Insight_UG.book Page i Thursday, March 17, :24 PM User Guide

Transcription

1 User Guide

2 Copyright 2016, Savvius, Inc. All rights reserved. Information in this document is subject to change without notice. No part of this document may be reproduced or transmitted in any form, or by any means, electronic or mechanical, including photocopying, for any purpose, without the express written permission of Savvius, Inc. AiroPeek SE, AiroPeek NX, AiroPeek VX, Compass Live, EtherPeek SE, EtherPeek NX, EtherPeek VX, Gigabit Analyzer Card, GigaPeek NX, inettools, NAX, NetDoppler, NetSense, Network Calculator, Omni³, Omni Capture Engine, Omni Desktop Engine, Omni DNX Engine, OmniAdapter, OmniAdapter 10G, OmniAdapter 10G MX, OmniEngine Desktop, OmniEngine Enterprise, OmniEngine Manager, OmniEngine Workgroup, Omni Management Console, Omni PacketGrabber, Omni Virtual Network Service, OmniPeek, OmniPeek Basic, OmniPeek Connect, OmniPeek Enterprise, OmniPeek Enterprise Connect, OmniPeek Insight, OmniPeek Personal, OmniPeek Professional, OmniPeek Remote Assistant, OmniPeek Workgroup, OmniPeek Workgroup Pro, OmniPeek Personal, Omnipliance, Omnipliance Core, Omnipliance CX, Omnipliance Edge, Omnipliance MX, Omnipliance Portable, Omnipliance SuperCore, Omnipliance TL, Omnipliance WiFi, OmniStorage, OmniSpectrum, OmniVirtual, OmniWatch, PacketGrabber, Peek DNX, ProConvert, ProtoSpecs, RFGrabber, RMONGrabber, Savvius, Savvius Academy, Savvius Insight, Savvius Vigil, TimeLine, TimeLine Network Recorder, WAN Analyzer Card, WANPeek NX, WatchPoint, WildPackets, WildPackets Academy, WildPackets Compass, and WildPackets OmniAnalysis Platform are trademarks of Savvius, Inc. All other trademarks are the property of their respective holders. Savvius, Inc. reserves the right to make changes in the product design without reservation and without notification to its users. Contacting Savvius Mailing Address Savvius, Inc Treat Blvd., Suite 500 Walnut Creek, CA Voice/Fax 8 AM - 5 PM (PDT) (925) (800) (US only) Fax: (925) Sales sales@savvius.com Web Self-support portal for Savvius Insight Resources See for white papers, tutorials, technical briefs and more. ii

3 Professional Services Savvius offers a full spectrum of professional services, available onsite or remote, to help customers make the most of their network infrastructure investment. The Savvius Professional Services team stands ready to partner with you to maximize your network performance and to minimize your network downtime. Savvius technical instructors, network systems engineers, and custom software developers can help you design, build, manage, and secure a better network for your business. See for course catalog, current public course scheduling, web-delivered courses, OnDemand courses, and consulting services. Savvius Academy (800) training@savvius.com Developer Community To join the Savvius Developer Network and gain access to product plug-ins, plug-in wizards, and API documentation, please visit Compliances CE This product has passed the CE test for environmental specifications. Test conditions for passing included the equipment being operated within an industrial enclosure. In order to protect the product from being damaged by ESD (Electrostatic Discharge) and EMI leakage, we strongly recommend the use of CE-compliant industrial enclosure products. FCC Class B This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a residential environment. This equipment generates, uses and can radiate radio frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a commercial area is likely to cause harmful interference in which case the user will be required to correct the interference at his own expense. About Savvius, Inc. Savvius, Inc., a leader in packet-level network analytics and security forensics, enables network and security professionals to identify, understand, and respond to challenges in network performance and security. Savvius, formerly WildPackets, has sold products in more than 60 countries and all industrial sectors. Customers include Apple, Boeing, Cisco, Deutsche Telecom, Fidelity, Microsoft, Nationwide, and a high percentage of the Fortune Savvius is a Cisco Solution Partner. For more information, visit _IN_902d iii

4 iv

5 Contents About Savvius Insight Customer use cases What s included Hardware summary Savvius Insight workflow Installing Savvius Insight Connecting cables to the front and back panels Front panel features Back panel features Starting / shutting down Savvius Insight Initial configuration using the configuration utility Upgrading Savvius Insight software Connecting to Savvius Insight through the serial port Using Savvius Insight and Splunk Savvius for Splunk App Splunk server IP address in configuration utility Use BRIDGED ports for Splunk server Splunk licensing Using Savvius Insight and OmniPeek Main program window and Start page How to start a capture on Savvius Insight Capture window views Limit capture-to-disk to preserve SSD Solving problems using OmniPeek Insight Where do I start? Who s using my network, and how? How is my network performing? How do I get a single view of who s talking to whom? How do I save a file to share with someone else? Self-support portal for Savvius Insight Technical specifications v

