Contacting WildPackets

Transcription

1

2 Copyright 2009, WildPackets, Inc. All rights reserved. Information in this document is subject to change without notice. No part of this document may be reproduced or transmitted in any form, or by any means, electronic or mechanical, including photocopying, for any purpose, without the express written permission of WildPackets, Inc. AiroPeek SE, AiroPeek NX, AiroPeek VX, EtherPeek SE, EtherPeek NX, EtherPeek VX, Gigabit Analyzer Card, GigaPeek NX, inettools, NAX, NetDoppler, NetSense, Network Calculator, Omni³, Omni Capture Engine, Omni Desktop Engine, Omni DNX Engine, OmniAdapter, OmniAdapter 10G, OmniEngine Desktop, OmniEngine Enterprise, OmniEngine Manager, OmniEngine Workgroup, Omni Management Console, Omni PacketGrabber, Omni Virtual Network Service, OmniPeek, OmniPeek Basic, OmniPeek Connect, OmniPeek Enterprise, OmniPeek Enterprise Connect, OmniPeek Personal, OmniPeek Professional, OmniPeek Workgroup, OmniPeek Workgroup Pro, OmniPeek Personal, Omnipliance, Omnipliance Core, Omnipliance Edge, Omnipliance Portable, Omnipliance SuperCore, OmniSpectrum, OmniVirtual, OmniWatch, PacketGrabber, Peek DNX, ProConvert, ProtoSpecs, RFGrabber, RMONGrabber, WAN Analyzer Card, WANPeek NX, WatchPoint, WildPackets, WildPackets Academy, and WildPackets OmniAnalysis Platform are trademarks of WildPackets, Inc. All other trademarks are the property of their respective holders. WildPackets, Inc. reserves the right to make changes in the product design without reservation and without notification to its users. Contacting WildPackets Mailing Address WildPackets, Inc Treat Blvd., Suite 500 Walnut Creek, CA Voice/Fax 8 AM - 5 PM (PST) (925) (800) (US only) Fax: (925) info@wildpackets.com Sales sales@wildpackets.com Web Technical Support Resources See for white papers, tutorials, technical briefs and more. ii

3 Professional Services WildPackets offers a full spectrum of professional services, available onsite or remote, to help customers make the most of their network infrastructure investment. The WildPackets Professional Services team stands ready to partner with you to maximize your network performance and to minimize your network downtime. WildPackets technical instructors, network systems engineers, and custom software developers can help you design, build, manage, and secure a better network for your business. See for course catalog, current public course scheduling, web-delivered courses, and consulting services. WildPackets Academy (800) training@wildpackets.com Product Support and Maintenance WildPackets Maintenance Programs ensure that you grow along with our products as new features and enhancements are added and that your usage is fully supported by our Technical Support staff. Enhanced support services are available with remote or onsite consulting. Developer support is also available for customers adding custom enhancements to WildPackets products. All Maintenance inquiries and purchases can be accommodated by contacting sales@wildpackets.com. Developer Community To join the WildPackets Developer Network and gain access to product plug-ins, plug-in wizards, and API documentation, please visit About WildPackets, Inc. WildPackets delivers software and hardware solutions that drive network performance, enabling organizations of all sizes to actively monitor, analyze, troubleshoot, optimize, and secure their wired and wireless networks. WildPackets products are sold in over 60 countries and deployed in all industrial sectors, including 80 percent of the Fortune WildPackets is a Cisco Technical Development Partner. For further information, please visit E-OP60a iii

4

5 Contents Chapter 1 Introduction System requirements Installing OmniPeek Installing an OmniEngine Main program window and Start Page Chapter 2 Using OmniPeek with OmniEngines Displaying the OmniEngines window Connecting to an OmniEngine Chapter 3 The Capture Window Creating an OmniPeek capture window Creating an OmniEngine capture window Chapter 4 Dashboards Network dashboard Voice & Video dashboard Apdex dashboard Chapter 5 Viewing and Decoding Packets The packets view The packet decode window Chapter 6 Creating Filters Enabling a filter Creating filters with the make filter command Creating a simple filter Chapter 7 Expert Troubleshooting The expert view window Using the EventFinder Application view v

6 Contents Chapter 8 Statistics Analysis Monitoring the network Capture window statistics Chapter 9 Using the Peer Map The Peer Map view Appendix A Keyboard Shortcuts Index vi

7 C H A P T E R 1 Introduction Welcome to OmniPeek, the network analyzer and software console for distributed network analysis from WildPackets! OmniPeek as a portable analyzer As a portable analyzer, OmniPeek offers an intuitive, easy-to-use graphical interface that engineers can use to rapidly analyze and troubleshoot enterprise networks. OmniPeek supports local captures from multiple interfaces and data collection from any network topology, including WLAN and Gigabit networks, wireless networks, WAN links, and local matrix switches. OmniPeek with distributed OmniEngines As a software console for OmniEngines, OmniPeek can also manage and interact with an unlimited number of OmniEngines performing independent capture and analysis at any location across the network. 1

