margins. So, how can carriers afford to pay for all this bandwidth traffic infrastructure? LTE, the next-generation, high-bandwidth network standard, is not cheap.
Sitting next to me was an executive from an Egyptian telecom operator. He said that 5% of his customers are producing 80% of the traffic. He mentioned that they are looking for solutions to their problem of traffic growth exceeding revenue growth. He added that they are preparing for these solutions by upgrading their core switching infrastructure.
Part of the solution is in price-tiering, and related policy enforcement, which is enabled by Deep Packet Inspection (DPI) - see here. In this article, I state DPI and related Policy Enforcement today creates revenues for mobile carriers via traffic price-tiering schemes, while still continuing to improve quality of service and security. The beauty of DPI is that it costs the carriers very little, providing a payback of six months or less. So DPI is avoiding the carrier capex squeeze faced by its telecom equipment brethren, and currently experiencing very healthy demand.
Granular price-tiering, traffic shaping, and policy enforcement enable carriers to 1) charge for certain traffic like bandwidth-hogging online video applications and 2) lower peak traffic loads by incentivizing customers to do their heavy surfing during off-peak periods.
The vendors that I visited at this London trade show seemed to be riding this digital traffic management wave. Allot (NASDAQ:ALLT) and Procera (NASDAQ:PKT) both announced very strong quarterly results this month. Procera was off-the-charts with revenues rising 158% to $12M, bookings of $20M, and a book-to-bill ratio of 3x. Last-quarter's net income was $2.5M, a four-fold increase over the previous quarter. Management raised guidance on an already-strong Q4, which they will probably beat. Allot Q3 revenues rose 37% to $20M. Allot's book-to-bill ratio slipped below 1x. This was due to the timing of a $9.5M booking from an Asian wireline service provider. The book-to-bill ratio should easily surpass 1x in the current quarter, as the order rate is expected to increase. Net income was $3.4M versus $2.7M in the prior quarter and $1.4M in the year-ago quarter. Allot subsequently raised $78M dollars in a secondary offering about two weeks ago.
Sandvine (OTC:SNVNF) Q3 revenues rose 10% to $26M. Non-GAAP net income was $1.5M, vs $1.0M in the prior quarter and $2.8M in the year-ago period. Sandvine has lost some North American cable customers to Procera. Sandvine, and larger integrators like Cisco (NASDAQ:CSCO) and Alcatel-Lucent (ALU), have slower growth because they have more rigid systems, using ASIC chip design as opposed to more open software-based systems from Procera and Allot. This generally means that to add new services, a customer would have to add more in-line servers, load-balancing, etc. Allot and Procera are able to put this functionality on a single open platform, requiring less equipment, less potential points of failure, less power, and less maintenance. Sandvine, however, is still the largest of the independent DPI firms, providing strong price-tiering and usage-based solutions for its customers.
Since publishing my initial DPI article three weeks ago, I received a lot of comments about my scalability and throughput comparisons of Allot and Procera. After further investigation, I would like to set the record straight. Allot's sigma-E net throughput after eliminating the 6 blades required for core processing and other internal requirements is 128 Gbps (8 available blades x 16 Gbps per blade). Procera's PL10K has a net throughput of 120Gbps (6 available blades x 20 Gbps). So, on a net throughput per blade basis, Procera has a 25% advantage over Allot (20 Gbps vs 16 Gbps). On a net throughput per chassis basis, Allot has a 7% advantage over Procera (128 Gbps vs 120 Gbps). On a throughput per cluster basis, Procera has at least a 100% advantage over Allot (2Tbps vs 1Tbps). Note: 2Tbps is not even close to Procera's theoretical limit. This large advantage lies in the fact that Allot needs dedicated ports to create the cluster. In addition, Procera has a 25% scalability advantage in subscribers per single system (10M vs 8M). There are other Procera scalability advantages that I saw when comparing data sheets and related follow up. But it's suffice to say that Procera currently has scalability advantages over Allot, and even more scalability advantages over other competitors.