6 Contents vi

7 Savvius Insight About Savvius Insight Savvius Insight is a compact, quad-core, six-port appliance about the size of a trade paperback. It fits easily into a wiring closet and includes pass-through ports for monitoring a location s Internet connection, and three additional ports for monitoring internal networks. Each Insight appliance runs Savvius Capture Engine software, and also includes a Splunk Forwarder, enabling optional use of Splunk via Splunk Enterprise or Splunk Cloud server for benchmarking, monitoring, and troubleshooting. By installing Savvius Insight in each remote office, network administrators can easily and affordably gain insight into the network performance of all locations under management. Savvius Insight makes enterprise-class network analytics available in areas that have been underserved until now. Customer use cases Savvius Insight is well suited for small offices who share resources, like accountants, insurance agents, and medical professionals. They have one shared IT manager who spends too much time going from office to office to address typical networking problems, like the network is too slow or users can't connect. The IT Manager needs remote visibility into each office, as well as historical data for comparison when issues arise. Savvius Insight is installed at each office. The IT manager can now track all offices from a single location, using either OmniPeek Insight, or Splunk. By reviewing collected data, he can determine the source of most problems in near real time, and can perform quick daily audits thereby increasing the overall reliability and user satisfaction in each office. Savvius Insight is also perfect for outsourced IT service providers. They manage the networks and IT infrastructure for their clients, typically 5-50 employees per client. It allows IT service providers to decrease MTTR for their customers, increase their ability to predict when problems are brewing, while at the same time reducing costs. To accomplish this they install Savvius Insight at each of their customer locations. The can log into each of the systems at any time to see the current status of each of their client networks. They can also define alarms and alerts on KPIs 1

8 with notifications sent each time an alert is triggered. If a problem is detected or an alert received, they can connect to quickly see what the problem is. Lastly, Savvius Insight can be used with OmniPeek within large corporate networks. Even though they may have already deployed several large network monitoring appliances, there are areas on their network with lower utilization where they don't have good visibility. They can add permanent coverage in these areas, as well as have a few Savvius Insight appliances on hand to send to locations on an as-needed basis to perform analysis. When they need visibility or want to do analysis, they connect to Savvius Insight with OmniPeek. This Savvius Insight User Guide explains how to install and begin using Insight. For additional information on using Savvius Insight, visit What s included Your standard Savvius Insight package includes: Savvius Insight appliance Savvius Capture Engine software pre-installed in Savvius Insight Savvius Insight Quick Start Guide AC power adapter and cord Rubber feet (4) Serial console cable (RJ45 to DB-9) Hardware summary Here is a summary of the hardware for the Savvius Insight: Quad-core 1700MHZ Intel Atom processor 128GB SSD 8GB RAM Two USB 2.0 ports Serial port (with RJ45 physical connection) Management port Three Ethernet ports Two bridge ports External power adapter 2 What s included

9 Savvius Insight workflow Savvius Insight is simple and easy to use! Here are the steps to get you started: 1. Install Savvius Insight. See Installing Savvius Insight on page Connect cables to the front and back panels of Savvius Insight. See Connecting cables to the front and back panels on page Power on Savvius Insight. See Starting / shutting down Savvius Insight on page Configure the initial settings for Savvius Insight. See Initial configuration using the configuration utility on page If you are using Savvius Insight to forward packet data to a Splunk server, make sure the Splunk server is configured in the configuration utility. See Initial configuration using the configuration utility on page 7. For more information on using Savvius Insight with Splunk, see Using Savvius Insight and Splunk on page If you are using OmniPeek Insight software to start packet captures, and to analyze the packet files that are captured and saved on Savvius Insight, install the optional OmniPeek Insight software on a Windows computer. For more information on using OmniPeek Insight, see Using Savvius Insight and OmniPeek on page 16. Installing Savvius Insight To install Savvius Insight: 1. Determine the location of where to install Savvius Insight. Here are some guidelines for determining the location: The most common installation location is to install Savvius Insight somewhere between your cable modem (Internet connection) and the LAN. One of the bridge ports on Savvius Insight is connected to the cable modem, while the other bridge port is connected to the LAN. You will need to initially configure Savvius Insight via the 0 MGMT port using another computer. Make sure you have easy access to Savvius Insight so that you can connect the computer to the 0 MGMT port on Savvius Insight. It is also possible to connect Savvius Insight with a single Ethernet cable to a port on a router configured as a SPAN port, or to a TAP. Make sure you have easy access to these connections. 2. Place Savvius Insight on a flat surface. Savvius Insight workflow 3