8 Chapter 1: Introduction OmniPeek allows network engineers to troubleshoot problems and perform statistical analysis on remote segments from a single location, as shown in the diagram above. A single OmniEngine can also link to multiple installations of OmniPeek, allowing simultaneous connection and collaboration, as shown below. The separately purchased OmniEngines have no user interface of their own. OmniEngines rely on OmniPeek to provide a user interface through the OmniEngines window. For more information, see Chapter 2, Using OmniPeek with OmniEngines. See also the OmniEngine Getting Started Guide that ships with the product or the online help in the OmniEngine Manager application. 2

9 OmniPeek Getting Started Guide OmniPeek Product Family The OmniPeek Product Family includes OmniPeek Analyzers, distributed OmniEngines, Omnipliances, and capture adapters for distributed wireless packet capture. OmniPeek and OmniEngines can be purchased in Enterprise and Desktop versions, offering a variety of licensing and feature options. Please visit our Web site at for details about how to select the OmniPeek configurations and media types that precisely fit the needs of your network. Network forensics Network forensics is the retrospective analysis of network traffic for the purpose of conducting an investigation. You can use OmniPeek and the OmniEngines to capture, store, and data mine large volumes of traffic data in order to investigate items such as network problems, security attacks, HR policy violations, and more. OmniPeek also displays packet flow reconstruction of web requests and responses, allowing you to perform forensic searches by drilling down to individual images, files, and pages. You can select an individual HTTP request and immediately view the corresponding details, header information, a graphic representation of an image, or a timeline display of the individual packets and phases of that request. See the OmniPeek User Guide or online help for information on how to perform forensics on your own network. Voice and video over IP analysis If you have purchased OmniPeek Enterprise, voice and video over IP is available for call signaling and media analysis in the Voice & Video views of capture windows, providing simultaneous analysis of voice and video data traffic with subjective and objective quality metrics. For information on voice and video analysis, see the OmniPeek User Guide or online help. System requirements The system requirements for OmniPeek are: Windows Vista, Windows XP Professional, Windows Server 2003 Internet Explorer 7.0 Microsoft.NET Framework 2.0 For more information, please see our web site at OmniPeek Product Family 3

10 Chapter 1: Introduction Supported adapters and drivers To analyze Gigabit, WAN, or wireless traffic, a supported network analyzer card (WildPackets OmniAdapter or WAN Analyzer Card) or wireless LAN adapter is required for OmniPeek. For the most recent information on network adapter cards and drivers, please visit For information on configuring wireless channels and security, Gigabit hardware profiles, and WAN settings in OmniPeek and the OmniEngines, please refer to the OmniPeek User Guide or online help. Installing OmniPeek To install OmniPeek: 1. Uninstall any earlier versions of OmniPeek. 2. Insert the OmniPeek Installer CD into your CD or DVD drive. 3. Follow the installation instructions that appear on the screen. During installation you are asked to enter a valid Activation Key. When prompted, you can select from the following: Automatic: The installer uses your Internet connection to send an encrypted message to an activation server, which retrieves and displays your Activation Key. Please write down the Activation Key for future reference. Manual: The installer allows you to enter the Activation Key manually. You can obtain an Activation Key in the following ways: Go to a computer with an Internet connection and web browser and complete the request form, or call WildPackets Technical Support. For more information about the product activation process, please see our website at: 4. When the Installer has finished installing the program files, you can choose to view the Readme or launch the program. Note The OmniEngine Manager is installed by default with OmniPeek. This application lets you configure and update settings for the separately purchased OmniEngines. For information, see the OmniEngine Getting Started Guide or the online help in the OmniEngine Manager application. 4 Installing OmniPeek

11 Installing an OmniEngine OmniPeek Getting Started Guide For complete instructions on how to install, configure, and update settings for an OmniEngine, See the OmniEngine Getting Started Guide that ships with the product. Main program window and Start Page To start OmniPeek: Choose Start > All Programs > WildPackets OmniPeek. The main program window and Start Page appears. The parts of the main program window are described below. Toolbar Start Page Status Bar Toolbar: Provides icons for frequently-used tasks in OmniPeek. Choose View > Toolbars > Show Toolbars to toggle the display of the icons in this toolbar. Installing an OmniEngine 5

12 Chapter 1: Introduction Start Page: Provides buttons for creating a new capture, opening saved capture files, viewing the OmniEngines window, and starting the monitoring of the network. Additionally, the Start Page provides links to useful resources, both local and online: Status Bar: Shows brief context-sensitive messages on the left and the current monitor adapter on the right. Choose View > Status Bar under the menu to toggle the display of this status bar. 6 Main program window and Start Page

13 C H A P T E R 2 Using OmniPeek with OmniEngines If you are using OmniPeek as a console for distributed OmniEngines, you will need to connect to the OmniEngines from the OmniEngines window in OmniPeek. (If you are using OmniPeek as a portable network analyzer only, and not as a console for distributed OmniEngines, you do not need to review this section.) OmniEngines let you capture and analyze data at any location across the network and perform real-time network analysis from the OmniPeek console. OmniEngines can capture traffic from one or more network interfaces, including Ethernet, wireless, full-duplex Gigabit, 10 Gigabit, and WAN. The OmniEngines window in OmniPeek lets you view and interact with OmniEngines, which run as a standard Windows service where they are installed and have no user interface of their own. Displaying the OmniEngines window Do one of the following to display the OmniEngines window: Choose View > OmniEngines. Click View OmniEngines on the Start Page. The OmniEngines window appears. 7

