SteelCentral Packet Analyser Walkthrough

Transcription

1 SteelCentral Packet Analyser Walkthrough The aim of this demo is to show how to perform simple analysis of packets using the SteelCentral Packet Analyser in conjunction with NetShark. We will talk through connecting the Shark to the Packet Analyser (Pilot) and then demonstrate the use of Views and Trace Clips to analyse packets. Firstly, double-click the SteelCentral Packet Analyser icon on the desktop. You should obtain something similar to the following: The top left box shows the sources. In our case we can see the NetShark in out SteelCentral demo facility, which is capturing database traffic between our webservers and the backend databases. For this Sources box, click the Files tab which should change the view to look something like the following: Now we need to apply a View. A View is a way of displaying the analysis of the data and there are many different prebuilt views, all within the Views window which is directly beneath the Sources window. These are split up into Zycko Ltd 2015 P1 of 7

2 categories to make browsing easier, but you can also search for individual views using the search box and even create your own. Moving on to Talkers and Conversations, mention that we can view the key information about conversations on the network: Next, expand User Activity and pay particular attention to the Web and VoIP sections. Not only can we view layer3/4 information but we also have visibility into the applications as well. Zycko Ltd 2015 P2 of 7

3 Let us now apply a view. Ensure that the capture Database Traffic (in the sources box) is selected and then double-click the view Network Usage by Port. You should obtain something similar to the following: As we are capturing packets between the web and database servers the high level of MS-SQL and MySQL should have been expected. What we can now do is drill down from this view to obtain even further information. Right-click the big purple wedge on the pie chart (i.e. MySQL) and then select Drill Down -> Performance and Errors -> SQL -> SQL Performance by Query. Zycko Ltd 2015 P3 of 7

4 Click OK to any warning (we should really have applied a trace-clip first) and then after a short delay you should see the following: The really interesting stuff is towards the right. To best see this, drag the tab to undock it, resize to fill the screen and then scroll to reveal the right-hand columns. You should finally have something like the following: Zycko Ltd 2015 P4 of 7

5 So what are we seeing here? Well, we already see the individual SQL statements, now we can also see the database and table being accessed. We also have an analysis of the number of requests but also the average response time on a per statement basis. This is very useful as we are troubleshooting an application accessing a database which is running slow as we can pinpoint exactly how the database is being used. Scroll further to the right to reveal the Max Total Transaction Time column displaying the duration of each of these transactions. As a final demo we will create a Trace Clip, analyse for TCP errors and then send these packets to WireShark for further analysis. Right-click the Database Traffic link and then select Add Trace Clip: Click the option 3 hours and give it a meaningful name, such as Last 3 Hours. You can go back in time and select a particular time window using the slider if this is what you need. Click OK. Zycko Ltd 2015 P5 of 7

6 Next you should highlight the Trace Clip and then double-click the view TCP Errors Overview as shown. Explain that this view is only applied to this particular time window: Zycko Ltd 2015 P6 of 7

7 Finally, right-click one of the wedges showing errors. In our case we have selected Duplicate Acks and select Send to WireShark. This will send just the packets corresponding to our selection (49 in this case) to WireShark: Packet Analyzer can do far more than just analyze packets and the ability to drill down and then select particular packets to send to WireShark is a very powerful troubleshooting tool. Zycko Ltd 2015 P7 of 7