10 CAUTION! Do not place anything on top of or directly next to Savvius Insight. Any obstructions to the heat sink located on top of Savvius Insight can cause the unit to overheat. 3. Attach the rubber feet to the bottom of Savvius Insight. 4. Attach the power adapter by screwing in the connector on the adapter to the power-in socket on the back panel. 5. Plug the other end of the power adapter to an AC outlet. Connecting cables to the front and back panels Connecting cables to the front and back panels, as well as the LED states on Savvius Insight are described below. Front panel features 0 MGMT Port 1 Port 2 Port 3 Port 4 5 BRIDGED Ports Serial Port USB 2.0 Ports SSD/Status/Power LEDs Port LEDs Serial Port: The serial port lets you connect to another computer terminal for advanced diagnostics or recovery access using the RJ-45 to DB-9 serial console cable included with Savvius Insight. The RJ-45 connector on the console cable is connected to the serial port on Savvius Insight, and the DB-9 (male) connector on the console cable is connected to the DB-9 (female) serial port on the computer terminal. See Connecting to Savvius Insight through the serial port on page Connecting cables to the front and back panels

11 Note Many computers do not have a DB-9 serial port. Make sure the computer terminal you are using has one. If necessary, you can obtain and install a USB to COM adapter on the computer terminal. SSD/Status/Power LEDs: SSD: If the LED blinks, it indicates data access activities; otherwise, it remains off. Status: When Savvius Insight is first powered on, the LED momentarily blinks green, and then remains off. Power: If the LED is on it indicates that the system is powered on. If it is off, it indicates that the system is powered off. USB 2.0 Ports: The USB ports are reserved for future expansion. 0 MGMT port: This Ethernet port is the management port that lets you initially configure Savvius Insight (see Initial configuration using the configuration utility on page 7). Once Savvius Insight is configured, the port can then be used for device management. Connect a standard Ethernet cable from your network to the 0 MGMT port. 1 3 ports: These Ethernet ports are used for capturing packets from your network. Connect a standard Ethernet cable from your network to the desired port on Savvius Insight. 4 5 BRIDGED ports: These Ethernet ports are configured as a bridge and are used when you want to insert Savvius Insight in-line between two network devices. This configuration allows the capture of traffic flowing between the two network nodes without requiring a tap. In this implementation, packets enter Savvius Insight through one of the bridge ports, and then exit Savvius Insight through the remaining bridge port. Essentially, any traffic that gets to one bridge port is copied to the other bridge port. In cases where power is turned off or is lost to Savvius Insight, the two bridge ports are connected as if they are a wire ( fail to wire ), so Internet connectivity is not lost. To establish the bridge, connect standard Ethernet cables so that Savvius Insight is between your cable modem (Internet connection) and the LAN. One of the bridge ports on Savvius Insight is connected to the cable modem, while the other bridge port is connected to the LAN. Both bridge ports must be connected in this fashion in order to properly establish the bridge. CAUTION! Do not connect each of the bridge ports to the same IP routed network; otherwise, a routing loop is created, and can cause the network to be inoperable. Front panel features 5

12 Note If you are using Savvius Insight to forward data to a Splunk server, captures are automatically started on the bridge ports, and the data is forwarded to the Splunk server configured in the configuration utility. See Initial configuration using the configuration utility on page 7. Port LEDs: The two LEDs on the bottom of ports 0 5 light to indicate activity. A green and yellow LED light to indicate a connection has been established. A flashing yellow LED indicates data access activities. Back panel features Reset Button Power-on Button with LED Power-in Socket Reset Button: Insert a paper clip, and press and hold the reset button for three seconds to reset Savvius Insight to its factory settings. You will lose all saved settings and data on Savvius Insight when it is reset to its factory settings. Once Savvius Insight has reset, you will need to run the configuration utility again as described in Initial configuration using the configuration utility on page 7. Power-on button with LED: Press to power-on or power-off Savvius Insight. When in Standby mode, the LED lights red; in Power-on mode, the LED lights green; when Off, the LED does not light. Power-in Socket: Connects to the screw-on connector on the power adapter included with Savvius Insight. Note Make sure the screw-on connector on the power adapter is connected to the Power-in Socket on Savvius Insight before the power adapter is plugged into an AC power source. 6 Connecting cables to the front and back panels

13 Starting / shutting down Savvius Insight To start / shutdown Savvius Insight: Press the power-on button on the back panel of Savvius Insight. CAUTION! When shutting down Savvius Insight, press the power-on button briefly to have Savvius Insight do a clean shutdown. Holding the button down for several seconds results in Savvius Insight doing an immediate shutdown, causing data loss. This operation is only to be used if Savvius Insight becomes unresponsive. Initial configuration using the configuration utility The configuration utility on Savvius Insight lets you configure device, network, and time settings. Additionally, if you are forwarding your data from Savvius Insight to a Splunk server, you can configure the IP address of the Splunk server and the port used to connect to it. Important! Savvius Insight comes from the factory initially configured to an IP address of To initially run the configuration utility, you must use an Ethernet cable connected directly between the 0 MGMT management port on Savvius Insight and your PC or laptop, and then use a browser window on the PC or laptop to open the configuration utility. The PC or laptop must be configured to be on the same IP subnet as Savvius Insight (see the Savvius Insight web page if you need instructions for configuring your computer to be on the same subnet as the appliance). Once you are using the configuration utility, you can configure Savvius Insight to a new IP address that is directly accessible via the network. To initially configure Savvius Insight using the configuration utility: 1. Use a PC or laptop and configure it for an IP address compatible with the /24 network. This allows the PC or laptop to communicate with Savvius Insight, which has a default address of (See the Savvius Insight web page if you need instructions for configuring your computer to be on the same subnet as Savvius Insight.) 2. Connect an Ethernet cable from the PC or laptop to the 0 MGMT port on Savvius Insight. 3. From a browser window on the PC or laptop, enter the default IP address for Savvius Insight of in the URL box. The Savvius Insight Login screen appears. Starting / shutting down Savvius Insight 7