14 Chapter 2: Using OmniPeek with OmniEngines Insert Engine Discover Engine Insert Group Delete Connect Disconnect Connecting to an OmniEngine In order to view packets and data from an engine, you must first connect to the engine from the OmniEngines window. To connect to an OmniEngine: 1. From the OmniEngines window, click the Insert Engine button. The Insert Engine dialog appears. 8 Connecting to an OmniEngine

15 OmniPeek Getting Started Guide 2. Complete the dialog: Host: Enter the IP address of the OmniEngine that you want to connect to. Port: Enter the TCP/IP Port used for communications. Port 6367 is the default port for the WildPackets OmniEngine. Authentication: Select the method used to authenticate the user. For OmniEngine Windows, select Default if you don t use another third-party authentication server. For OmniEngine Linux, select Third Party. Domain: Type the Domain for login to the engine. If the engine is not a member of any Domain, leave this field blank. Username: Type the Username for login to the OmniEngine. Password: Type the Password for login to the OmniEngine. 3. Click Connect. When the connection is established, the engine appears in the OmniEngines window. Connecting to an OmniEngine 9

16 Chapter 2: Using OmniPeek with OmniEngines Tip You can add multiple engines to the OmniEngines window by using the Insert Engine button. 4. Click the Insert Group button to add a new group of engines to the OmniEngines window. A new group folder appears. 10 Connecting to an OmniEngine

17 OmniPeek Getting Started Guide 5. Select the engine group folder and click Insert Engine to add an engine to the group. Connecting to an OmniEngine 11

18 Chapter 2: Using OmniPeek with OmniEngines 12 Connecting to an OmniEngine

19 C H A P T E R 3 The Capture Window Capture windows are the main interface for presenting traffic analysis information about your network. You can have multiple configurable capture windows, each with its own selected adapter, its own dedicated capture buffer, and its own settings for filters, triggers, and statistics output. The number of capture windows you can have open at one time is limited only by the amount of available system resources. Creating an OmniPeek capture window To create an OmniPeek capture window: 1. Do one of the following to start a new capture: Click New Capture on the Start Page Choose File > New The General options of the OmniPeek Capture Options dialog appears. OmniPeek capture options 13

20 Chapter 3: The Capture Window 2. Configure the General options. 3. Choose an adapter in the Adapter options. Note Click the Help button on the dialog for more information on how to configure these options. For a description of other configuration options, see the OmniPeek User Guide or online help. 4. Click OK. A new OmniPeek capture window appears. Capture window views 5. Click Start Capture to begin capturing packets. The Start Capture button changes to the Stop Capture button and traffic statistics begin to populate the Network dashboard of the capture window. 6. Click the capture window views in the navigation bar to view captured packets, expert and statistical analysis of the data, the Peer Map display, and more. 7. Click Stop Capture to end the capture. You can choose to save, discard, or resume the capture. 14 Creating an OmniPeek capture window

21 OmniPeek Getting Started Guide Tip To resume capturing from where you left off, hold down the Shift key and click the Start Capture button. To empty the capture buffer and start a new capture, simply click the Start Capture button again. Creating an OmniEngine capture window To create an OmniEngine capture window: 1. Do one of the following to open the OmniEngines window: Click View OmniEngines on the Start Page Choose View > OmniEngines The OmniEngines window appears. 2. Connect to an engine. (To connect to an engine, see Connecting to an OmniEngine on page 8.) The Home tab for the OmniEngine appears. 3. Click New Capture under the Captures icon. The OmniEngine Capture Options dialog appears. Creating an OmniEngine capture window 15

22 Chapter 3: The Capture Window 4. Configure the General options. 5. Choose a capture adapter in Adapter options. Note Click the Help button on the dialog for more information on how to configure these options. For a description of other configuration options, see the OmniPeek User Guide or online help. 6. Click OK. A new OmniEngine capture window appears. 16 Creating an OmniEngine capture window

23 OmniPeek Getting Started Guide Capture window views 7. Click Start Capture to begin capturing packets. The Start Capture button changes to the Stop Capture button and traffic statistics begin to populate the Network dashboard of the capture window. 8. Click the capture window views in the navigation bar to view captured packets, expert, and statistical analysis of the data, the Peer Map display, and more. 9. Click Stop Capture when you want to stop collecting packets into the OmniEngine capture buffer. Note Users without permission to create or modify OmniEngine capture windows will find features grayed out, missing, or receive an error message indicating the task is not allowed. For details, see the OmniEngine Getting Started Guide. Creating an OmniEngine capture window 17

24 Chapter 3: The Capture Window 18 Creating an OmniEngine capture window

25 C H A P T E R 4 Dashboards The OmniPeek dashboards display graphical data about your network summarized into several easy-to-read displays. There are three dashboards available with OmniPeek: Network, Voice & Video, and Apdex. Network dashboard The Network dashboard displays key statistics for the capture window. If files have been automatically saved to the hard disk, the Network dashboard also displays a list of the saved files. 19

