Network Analysis | SecurActive Performance Vision's blog

* You are viewing the archive for the ‘Network Analysis’ Category

Version 2.12: Performance Vision integration into Omnipeek

SecurActive Performance Vision and Wildpackets have partnered to deliver a great end-to-end solution integrating the best of both worlds:

  • WildPackets bring their expertise in high rate packet capture and storage and in-depth packet decoding,
  • SecurActive Performance Vision bring their great ability to provide an overview of network and application performance and a drill down to the details through an intuitive and user-friendly interface.

By combining both solutions, WildPackets and SecurActive provide a best of breed solution to monitor network and application performance from monitoring dashboards to in-depth packet expert analysis.

Users equipped with both solutions will benefit from a one-click bridge from any Performance …

Step by step guide to analyze DNS performance

When you experience a performance degradation on a network, it may not be due to the server nor to the network or application. The root cause may be a DNS issue at the workstation level or between the different tiers of the application chain. For example, a Web portal, accessing to its database, via a DNS request which is very slow.

A key to diagnosing DNS issues quickly is to validate the behavior of DNS on all steps of your application chain.

The name resolution protocols are translating a known IP address (information of the network) and a name which is more …

How Performance Vision can help make a better use of your packet decoder

We see more and more network administrators turning towards NPM/APM solutions, although they have sniffers / packet decoders in place and are perfectly litterate when it comes to viewing and looking at network packets. Whatever the protocol decoder: opensource or paid license, whatever the vendor (Wireshark, WildPackets, Clearsight, Network Instruments, ….). What are the reasons for that?
What limits are they facing while using their sniffers to troubleshoot performance issues?
If you read the testimonial of Police Headquarters in Paris on their use of Performance Vision, you will understand the issues they were facing using packet decoders such as Wireshark and Clearsight. Here …

How to capture Virtual Traffic?

Virtualization is widely spread and raises some new challenges for network analysis and network based APM. To analyze and troubleshoot performance degradations in application chains which are partially or totally virtualized, you need to capture virtual traffic (i.e. traffic between virtual machines which does not go through the physical network).

Depending on the virtualization architecture in place, many options are available; there is no perfect choice whatever the environment and constraintes are. The right option depends on your specific context:

  • what type of virtualization software is used?
  • what kind of virtual switch is in place?
  • how often do you need to be able to …

Links between latency, throughput and packet loss

Latency is the time required to vehiculate a packet across a network.
Latency may be measured in many different ways: round trip, one way, etc…
Latency may be impacted by any element in the chain which is used to vehiculate data: workstation, WAN links, routers, local area network, server… and ultimately it may be limited, for large networks, by the speed of light.
Throughput is defined as the quantity of data being sent/received by unit of time.
UDP throughput is not impacted by latency.
UDP is a protocol used to carry data over IP networks. One of the principles of UDP is …

What drives network latency?

Network latency (time required to send a packet over a network) is driven by 4 components:

  1. Propagation
  2. Processing
  3. Serialization
  4. Queueing

Propagation
Propagation is the time required to go from one interface of a network device to another over a physical cable. It should be very constant (unless you change the path) as it is driven by pure physics: time = distance / (2/3 x speed of light).
Unless you reduce the distance, propagation time cannot be reduced. For example, if you want to reduce the propagation time from Europe to China, the only way is to use a different physical path to reduce the distance; for example …

IPV6: maybe you have migrated… and just do not know about it!

Dear customer,

Do you have IPv6 flows on your network? Have you planned a migration to IPv6?

Today, we usually receive, at first, a negative answer from our customers.

IPv6 addresses are already used by many vendors… New OS versions, like the ones of Windows or Linux, converse by default in IPv6; this means that many of our customers have IPv6 addresses in their network without knowing it!

You can see a lot of articles on the web on how various solutions can help you facilitate your migration to IPV6… etc.
It sounds a bit …

You always wanted to know how MOS was related to rtt, packet loss, and jitter?

If not, too bad: you can go out, have a drink, meet peoples and have fun. For those thrilling to get the answer, you can stay.
Apart from knowing that MOS is a metric build statistically over subjective test data, and thus that it would require a complete audit conducted by experts following the ITU-T recommendation P800, most network auditing applications will offer sort of a quick estimation of the MOS thanks to an obfuscate equation mixing packet loss (percentage of packet lost to total packet sent), jitter (as sent in RTCP, …

Traffic capture in a virtualized environment

What’s the issue?
With the growing number of virtualized servers, it is hard to:
- know where the servers may be at one point of time (due to facilities such as VMotion, which provides an increased flexibility in moving virtual servers depending on where resources are available).
- determine where and how to capture the traffic reaching critical servers for performance analysis.
What you can do without traffic capture within the server farm?
Capturing traffic within a virtualized server farm may represent an issue for some uses, but for some crucial needs of network visibility like:…

Cisco SPAN to multiple destination ports

Getting some flexibility to capture network traffic is always helpful when you consider that alternatives to SPAN are still quite expensive (TAPs) and that having 10Gbps SPAN destination ports can costly (both in terms of switch cards and for the interfaces on the analysis device).

Port mirroring or SPAN

Network TAP

Port Mirroring n to 1

For more information …