14 Username: Enter the default username for Savvius Insight. The default is root. Password: Enter the password for Savvius Insight. The default is savvius 4. Since you are logging into Savvius Insight for the first time, you are prompted to change the default password before continuing. Current Password: Enter the current password for Savvius Insight. The default is savvius. 8 Initial configuration using the configuration utility

15 New Password: Enter the new password for Savvius Insight. Confirm Password: Enter the new password again for Savvius Insight. Note The Password that you enter here is used for both Savvius Insight and the Splunk forwarder that forwards data to the Splunk server. Make sure to note the Password that you configure. You can also change the Savvius Insight password at any time by clicking Change Password from the configuration utility. 5. Click Submit. The Savvius Insight Configuration Utility appears. 6. Configure Savvius Insight settings: Important! Once you configure and apply the settings below, the default address for Savvius Insight of is no longer used. To access the configuration utility again, you must enter the IP address of Savvius Insight as configured below, as well as the new password entered above. Settings Initial configuration using the configuration utility 9

16 Savvius Insight Portal: Click the insight.savvius.com link to access documentation and support resources for Savvius Insight owners. It contains links to download OmniPeek Insight network analysis software for Windows and the Savvius for Splunk app. Device Name: Enter a name for Savvius Insight. A unique device name allows for easy identification of data sources. IP Assignment: This setting lets you specify whether Savvius Insight uses DHCP or static settings. If DHCP is selected, then Savvius Insight is configured by the DHCP server. If Static is selected, then Address, Netmask, Gateway, and DNS settings can be configured for Savvius Insight. Important! Savvius Insight can be configured to obtain an IP address automatically from a DHCP server; however, we strongly recommend the use of a static IP address for Savvius Insight. If DHCP is used, and if the address should change on a new DHCP lease, then the user must look up the new IP address assigned to Savvius Insight from the DHCP server. To help you look up the IP address, the MAC Address of Savvius Insight is displayed if you select DHCP. Note If DHCP is selected, you have approximately two minutes to connect Savvius Insight to your network in order for the DHCP server to assign an IP address. Please make sure Savvius Insight is connected to your network within the two minute time period from the time you click Apply. If you reboot Savvius Insight, the two minute clock is also reset. Address: This setting lets you specify the IP address that you are assigning to Savvius Insight. Netmask: A Netmask, combined with the IP address, defines the network associated with Savvius Insight. Gateway: Also known as Default Gateway. When Savvius Insight does not have an IP route for the destination, the IP packet is sent to this address as it does not know how to direct it locally. Only a single default gateway can be defined. DNS: This is the domain name server. A Domain Name Server translates domain names (e.g., into an IP address. Enter the address of the DNS server, and click Add Server. Multiple DNS name servers can be defined. You can also edit or delete any defined DNS servers. 10 Initial configuration using the configuration utility

17 Time Settings Timezone: The Timezone setting lets you specify the physical location of Savvius Insight. Select from the list the location closest to your Savvius Insight. NTP Server: The Network Time Protocol (NTP) is used to synchronize the clocks of computers over a network. To synchronize the Savvius Insight clock, you can specify the IP address of an NTP server located on either the local network or Internet. Enter the address of the NTP server, and click Add Server. Multiple NTP servers can be defined. You can also edit or delete any defined NTP servers. Splunk Settings Splunk Server: This setting specifies the IP address of the Splunk server that Savvius Insight automatically forwards its capture statistics to once the configuration settings are applied. Splunk Port: This setting configures the port used to communicate to the Splunk server. 7. Click Apply to save and apply the configuration settings to Savvius Insight. You will lose connection to Savvius Insight (if you configured a new IP address above). Initial configuration using the configuration utility 11

18 8. Disconnect the cable from the computer/laptop to the 0 MGMT port on Savvius Insight. 9. Connect the 0 MGMT to a router port on your network. You should now be able to reach the management port IP address from the network. 10. Restore your PC or laptop s former network settings and reconnect it to your network. Upgrading Savvius Insight software When a Savvius Insight software update becomes available, the configuration utility alerts you of the update, and displays a screen similar to the screen below. You will need to download a ZIP file containing the two upgrade files, and then install those files, as described below. here upgrade To upgrade the Savvius Insight software: 1. Start the Savvius Insight Configuration Utility from your web browser. 2. When software updates are available, click here to download a ZIP file that contains the Image and Checksum files required to update the software. 3. Click upgrade to install the Image and Checksum files from where the ZIP file is saved on your hard disk. The Upload Image screen appears. 12 Upgrading Savvius Insight software