26 Chapter 4: Dashboards Network Utilization: This display graphs network traffic in Mbits/second. You can rightclick inside the display to select a Bar, Area, Line, or Line/Points display. Wireless Signal: This display graphs wireless signal and/or noise strength (as a percentage) for each of the wireless channels. This display is available only when a wireless adapter is selected as the capture adapter. You can right-click inside the display to select the parameters to display. Hovering over a channel will display a tooltip with additional channel information. Current Activity: This display shows three analog gauges with corresponding digital displays at their centers to show network utilization (as a percent of capacity), traffic volume (in packets per second), and error rate (total errors per second). You can rightclick inside the display to select a Light, Dark, or Clean background for the display. Log: This display shows the number of notifications generated by level of severity. You can right-click inside the display to select a Light, Dark, or Clean background for the display. 20 Network dashboard

27 OmniPeek Getting Started Guide Files: This display lists the files that have been saved to the hard disk. Files are only saved when the Capture-to-disk capture option is enabled. You can right-click inside the display to select a Light, Dark, or Clean background for the display. Top Talkers by IP Address: This display shows a graph of top talkers on the network, broken out by node. You can right-click inside the display to select a Bar or Pie display. Voice & Video dashboard The Voice & Video dashboard provides a visual display of voice and video call summary, as well as useful graphs and statistics to troubleshoot and analyze voice and video traffic. The parts of the Voice & Video dashboard are identified below. Call Summary: This display shows Call Counter information and Closed Call Statistics on voice and video packet loss. In addition, the Call Summary displays the Max Voice & Video dashboard 21

28 Chapter 4: Dashboards Call Time which is the point and time when the maximum call limit was reached. The Max Call Time is displayed in red text and will dynamically appear. Call Quality Distribution: This display shows open and closed calls by quality based on MOS scores. You can right-click inside the display to select a Bar or Pie display. Because MOS scores are based on media flows, and not calls, each call s quality is the lowest MOS score of any of its associated media flows. Voice media is scored with MOS- CQ, video media with MOS-V, and audio media with MOS-A. The quality thresholds are as follows: <2.0 = Bad (displayed in Red) >=2.0 to <3.0 = Poor (displayed in Orange) >=3.0 to <4.0 = Fair (displayed in Yellow) >4.0 = Good (displayed in Green) Media flows with unsupported codecs are not included in the display since we cannot obtain MOS values for these calls. Additionally, the display reflects that same data present in the Calls and Media views, and therefore is affected by the 1000 call limit. Call Quality: This display shows a line graph of the quality for each codec in use over time. You can right-click inside the display to select a Line or Line/Points graph. MOS scores are used for the quality measurement. Voice media shall be scored with MOS- CQ, video media with MOS-V, and audio media with MOS-A. The quality for a time period shall be the average of the MOS scores for all open media flows for that time period. In addition, this graph will only display MOS scores for supported codecs as unsupported codecs do not provide MOS measurements. Call Volume: This display shows a graph of open calls (per codec) over time for voice and video calls. This graph reflects all calls from the Calls and Media view, and unlike the other graphs in the dashboard, the Call Volume graph includes data for calls using unsupported codecs. You can right-click inside the display to select an Area, Line, or Line/ Points graph. Call Utilization: This display shows a graph of overall network utilization compared to network utilization by VoIP protocols. You can right-click inside the display to select an Area, Line, or Line/Points graph. This graph displays two legends: Network Utilization and Call Utilization. Utilization values are displayed in Mbits/second. The VoIP utilization shall be the total utilization for all VoIP packets (i.e., signaling, media RTP/RTCP, and unsupported codecs). 22 Voice & Video dashboard

29 OmniPeek Getting Started Guide Tip Several of the displays inside the Voice & Video dashboard support tooltips. Hover over the display to view a tooltip with additional information. Apdex dashboard The Apdex dashboard provides a visual display of the data in the Application view. The screenshot below displays individual application Apdex scores corresponding to the ratings in the Apdex column of the Application view. Apdex ratings are also displayed in the gauge and table representing each application. Sort Descending Sort Ascending Display Applications Sort By Expand All Gauges Collapse All The parts of the Apdex dashboard are described below. Apdex dashboard 23

30 Chapter 4: Dashboards Sort By: Use the drop-down list to choose how to sort the Apdex display. Sort Ascending: Sort the display in ascending order. Sort Descending: Sort the display in descending order. Display Applications: Displays the selected number of Top applications in the display. You can also choose a refresh interval from the drop-down list. Expand All: Expand the display to show all of the details. Collapse All: Collapse the display to show the minimum details. Gauges: The dial on the gauge shows the number and color associated with the Apdex score and rating: Blue: Excellent application response time ( ) Green: Good application response time ( ) Yellow: Fair application response time ( ) Red: Poor application response time ( ) Gray: Unacceptable application response time (0 -.49) Tip You can click the gauge to display the Application view and the specific details for this application. Apdex Score: This score represents user satisfaction with application performance as a score from 0.00 (unacceptable) to 1.00 (excellent). Apdex Rating: This rating is the verbal correlate to the numerical score (Unacceptable, Poor, Fair, Good, Excellent). Apdex Sample Count: This count displays the number of Apdex tasks that have completed for this application. Expert Event Count: This count displays the total number of expert events that have been identified by the Expert EventFinder. Expert Max. Event Severity: This displays the maximum level of event severity identified for this application. Expert >> Application >> [Application Name]: Click this link (or click the gauge) to display the Application view and the specific details for this application. 24 Apdex dashboard

