Network Burst Analysis: Difference between revisions

How can you use the Allegro Network Multimeter to quickly and easily detect network bursts and find the related sender and receiver? <br>In our example, users are complaining about sudden slow application load times at certain points of the day.<br>To close in on the problem, we can use the Allegro Packets Network Multimeter and measure the TCP handshake time.

== Incident rules ==

Since network bursts appear at random hours of the day the Allegro Network Multimeter has the option to create rules to automatically capture the incidents and notify the user.

To create a new rule first navigate to ‘Incidents’ under ‘Generic’ Tab.

 

 

 

Here you will find all your already created rules with option of editing or deleting them.

 

 

 

 

'''Rule name:''' Name of the to be created rule.

 

 

 

 

'''Virtual link group:''' if enabled, can detect end-to-end failure between two physical Ethernet interfaces. It allows the switch to detect unidirectional or bi-directional link failures irrespective of intermediary devices and enables link recovery.

 

 

 

'''Aggregation of recurring incidents:''' Groups incidents with the same rule trigger if enabled.

 

'''Rule description:''' Every rule can get its own description.

'''Traffic capturing:''' Select which kind of traffic the rule is capturing from.

For our example, we will create a rule to check if the TCP handshake time stays below 0.2 seconds.

| [[File:Burst_analysis_handshake_rule.png|600px|thumb|right]]

'''Note:''' For our example it would not be wise to enable a notification, because this rule will trigger a lot on a daily basis and fill up the inbox.

 

After creating a rule, if ‘Traffic capturing’ is enabled, with the ‘Capture settings’ you can customize the saving of the capture.  

| [[File:Burst_analysis_capture_settings.png|1000px|thumb|right]]

 

'''Capture cooldown period:''' Cooldown prevents additional capture for given time for each rule separately.

 

'''Storage Device:''' Select the storage device the capture is saved to.

 

'''Storage directory:''' Insert the directory of the storage device here.

 

'''Select packet ring buffer to capture from:''' List of all possible packet ring buffer to capture from.

 

'''Capture profile:''' List of all created capture profiles.

 

 

 

If you want to be notified about a rule triggering, first a notification channel needs to be created.

 

To create more reporting channels, visit the ‘Notification channels’ tab.

| [[File:Burst_analysis_reporting_channels.png|1000px|thumb|right]]

Firstly, you will see a list of all created channels with the options of sending a test to the given recipient, editing the channel or the option to delete it.

With the green ‘Add channel’ button a new channel can be created.

| [[File:Burst_analysis_add_channel.png|600px|thumb|right]]

 

 

'''Type:''' Type of message that should be send in case of an incident.

 

 

'''Handle incidents for:''' what kind of traffic incidents does the channel handle?

 

'''Email recipient address:''' name of the email address the incident should be reported to.

 

If you want to see a live view of all the data your rules are checking, under ‘Incident statistics’ tab you can get short statistics for all your created rules.

| [[File:Burst_analysis_incident_statistics.png|1000px|thumb|right]]

 

 

Finally, under the ‘Occurred incidents’ tab you will see a list of all past incidents.

 

 

Clicking on the subject of an incident will open a new window with more information for the specific occurrence.

| [[File:Burst_analysis_rule_trigger.png|800px|thumb|right]]

Should a further investigation of the IP statistics be necessary, click on the given link in the subject. It will open an analysis of the IP address of the timeframe when the incident occurred.<br>These statistics can also be downloaded as a PCAP for further analysis.

 

| [[File:Burst_analysis_ip_statistics.png|1000px|thumb|right]]