19 4. Click Choose File to navigate to the ZIP file, and then click Upload. 5. Allow the upload to complete. Wait up to five minutes for Savvius Insight to reboot. You will lose connection to the configuration utility once Savvius Insight reboots. Connecting to Savvius Insight through the serial port Using the included serial cable connected to the serial port on Savvius Insight, a PC/laptop, and a terminal program of your choice, you can log into Savvius Insight and access the command prompt (root@insight). This is especially useful for advanced diagnostics or recovery access. To connect to Savvius Insight through the serial port: 1. Connect the serial console cable included with Savvius Insight from the serial port (DB-9) on your laptop to the serial port (RJ-45) on the back panel of Savvius Insight. 2. Using any serial terminal program (e.g., HyperTerminal or Putty), establish a connection to Savvius Insight. Make sure the appropriate terminal settings match the default settings below for Savvius Insight: Terminal Type: [VT100+] Bits per second: [115200] Data Bits: [8] Parity: [None] Stop Bits: [1] Flow Control: [None] VT-UTF8 Combo Key Support: [Enabled] Recorder Mode: [Disabled] Resolution 100x31: [Enabled] Connecting to Savvius Insight through the serial port 13

20 3. Once a connection to Savvius Insight has been established, the Insight login prompt appears. 4. Log into Savvius Insight by entering the username and password you configured earlier using the configuration utility. If you did not configure a username and password earlier, the default is: username: root password: savvius 5. The Insight command prompt (root@insight) appears once you are logged in. Using Savvius Insight and Splunk Splunk is a powerful platform that lets you look closely at the data coming from Savvius Insight. At the highest level, a Splunk server on the Splunk platform accepts the machine data (logs, metadata, etc.) forwarded from Savvius Insight, indexes it, makes it searchable, and displays it into easy-to-read dashboards viewable in a web browser. To learn more about Splunk and how to customize the dashboards for your specific needs, go to the Splunk website at To learn more about using Savvius Insight with Splunk, go to the Savvius website at Savvius for Splunk App The Savvius for Splunk App provides dashboards in the Splunk UI that display statistics from one or more Savvius Insight appliances. There are high level dashboards like the Network and Security dashboards, which display trends about the network and the events taking place on it. There are also lower level dashboards that display lists of network activity like nodes, flows, and protocols. All of the dashboards are completely web-based and can be customized and extended in many ways. You can download and install the Savvius for Splunk App from the Splunkbase website at 14 Using Savvius Insight and Splunk

21 Splunk server IP address in configuration utility To forward data from Savvius Insight to Splunk, the IP address of the Splunk server must be specified in the Savvius Insight configuration utility. Additionally, you must also enter the port used by the Splunk server. Once the settings in the configuration utility are applied, data automatically begins to flow from Savvius Insight to the Splunk Server via the Bridge ports on Savvius Insight. See Initial configuration using the configuration utility on page 7. Use BRIDGED ports for Splunk server When an IP address is configured for a Splunk server in the configuration utility, Savvius Insight automatically starts two Splunk captures on its BRIDGED ports. Make sure the BRIDGED ports on Savvius Insight are properly cabled. See Front panel features on page 4. Note Do not delete either of the two Splunk captures. If either capture is deleted, you must recreate the capture using the Splunk Analysis Capture or Splunk Expert Capture capture templates available from the Home tab in OmniPeek Insight. See How to start a capture on Savvius Insight on page 18. Splunk licensing The free Splunk license, or a Splunk license that you can purchase is required to use Savvius Insight together with Splunk. The Splunk license pricing model is usage based. The free license allows you to index up to 500MB of data per day. More data can be indexed by purchasing a license. Splunk offers perpetual licenses and a term license. To learn more about Splunk licensing, go to Splunk server IP address in configuration utility 15

22 Using Savvius Insight and OmniPeek A version of OmniPeek software called OmniPeek Insight is available for download for users of Savvius Insight. You can use OmniPeek Insight software to start packet captures, and to analyze the packet files that are captured and saved on Savvius Insight. OmniPeek Insight software is installed on a Windows computer located on the same network as Savvius Insight. You can register your Savvius Insight and download the OmniPeek Insight software by visiting Note If you have OmniPeek software (version and above) already installed on a computer, you can use that version of OmniPeek to start captures, and to analyze packet files captured and saved on Savvius Insight. Here is just a sample of what you can do with OmniPeek Insight software: Start a capture: Starting a capture lets you capture and analyze data in real-time, and record data for post-capture analysis from one or more Savvius Insight appliances installed on the network. You can view a capture in real-time, or save it to disk (captureto-disk) for later analysis. See How to start a capture on Savvius Insight on page 18. Note We recommend limiting instances of capture-to-disk captures on Savvius Insight in order to extend the storage life of the SSD. View the Compass dashboard and other dashboards: The Compass dashboard is an interactive forensics dashboard that displays network utilization over time including protocol, node, flow, VLAN, and application statistics. You can view these statistics from a single supported capture file, or from multiple capture files (*.pkt, *.apc, *.pcap [Libpcap format only], *.wcap [Libpcap format only], *.cap [Libpcap format only], *.wpz, and *.pcapng) aggregated within the Compass workspace. Additionally, other dashboards such as the Timeline, Network, and Applications dashboards, are also available to display graphical data about your network summarized into several easy-to-read displays. View the Experts: The Expert views provide expert analysis of response time, throughput, and network applications in a flow-centered view of captured traffic. Expert views also provide a detailed view of every transaction, noting any events encountered in each individual conversation or flow. You can drill down to select the packets associated with a particular event or with any conversation in Expert views. View the Packets: Packets, the units of data carried on the network, are the basis for all higher level network analysis. When troubleshooting network problems, it is important to be able to drill down into the packets themselves by looking at their individual decodes as well as use the packets captured into the buffer as the foundation for expert and statistical 16 Using Savvius Insight and OmniPeek