31 C H A P T E R 5 Viewing and Decoding Packets Packets are the units of data carried on the network and the basis for all higher level network analysis. The Packets view of a capture window is where you can view information about the individual packets transmitted on your network. Capture windows also allow you to view the decoded packet contents, in raw, hexidecimal and ASCII format. The packets view 1. Open a capture window and click the Packets view. Start/Stop Capture 25

32 Chapter 5: Viewing and Decoding Packets 2. Click the Start Capture button. Packets begin populating the capture window. Node type icons 3. Right-click a column heading to hide or display available column headings. 4. Right-click a packet row and select Insert into Name Table... The Insert Name dialog appears. 5. Select a Node type icon to represent this packet. The Node type options let you choose an icon that will appear in the Packet List, for example, Workstation, Server, Router, or Access Point. The packet decode window Network problems are revealed more quickly by looking at the detailed information contained in individual packets. Looking into the packets can help you troubleshoot your network, track down a security breach, or examine protocol structure and compliance. 26 The packet decode window

33 OmniPeek Getting Started Guide To view the decode of a packet: 1. Double-click a packet in the Packets view of a capture window. The Packet Decode window appears. The decoded packet data is presented in byte order from top to bottom. Window Header Decode Hex ASCII Tip You can open individual Packet Decode windows for up to 10 packets at once. When multiple packets are selected in the active Packet List, click Enter to open them all. 2. Click on the - minus or + plus signs in the margin to collapse or expand the view of any header section. Window header: Click the Decode Previous or Decode Next buttons at the top of the window to step through the packets shown in the Packet List of the active capture window. Decode view: The packet decode window 27

34 Chapter 5: Viewing and Decoding Packets The body of the Decode view is laid out in the same order as it appears in the packet. A quick glance at this section often reveals the source of trouble. Problems like a misconfigured client, or incompatible versions of the same protocol from different vendors can be easily understood when you can see and compare the packets themselves. Hexadecimal view: The Hex view at the bottom of the decode window shows the offset of the first character in each line, the raw packet data in hex, and the ASCII version of raw packet data 3. Highlight an item in one part of the window. The same bytes of the packet are highlighted in all the other views or panes as well. The highlight matches in the Decode, Hex, and ASCII panes. Color coding is used to link the Decode view with the Hex view for both Hex and its ASCII equivalent. The Hex and ASCII views are in turn linked to the color of the protocol shown in the Protocols column of the Packet List. Toggle Orientation Highlights match: Decode Hex ASCII 28 The packet decode window

35 OmniPeek Getting Started Guide Tip Use the Toggle Orientation button in the toolbar to tile the Decode and Hex views vertically or horizontally. The packet decode window 29

36 Chapter 5: Viewing and Decoding Packets 30 The packet decode window

37 C H A P T E R 6 Creating Filters Filters let you focus on specific traffic. If you want to check a problem between two particular devices, perhaps a computer and a printer, address filters can capture just the traffic between these two devices. If you are having a problem with a particular function on your network, a protocol filter allows you to focus on traffic related to that particular function. Filters work by testing packets against the criteria specified in the filter. Packets whose contents meet these criteria match the filter. You can build filters to test for just about anything found in a packet: addresses, protocols, sub-protocols, ports, error conditions, and more. Filters are so easy to create in that you can often create a custom filter on-the-fly while analyzing suspect traffic on your network. Enabling a filter In addition to the filters that you create, the OmniPeek and the OmniEngines include numerous pre-defined filters. You can enable one or more filters when capturing or monitoring packets. To enable filters when capturing packets: 1. Click the Filters view in a capture window. 31

38 Chapter 6: Creating Filters Reject Matching Start/Stop Capture 2. Select the filter or filters that you want to enable. Note For an OmniEngine, you will need to send your selections to the engine by clicking the yellow bar below the toolbar icons labeled Click here to send changes. 3. Click the Start Capture button to begin capturing packets. Any packets that match the filters that are enabled are placed into the capture buffer. Alternately, you can choose to place the packets that do not match the filter in the capture buffer by clicking the Reject Matching icon. Creating filters with the make filter command You can use the Make Filter command to easily create a filter based on the address, protocol, and port settings of an existing packet, node, protocol, conversation, or packet decode. 32 Creating filters with the make filter command

