News

Network Instruments Expands GigaStor™ Line

Read the press release >

In Practice: Testing the Network

Summary Getting blindsided by a preventable problem can be frustrating, expensive, and quite embarrassing. Identifying potential problems on the network and preparing for future deployments is critical to ensure there are enough resources available for users. Observer’s What-If modeling can help manage risks and even prevent those unwanted surprises.

A big component of network management is ensuring there are enough resources to support critical business applications. Observer continually monitors network activity and notifies you when network resources are threatened.

To prevent problems, however, you should plan infrastructure upgrades by running network assessment tests. Observer’s What-If live modeling and analysis offers both a predictive tool for modeling potential response times, utilizations, or packets per second at different network speeds, and also permits you to change different conversational and network metrics to predict changes in performance with the new values.

The What-If Analysis starts with a conversation collected from your network and bases all predictions on your actual network data. Different system formulas are used for different types of systems to be modeled. To begin a What-If live modeling session, right-click on a conversation from either the TCP or UDP Events display and select What-If Analysis. The top of the display will show which stations are currently being modeled. The client is on the left, the server is on the right.

The X-axis of the graph displays different network speeds. The Y-axis will display different values including utilization percentage, response time, or packets per second depending on the graph type selected. For example, if utilization is currently at 40%, and you want to see how utilization is effected if the network supports additional users, you can change the number of users you expect the network to support and Observer will display a projected utilization level.

A key will show the different items on the graph and their associated colors. The items below the graph initially represent the actual data from the captured conversation. These items can be manipulated to model changes in the network.

Observed connection parameters include:

• Average Packet Size (Bytes)—displays the average size of the packets sent from the client and the server. Changing these values in the client or server spinboxes will model changes in network performance.
• Latency (mSec)—displays the average latency time as observed in the transaction conversation. Values are shown for packets sent from the client and the server. Changing these values in the client or server spinboxes will model changes in network performance.
• Transaction Packet Ratio—displays the transaction packet ratio of the packets sent from the client and the server.
• "Utilization from other sources (%)" —sets the network utilization to simulate. This would be in addition to the current conversational conditions recorded, and only changes the modeled values if the option to "Include utilization from other sources in What-If Analysis" is checked in the Expert Global Settings, What-If tab setup.

Simply adding bandwidth is not a magic solution to all network problems. This is especially true in the case of deploying VoIP. With VoIP, the main issue is network contention. Communications are constantly vying for attention even at low utilization levels. Observer’s What-If modeling will show you which resources will be threatened and the potential consequences resulting. This way you can be ready for those inevitable problems and successfully make the case and prepare for infrastructure upgrades.

Tech Tip: Reconstructing the Data Stream

Observer’s data stream reconstruction feature is ideal for network forensics, allowing you to proactively enforce corporate IT usage policies. This is because Observer not only shows what communications took place, it can also reconstruct the data stream–providing hard evidence of phone conversations, web pages (including images), instant messages, and e-mails.

Before reconstructing these communications, you must first capture the data stream. With the GigaStor, all you have to do is select a time period you would like to investigate. For any other probe, this requires a standard packet capture.

Once the data stream is captured, select Decode. Then click the Expert tab and the TCP Events button. To reconstruct a web page, right-click on any site address and select “Stream Reconstruction”.

The Stream Reconstruction contains a summary of web traffic activity, with a link to the actual web page html data that was downloaded.

Clicking the link “tempfile.htm” will reconstruct the web page, including images.