23 analysis. The Packets view of a capture window is where you can view information about the individual packets transmitted on your network. To learn about the above features and more, view the OmniPeek User Guide and online help. Main program window and Start page To start OmniPeek Insight: On the Start menu, click OmniPeek for Savvius Insight. The main program window and Start Page appears. The parts of the main program window are described below. Toolbar Start Page Status Bar Toolbar: Provides buttons for frequently-used tasks in OmniPeek. To display different toolbars or to customize toolbar options, on the View menu, click Toolbars. Start Page: Provides buttons for opening saved capture files and viewing the Capture Engines window. Additionally, the Start Page provides links to useful resources, both local and online. Main program window and Start page 17

24 Status Bar: Shows brief context-sensitive messages on the left and the current monitor adapter on the right. To toggle the display of the status bar, on the View menu, click Status Bar. How to start a capture on Savvius Insight Savvius Insight captures allow you to capture and analyze network data in real-time, and optionally record data for post-capture analysis. You can start captures from each of the Ethernet ports, and from the bridge ports on Savvius Insight. Use of the Ethernet ports will require the use of a network tap. Bridge port captures should be configured as described in Front panel features on page 4. To start a capture on Savvius Insight: 1. In OmniPeek Insight, do one of the following to open the Capture Engines window: On the Start Page, click View Capture Engines On the View menu, click Capture Engines The Capture Engines window appears. 18 Using Savvius Insight and OmniPeek

25 Insert Engine 2. From the Capture Engines window, click Insert Engine. The Insert Engine dialog appears. 3. Complete the dialog: Host: Enter the IP address of the Savvius Insight that you want to connect to. How to start a capture on Savvius Insight 19

26 Port: Enter the TCP/IP Port used for communications. The default port for the Savvius WP Omni protocol is Authentication: Select Third Party to connect to Savvius Insight. Domain: Type the Domain for login to Savvius Insight. If Savvius Insight is not a member of any Domain, leave this field blank. Username: Type the Username for login to Savvius Insight. Password: Type the Password for login to Savvius Insight. 4. Click Connect. When the connection is established, the Home tab for Savvius Insight appears. 5. From the Home tab, click New Capture and select the type of capture window that you would like to create: New Capture : This option lets you create a new Savvius Insight capture based on the capture settings that you define. 20 Using Savvius Insight and OmniPeek

27 New Forensics Capture : This option lets you create a new Savvius Insight capture based on a forensic capture template configured for post-capture forensic analysis. New Monitoring Capture : This option lets you create a new Savvius Insight capture based on a monitoring capture template configured to view higher level expert and statistical data in a continuous real-time capture. New Splunk Capture : This option lets you create a new Savvius Insight Splunk capture based on a Splunk capture template configured to forward data to a Splunk server. New Splunk Expert Capture : This option lets you recreate a Savvius Insight Splunk Expert Auto Capture based on a Splunk capture template optimized for Expert analysis and configured to forward data to a Splunk server. This is typically used along with the Splunk Analysis Capture to create a high-performance capture for exporting to Splunk. Use this only to recreate the default Splunk capture that was pre-configured on the device. New Splunk Analysis Capture : This option lets you recreate a Savvius Insight Splunk Analysis Auto Capture based on a Splunk capture template optimized for analysis and configured to forward data to a Splunk server. This is typically used along with the Splunk Expert Capture to create a high-performance capture for exporting to Splunk. Use this only to recreate the default Splunk capture that was pre-configured on the device. Edit Capture Templates: This option opens the Capture Templates dialog and allows you to create new capture templates, or edit existing ones. Note You can also select the above options from the Insert drop-down list available from the Captures tab, and from the New Capture options available from the Adapters tab. How to start a capture on Savvius Insight 21

28 6. Configure the General options. Click Help on the dialog to help you configure the options. 7. Choose a Savvius Insight capture adapter in Adapter options. Each adapter corresponds to the Ethernet ports on Savvius Insight. 8. Click OK. A new Savvius Insight capture window appears. 22 Using Savvius Insight and OmniPeek