Some engineering footnotes on the above analysis: 1) This analysis used "Cisco math". Cisco counts capacity as input + output. So a 10GbE port has a capacity of 20 Gbps using Cisco math. Both Procera and Allot used Cisco math in their data sheets, as do most companies. An extra-heavy DPI process, however, could potentially slow the input/output connection, leading to slower throughput. 2) Competitor data sheets need to be compared on the same basis. Allot used a gross figure of 160Gbps throughput, while Procera used a net figure of 120Gbps. You have to look at the two boxes to see how many service blades are available for external packet processing. This is what the customer receives, and is the number that matters. 3) System throughput is halved for each filter (e.g. URL filter, anti-virus, etc) that passes through the network. This is true for Allot, Procera, or any other vendor.
I am not commenting on which box is better. Allot currently has a richer feature set than Procera. So, Allot has certain advantages, as does Procera. I am just sticking to the facts on this throughput/scalability issue.
One other housecleaning issue: in my previous DPI article, I mentioned that Procera's faster growth may be partially attributable to more exposure to the mobile carrier market. In fact, this was not the case in the last quarter. Procera's Q3 revenue breakdown was cable 58%, wireline (mainly with integrated mobile capabilities) 24%, education 9%, pure mobile 3%, and services 6%. Of the 18 trials in Q4, however, 7 are mobile customers, 6 are cable, and 5 are wireline (again with mobile integration). So, future revenues should have more exposure to the fast-growing mobile market.
I think that both Allot and Procera have bright futures. The DPI market is projected to increase from $0.5B this year to $2.0B in 2015, with very low market penetration rates today. It looks like Net Neutrality is staring to thaw, and that the US market mobile and wireline markets can open up, as well as more cable operators, in the not too distant future. Asia is booming. Europe is growing. So, it is not in the interest of Allot or Procera to get into a pissing contest of who is better, at the detriment of pricing, margins, or giving away market share to weaker competitors through negative comments about one another.
For all the VCs out there, you should check-out Vineyard Networks. I spoke to Vineyard's CEO at the conference. Backed by two local Vancouver investors, Vineyard specializes in identifying and tracking digital signatures across the network, which they refer to as Application Classification. Peer-to-peer companies like BitTorrent may try to conceal their bandwidth-heavy applications on the network, so that end-users avoid interference from carriers when downloading video and audio files. There is a constant cat-and-mouse game going on to change the digital signatures of these packets, and for the enforcement policy of the carrier to then recognize these new digital signatures. Thus, digital signature technology is an important sub-component of DPI and Policy Enforcement. Vineyard's revenues should increase 7x this year to the $7M-$8M range. Vineyard provides customers a quick payback, and a faster time to market than an internally-developed customer solution. Vineyard must compete with DPI vendors and system integrators that provide digital signature recognition, tracking and reporting, and especially against customers' internal programs (as some vendors and operators do not want to outsource this key capability). A possible exit would be for Vineyard to be acquired by one of their customers which include Blue Coat (NASDAQ:BCSI), Riverbed (NASDAQ:RVBD), and Tektronix, a subsidiary of Danaher (NYSE:DHR).
Similarly, I would not be surprised to see pure-play DPI companies like Procera and possibly Allot be acquired by more integrated telecom vendors. F5 (NASDAQ:FFIV) is already in a strategic partnership with Procera, and provides Procera with filtering and other feature sets where F5 excels. This best-of-breed approach differs from Allot's strategy of developing these feature sets internally.
By the way, both Procera and Allot have strong signature recognition policies. Procera's Datastream Recognition Definition Language (DRDL) flow-based scripting architecture has unlimited signature recognition capacity (over 2000 currently), with software upgrades available every two weeks. In the future, Procera has the unique capability to leverage DRDL to detect signatures even outside of its direct network coverage, and take the subsequent policy enforcement and optimization steps. Allot's Dynamic Actionable Recognition Technology (DART) can also recognize and track a multitude of signatures in real time. DART can identify over 900 specific applications and protocols, and can assign individual policies to each of them.
Disclosure: I am long PKT.