39 OmniPeek Getting Started Guide To create a filter with the Make Filter command: 1. Right-click a packet, node, protocol, conversation, or packet decode item from one of the views available in a capture window and choose Make Filter. The Insert Filter dialog appears with the Address, Protocol, and Port settings already configured with the information from the packet that was selected. 2. Enter a new name in the Filter text box and make any additional changes. 3. Click OK. The new filter is now available whenever a list of available filters is displayed. 4. To enable the new filter in your capture window, click the Filters view and select the check box of the new filter. The filter is applied immediately, even if a capture is already under way. Creating a simple filter You can create a simple filter by manually entering the parameters for the filter that you want to create. Unlike creating a filter using the Make Filter command, you will have to manually define the parameters (address, protocol, and port settings) for the filter you want to create. Note For information on creating more advanced filters, refer to the OmniPeek User Guide or online help. To create a simple filter by defining an address and protocol: 1. Do one of the following to open the Filters view: Click the Filters view in an open capture window. Choose View > Filters from the main menu Click the Filters options in the OmniEngine Capture Options dialog Creating a simple filter 33

40 Chapter 6: Creating Filters Insert 2. Click the Insert button. The Insert Filter dialog appears. New Capture 3. Give your new filter a name. o 34 Creating a simple filter

41 OmniPeek Getting Started Guide 4. Complete the address, protocol, or port setting information and click OK. The new filter is now available whenever a list of available filters is displayed. 5. To enable the new filter in your capture window, click the Filters view and select the check box of the new filter. The filter is applied immediately, even if a capture is already under way. Tip Click the New Capture button to create a new capture window that uses the filter that you are defining in the Insert / Edit Filter dialog as the only enabled filter. Creating a simple filter 35

42 Chapter 6: Creating Filters 36 Creating a simple filter

43 C H A P T E R 7 Expert Troubleshooting The expert features in OmniPeek and the OmniEngines provide real-time analysis of response time, throughput, and a wide variety of network events and potential problems in a flowcentered view of traffic in a capture window. You can also link end-user satisfaction with the performance of a network application through the Application Performance Index (Apdex), an open standard that defines methods for reporting application performance. See Application view on page 39. The expert EventFinder detects nearly 200 different network events and provides descriptions, possible causes, and possible remedies organized by OSI layer. Depending on your version of the program, network events specifically related to VoIP, Wireless, WAN, and user-defined Network Policy items are also shown. See Using the EventFinder on page 38. The expert view window The expert Hierarchy view makes it easy to track events and to see them in the context of peerto-peer or client-server traffic patterns. To display events in the expert Hierarchy view: 1. From the capture window, click the expert Hierarchy view. Pairs of nodes are displayed at the top level, individual conversations (flows) underneath them, and individual events nested under each flow. Color coded traffic indicator lights show whether or not packets were received in the last few seconds: green (active) white (inactive) 37

44 Chapter 7: Expert Troubleshooting Summary counts EventFinder Settings Refresh Network Policy Upper pane Expert views Lower pane Expert tabs 2. Right-click in the upper pane to collapse or expand the hierarchy to display the most relevant information. Using the EventFinder You can view more details about individual network events in the Expert EventFinder Settings dialog. To open the Expert EventFinder Settings window: 1. Right-click in the Hierarchy view and select Expand All. 2. Select an individual expert event. 3. Click the EventFinder Settings button. The Expert EventFinder Settings window appears with this expert event highlighted, as shown below: 38 Using the EventFinder

45 OmniPeek Getting Started Guide Restore Selected Default Toggle All Disable All Enable All Restore All Defaults Set Defaults Import Settings Export Settings Threshold Assistant Setting Memory Usage 4. Click the Show Info button to see a complete description, possible causes, and possible remedies of this network event. The Expert EventFinder Settings window also provides information on what sensitivity or setting value was used to flag this event as significant. You can configure the value, threshold, and memory settings for each individual expert event in the EventFinder window. You can also save these settings by exporting them to a file and import them later into another capture. Application view The Application view lets you link end-user satisfaction with the performance of a network application through the Application Performance Index (Apdex). The Apdex dashboard gives you a visual presentation of the data in the Application view. See Apdex dashboard on page 23. To display the Application view: 1. Select Application under Expert in the navigation bar of a capture window. Application view 39

46 Chapter 7: Expert Troubleshooting Apdex column 2. Select an application in the Application view and notice its corresponding score in the Apdex column. 40 Application view

47 C H A P T E R 8 Statistics Analysis OmniPeek and the OmniEngines calculate a variety of key statistics in real time and present these statistics in intuitive graphical displays. You can save, copy, print, or automatically generate periodic reports on these statistics in a variety of formats. (Please refer to the OmniPeek User Guide or online help for information on generating statistics reports.) Monitoring the network The monitoring statistics function in OmniPeek provides insight into the overall flow of network traffic. It is like the view from a traffic helicopter and can indicate bottlenecks and anomalies. Use monitor statistics to identify trends and current conditions that may signal unexpected network problems. To enable OmniPeek monitor statistics: 1. Choose Monitor > Monitor Options..., or click Start Monitor on the Start Page. The Monitor Options dialog appears. 41

