The ability to look at recent capture files is a network engineer's ultimate troubleshooting tool. Problem resolution is greatly enhanced when you can review the details of the network conversations. Imagine being able to click on a button and get any or all 5-minute captures of traffic that occurred in the last hour or the last week?
The NetQuality Analyzer with CPR ships with 2 ethernet ports. The main port is used for the standard set of network tests, such as bandwidth capacity and quality, application response time, SNMP and Netflow collection. As always, the units can be installed anywhere on the network. The additional port is available for packet capture. The units are always deployed as passive devices which require that you span or mirror your traffic to the unit's second ethernet port if you want capturing turned on. Once deployed and with port spanning or mirroring turned on, your NetQuality Analyzer will continually keep the last hour or last week (depending upon the model) of packet captures. When your network engineers need to troubleshoot an issue at a remote site, they don't need to send an engineer on site, instead, they click a few buttons on a web page, fill in some security information, and choose which 5-minute captures they want to transfer (via FTP) for review. Files are stored as compressed (gzip), standard pcap files that you can review with Ethereal, Wireshark, or Cace Technologies' Pilot, for example. It's quick, easy, and secure.
Speaking of security, the smaller units keep all their information in RAM, not flash, so if the unit is ever removed there are no packet capture files available. Because the information is in memory, the smaller units are designed to keep only the last hour of traffic on a 3 Mbps or less connection. The larger units ship with a disk drive, and as such, can keep a longer history, such as a week. These units store the packet capture files in an encrypted file system for security. The larger units can support a 100 mbps in capture data. In all cases, we collect only the first 68 bytes of the ethernet header.
No more this... |
but more this... |
AND THIS!! |
|
|
|