29 Capture window views The navigation pane of every capture window presents the views that display information about the capture data. A Savvius Insight capture window can have the views listed below. Here is an example of a capture-to-disk capture window from a Savvius Insight appliance. Capture window views 23

30 Capture Window Views Dashboards: These dashboards display graphical data about your network summarized into several easy-to-read displays. Timeline: This dashboard provides an overview of the top talkers, top protocols, and network utilization for the Capture Engine. Network: This dashboard provides an overview of network statistics for the capture. Applications: This dashboard displays key statistics for applications in the capture window. Compass: This dashboard lets you view network utilization, and top statistics from a single supported capture file, or from multiple capture files. Capture: These views display information about packets captured into the capture buffer. Packets: This view lists all of the packets placed in the buffer of a capture window (or capture file). The Decode and Hex panes show the contents of the selected packet decoded or in hexadecimal and ASCII. Log: This view collects messages generated by events relating to the particular capture window. These events include the results of notifications generated by the triggers or analysis modules selected for the capture window. 24 Using Savvius Insight and OmniPeek

31 Filters: This view lets you enable, disable, add, edit, and delete filters used for capturing packets into the capture window buffer. Alarms: This view lets you query a specified monitor statistics function once per second, testing for user-specified problem and resolution conditions. On matching any of these tests, the alarm function sends a notification of user-specified severity. Expert: These views provide expert analysis of delay, throughput, and a wide variety of network events in a conversation-centered view of traffic in a capture window. Clients/Servers: This view makes it easy to track events and to see them in the context of peer-to-peer or client-server traffic patterns. Flows: This view displays each flow independently in a flat view. This simplified view allows you to compare flows to one another, regardless of the node pair to which they belong. Application: This view allows you to categorize each flow by application. This view allows you to see who is using each application on your network and how each application is performing. Web: These views let you display web page requests and responses, allowing you to track client/server activity within a capture. The same web data is presented in four formats. Servers: This view lets you focus on which servers are being used. Clients: This view lets you focus on which clients are using which servers. Pages: This view displays a list of web pages with each individual request nested underneath. Requests: This view displays a flat list of individual HTTP requests. Visuals: These views graphically display network traffic and statistics. Peer Map: This view lets you visualize network traffic by displaying nodes and the traffic between the nodes. The lines indicate traffic between two nodes. The relative thickness of the lines indicate the volume of traffic occurring. Graphs: This view displays graphs of individual items from the other statistics views in real time. The data from these graphs can also be saved as tab-delimited or comma-delimited text, or as XML \ HTML. On a Capture Engine, this view must be enabled in the Graphs options of the Capture Options dialog. Statistics: These views display various statistical data about your network. Nodes: This view displays real-time data organized by network node. You can choose to display the nodes in a nested hierarchical view (logical addresses nested beneath Capture window views 25

32 their physical address), or in a variety of flat tabular views. Right-click the column header to add or remove various columns. Protocols: This view displays network traffic volume as a percentage of total bytes, broken down by protocol and subprotocol. You can choose to display the protocols in either a nested Clients/Servers view or a Flows view. Summary: This views lets you monitor key network statistics in real time and save those statistics for later comparison. Summary statistics are also extremely valuable in comparing the performance of two different networks or network segments. Applications: This views lets you view basic statistics about applications for a capture window. Limit capture-to-disk to preserve SSD Savvius Insight uses an SSD with a duty cycle that is not rated for continuous capture-to-disk. We recommend limiting instances of capture-to-disk captures on Savvius Insight in order to extend the storage life of the SSD. Problems associated with continuous capture-to-disk use are not covered by warranty. Solving problems using OmniPeek Insight OmniPeek Insight can be used in many ways to solve problems on your network. This section describes five common network analysis tasks you can easily perform with OmniPeek Insight. Note The examples below are based on a capture-to-disk capture file saved from a Savvius Insight appliance. Where do I start? The Compass dashboard provides an intuitive yet detailed summary of all network activity. Use this dashboard as your compass to find which areas need more detailed analysis. To use the Compass dashboard: 1. Click Compass in the navigation pane of the capture window to display the Compass dashboard. 26 Solving problems using OmniPeek Insight

33 2. In the example above, let s learn more about the spike in network activity (graphing average Mbps). 3. Put your cursor just to the left of the spike, drag across the spike, and then let go. The entire Compass dashboard, the graph and the detailed panels below, all update automatically to reflect the time frame you selected around the spike. Where do I start? 27

34 4. Note the Protocols, Flows, and Nodes statistics chart windows below the graph. You can pin or unpin statistics chart windows for Channels, WLAN, VLAN, Data Rates, and Applications by clicking the desired tab or pin/unpin icon (push-pin) in the upper right of the statistics chart window. 5. You now have a complete view of your network traffic for just the spike in activity. Use each of the statistics chart windows to quickly see what caused the spike and determine if more detailed analysis is needed. Who s using my network, and how? 1. Click Nodes in the navigation pane of the capture window to display the Nodes view. The Nodes view provides a list of all nodes that have been active on the network since the capture started. 28 Solving problems using OmniPeek Insight