48 Chapter 8: Statistics Analysis 2. Click the Adapter options. 3. Select a locally installed network adapter listed under Local machine. 4. Click OK. The program begins monitoring traffic from the selected adapter in the background. The OmniPeek console will continue to collect Monitor statistics from the selected adapter until you quit the program or deselect Monitor statistics from the Monitor menu. Displaying OmniPeek monitor statistics You can view various OmniPeek monitor statistics windows by going to the Monitor menu and selecting a type of statistic to view: Nodes: Displays real-time data organized by network node. Protocols: Displays network traffic volume, in packets and in bytes, broken down by protocol and subprotocol. Network: Displays network statistics in two different ways: The Gauge tab displays network statistics as three analog dials with corresponding digital displays at their centers. A history graph under the gauges displays maximum (red line) and average (yellow line) values. The Value tab displays network statistics: duration, aggregate counts and volumes, error packets, and both Total Errors and CRC. 42 Monitoring the network

49 OmniPeek Getting Started Guide Size: Displays the Packet Size Distribution graph, showing what percentage of the packets on the network are in each size class (according to their length in bytes). Displaying OmniPeek monitor statistics 43

50 Chapter 8: Statistics Analysis Summary: Displays summary of key network statistics in real time. You can use summary Statistics to baseline normal network activity, save the data, then compare saved statistics with those observed during periods of erratic network behavior. See Baselining with summary statistics. History: Displays a graph of network performance at selected intervals over time. Channel: Displays channels statistics in two different ways: The Channel tab displays a variety of statistics and counts for each channel, laid out in tabular form. The Signal tab displays continuously updated bar graphs of signal strength for monitored network traffic WLAN: Displays an SSID (Service Set Identifier) tree view of wireless nodes. Baselining with summary statistics The summary statistics feature allows you to monitor key network statistics in real time and save these statistics for later comparison. Use this feature to baseline normal network activity, save the data, then compare saved statistics with those observed during periods of erratic network behavior to help pinpoint the cause of the problem. Summary statistics are also extremely valuable in comparing the performance of two different network segments. For example, a field support engineer could compare the real-time statistics on a client s network with a saved healthy router snapshot and easily diagnose or eliminate the source of inconsistent or poor router performance. To baseline with summary statistics: 1. Choose Monitor > Summary. The Summary Statistics window appears. 44 Monitoring the network

51 OmniPeek Getting Started Guide Snapshot 2. Click the Snapshot icon. The real-time network traffic data displayed in the Current columns is copied to a new set of columns identified as Snapshot # (where # is the sequence number of the Snapshot). Tip Right-click in the column of a Snapshot you wish to remove and select Delete Snapshot #. 3. Choose File > Save Summary Statistics to save the information to a text file. Capture window statistics OmniPeek and OmniEngine capture windows provide the following statistics views: Nodes, Protocols, Summary, Graphs (and, when an adapter is selected), WLAN, Channels, and Signal. This section introduces the features in the Nodes and WLAN views of capture windows. Capture window statistics 45

52 Chapter 8: Statistics Analysis The Nodes view Node statistics display real-time data organized by network node. You can view Node statistics in a hierarchical view or in a variety of flat views. Node statistics are available for the entire network and for a capture window. To view Node statistics for a capture window, select Nodes in the navigation pane of a capture window. Node Details Tip Double-click a node to see more detail about the activity for the selected node and the protocols it is using (or right-click the node and choose Node Details). The WLAN view When a supported wireless adapter is selected as the capture adapter, WLAN statistics are available for a capture window. WLAN statistics display an SSID (Service Set Identifier) hierarchy of wireless nodes. 46 Capture window statistics

53 OmniPeek Getting Started Guide To view WLAN statistics for a capture window, select WLAN in the navigation pane of a capture window. Color Globe Node Type The Node Type drop-down list lets you limit the display to selected nodes (All Nodes, Clients, Access Points, ESSID, Ad Hoc, Admin, Unknown, and Channels). When the WLAN hierarchy view is broken out by channels, the root branches of the tree are channels numbers, with individual WLAN hierarchy views underneath it (ESSID, BSSID, nodes, etc). The Color globes identify each node by color: Blue: ESSID Pink: AP (access point) or Ad Hoc equivalent Orange: STA or client Gray: Admin or otherwise unknown Gray with (?): Indications for a particular node are contradictory or unexpected. The WLAN view 47

54 Chapter 8: Statistics Analysis 48 Capture window statistics

55 C H A P T E R 9 Using the Peer Map The Peer Map view in OmniPeek and the OmniEngines is a powerful tool for visualizing network traffic in a capture window. The Peer Map graphically displays all of the nodes, or a user-defined subset, detected in a particular capture window. Communications between nodes is indicated with line segments. The line between nodes can be color-coded to show which protocol is used. The thickness of the line indicates the volume of traffic between nodes. The Peer Map view To display the Peer Map: 1. Open a capture window and begin capturing traffic. 2. From the capture window, click the Peer Map view. Node pairs begin to populate the Peer Map view, with conversations indicated by connecting lines. Tip Hold the cursor over a particular node in the Peer Map to see a tooltip with more information about this node. You can also hover over a conversation line to get a tooltip with information about that conversation. 49

56 Chapter 9: Using the Peer Map Options Node details Tooltip Peer Map Tabs 3. Click the Options button to open the Peer Map Options dialog. This dialog lets you choose to show or hide displayable node type icons (such as workstation or server), node visibilities, and protocol line segment gaps. 4. Click the Node Details button to view statistics about this node. 5. Use the tabs in the right pane to configure Peer Map settings: Configuration: This tab lets you set the basic parameters of the Peer Map, what part of the traffic in the capture window s buffer is displayed, and how the protocols (line segments) are displayed in the Peer Map. Node Visibilities: This tab displays node counts and nodes that are both shown and hidden in the Peer Map. 50 The Peer Map view

57 OmniPeek Getting Started Guide Profiles: This tab lets you configure settings into a profile that controls the appearance and layout of the Peer Map. 6. Right-click on a node for other options, including: Arrange: If you have changed the appearance of the Peer Map by dragging nodes to new positions, this option arranges the node back to the ellipse of the Peer Map. Node Details: This option opens the Detail Statistics window and shows details of the selected node. The Peer Map view 51

58 Chapter 9: Using the Peer Map 52 The Peer Map view

59 APPENDIX A Keyboard Shortcuts Shortcut Ctrl + N Ctrl + O Ctrl + S Ctrl + P Alt + F4 Ctrl + Z Ctrl + X Ctrl + C Ctrl + V Ctrl + B Ctrl + A Ctrl + D Ctrl + E Ctrl + H Ctrl + Shift + H Description Creates a new capture window. Opens an OmniPeek capture file or other supported file type in a new capture file window. Opens the Save dialog to save all packets in the active window. Prints the active window in a format appropriate to its type. Quit OmniPeek. Undoes the last edit. Cuts the highlighted item(s) and copies to the clipboard. Copies highlighted item(s) to the clipboard. Pastes the current contents of the clipboard. Deletes all packets from the active capture window. Selects all packets, text, or items in a window. Removes all highlighting and selection. Opens the Select dialog, where you can use filters, ASCII or hex strings, packet length, and Analysis Modules to select captured packets. Removes selected packets from the display without deleting them. Hidden packets are not processed further. Removes unselected packets from the display without deleting them. Hidden packets are not processed further. 53

60 Chapter A: Keyboard Shortcuts Shortcut Ctrl + I Ctrl + T Ctrl + U Ctrl + G Ctrl + F Ctrl + J Ctrl + M Ctrl + L Ctrl + Y Ctrl + 1 Ctrl + 2 Ctrl + 3 Ctrl + 4 Ctrl + 5 Ctrl + 6 Ctrl + 7 Ctrl + 8 Ctrl + Tab Ctrl + Shift + Tab F1 F11 Description Initiates the send packet. Transmits the send packet. Restores all previously hidden packets to normal status. Opens the Go To dialog where you can choose a packet number to jump to. If packets are selected, the number of the first selected packet is shown. Finds patterns. Jumps to the next selected packet. Opens the Filters window. Opens the Log window. Toggles the packet capture function. Opens the monitor Node Statistics window. Opens the monitor Protocol Statistics window. Opens the monitor Network Statistics window. Opens the monitor packet Size Statistics window. Opens the monitor Summary Statistics window. Opens the monitor History Statistics window. Opens the monitor Channel Statistics window. Opens the monitor WLAN Statistics window. Makes the next window in sequence the active window. Makes the previous window in sequence the active window. Launches the Online Help. Display OmniPeek in a full screen window. 54

61 Index A adapter options 14 Apdex 37, 39 Application Performance Index (Apdex) 37, 39 application view 24, 39 ASCII 28 authentication 9 B baselining with summary statistics 44 C call quality 22 call quality distribution 22 call summary 21 call utilization 22 call volume 22 capture options dialog 13 adapter options 14 general options 13, 14 capture window 13, 26 packets view 25 WLAN tab 46 channel statistics 44 current activity, dashboard 20 D dashboard network 19 voice & video 21 domain 9 E expert analysis 37 expert EventFinder settings 37, 38 F files, dashboard 21 filter 31 creating a simple filter 33 enable a filter 31 insert filter dialog 34 make filter command 32 reject matching 32 filters reject matching 32 G gauge tab 42 general options 13, 14 Gigabit 4 H hexadecimal view 28 hierarchy view expert view 37 history statistics 44 host 9 I insert engine dialog 8 IP address 9, 21 L log, dashboard 20 M monitor statistics 41 N network dashboard 19 network statistics 42 network traffic 41 node detail statistics window 46 55

62 Index node details 46 node statistics 42, 46 node type icon 26, 50 O OmniEngine 1 connect 8 OmniEngine capture window creating 15 OmniEngine Manager 4 OmniPeek 1 OmniPeek capture window creating 13 OSI layer 37 P packet decode 26 packet size distribution graph 43 packets view 25 password 9 peer map 49 peer map settings 50 port 9 port protocol statistics 42 Q quality call 22 quality distribution call 22 R raw packet data 28 reject matching 32 S signal statistics 44 size statistics 43 SSID (service set identifier) 44 start capture 14, 17 start page 5 statistics node 46 WLAN 46 stop capture 14, 17 summary call 21 summary statistics 44 baselining with summary statistics 44 snapshot 45 T top talkers by IP address 21 U username 9 V value tab 42 voice & video dashboard 21 volume call 22 W WAN 4 wireless LAN 4 wireless nodes 44 wireless signal 20 WLAN statistics 44, 46 WLAN tab 46 56