35 Total Nodes View Type Column Header 2. The total number of nodes is listed in the upper left-hand corner. Use the adjacent pulldown menu to choose the type of node data to display. IP is the most common view. 3. Click a column header to sort the data by that parameter. If you need to quickly see your top talkers, sort on the Total Bytes or Total Bytes % columns. Your top talkers will rise to the top of the list. Who s using my network, and how? 29

36 4. To see exactly what your top talkers are doing on the network, simply double-click the node to create new tab that shows the overall application or protocol usage for that node. The view can be toggled between application and protocol using the drop down box in the title bar. 5. You now know who is using your network, and how. How is my network performing? OmniPeek Insight performs detailed network analysis ( Expert analysis) in the background to find common and even not so common network problems. A list of these potential problems can be found in the Expert views. To use the Expert views to perform network analysis: 1. Click Applications in the Expert views of the navigation pane of the capture window. The Applications view displays Expert analysis categorized by application. 30 Solving problems using OmniPeek Insight

37 2. Be sure the Event Summary tab is selected in the bottom window. The Event Summary tab shows all of the potential issues that have been identified during this capture. How is my network performing? 31

38 3. To quickly find exactly what application and what user has been effected by a nonresponsive server, just click on that event. The application data in the upper window will be automatically expanded to show exactly which application, server, and client has been effected. In this case all three instances correspond to the same communication between and server over HTTP. 32 Solving problems using OmniPeek Insight

39 4. If you want to tune the settings for this analysis function, just right click the event in the Event Summary, choose EventFinder Settings, and adjust the parameters in the dialog box that appears. You can also see a summary of the Event and change the Event severity. 5. With Expert events, OmniPeek Insight watches your network for you. You can set up alerts based on Event severity so you never miss a problem. How do I get a single view of who s talking to whom? OmniPeek Insight includes a feature called the Peer Map that provides a visual representation of who is talking to whom on the network. To use the Peer Map: 1. Click Peer Map in the navigation pane of the capture window to display the Peer Map view. How do I get a single view of who s talking to whom? 33

40 2. The Peer Map represents each network node with a dot. a. The size of the dot scales to the relative traffic for that node. b. The lines emanating from each node represent each of its connections to other network nodes. c. The thickness of the line scales to the traffic between those two nodes in relation to all other nodes. d. The color of the line depicts the underlying protocols in use multiple colors means multiple protocols in use between the network nodes. 3. To better isolate a node, simply drag it away from the others to get a clearer view. Any node repositioning will be retained the next time you open the packet file. 4. The panel on the right allows you to customize the view in the Peer Map. Key customization elements include: 34 Solving problems using OmniPeek Insight

41 a. Number of nodes b. Type of nodes c. Protocols in use 5. For example, if you want to isolate a particular protocol to quickly find only those conversations, click to disable all protocols in the Protocols panel, and then click the check box next to the protocol you wish to isolate in this case, OmniPeek. 6. In just a few clicks we have quickly identified the one conversation using OmniPeek that connects to a Savvius Capture Engine. How do I save a file to share with someone else? There may be times when you want to share a packet file with someone else to get their opinion on a network issue. This is very easy to do with OmniPeek Insight. How do I save a file to share with someone else? 35

42 To create a packet file: 1. On the File menu, click Save All Packets. This will create a file that includes all of the packets that are associated with the open capture window. 2. OmniPeek Insight provides a wide range of formats for saving packets, depending on the intended use of the saved file. Some examples include: a. OmniPeek format (.pkt,.wpz) use this format if you are sharing files with another OmniPeek user. b. Packet List (comma or tab delimited) use this format is you want to export packet information into another program. The most common usage is to import data into Microsoft Excel for further analysis of graphing. c. Libpcap or PcapNG use one of these formats if you are sharing files with a Wireshark user. 36 Solving problems using OmniPeek Insight

43 Self-support portal for Savvius Insight Support for Savvius Insight is available only at the Savvius Insight Web portal located at In the portal you will be able to: Register your Savvius Insight View the Frequently Asked Questions Obtain configuration instructions for common use cases Share your Savvius Insight experiences and issues with other users in an interactive forum Learn new Tips and Tricks about Savvius Insight hardware and software An RMA (Return Material Authorization) number must be obtained from Savvius in order to return hardware for any reason. Your Savvius Insight must also be registered to obtain warranty service. Technical specifications The technical specifications for Savvius Insight are listed below: Basic system configuration Pre-loaded, tested, and fully integrated with Savvius Capture Engine software 8GB RAM 128GB HD/SSD SATA Quad-core 1700MHZ Intel Atom processor Performance Network analysis up to 100Mbps Up to four simultaneous captures Ethernet Six built-in 10/100/1000 Gigabit Ethernet ports RJ-45 Interface Self-support portal for Savvius Insight 37