60
edits
Global settings: Difference between revisions
no edit summary
No edit summary |
No edit summary |
||
| Line 9: | Line 9: | ||
* '''Bridge mode''': In Bridge mode A.K.A. In-Line mode, all received packets will be transmitted between corresponding port pairs (e.g. 1+2, 3+4 on Allegro 500) so that the Allegro can be placed in-line between any network component.<br/ >The device will operate transparent and will not modify network traffic in any way. The additional latency will be typically around or less than 1 millisecond.<br>In Bridge mode it is also possible to process network traffic from a mirror port or Tap. However, "only" half of the total available ports on each respective Allegro Network Multimeter model can be used to operate in this way. For example on a 4-port Allegro model 500, you can conveniently leave the unit in bridge mode and connect up to two mirror ports on interfaces 1 and 3 respectively. Aforementioned interfaces are physically separated and not an (in-line) interface pair.<br />Always avoid connecting mirror port traffic on an Allegro Network Multimeter interface pair (e.g. 1+2, 3+4 on Allegro 500), as this will result in TX traffic in the direction of a mirror port which if highly undesirable.<br />[[File:Inline mode.jpg|800px|Allegro in brigde mode (in-line)]] | * '''Bridge mode''': In Bridge mode A.K.A. In-Line mode, all received packets will be transmitted between corresponding port pairs (e.g. 1+2, 3+4 on Allegro 500) so that the Allegro Network Multimeter can be placed in-line between any network component.<br/ >The device will operate transparent and will not modify network traffic in any way. The additional latency will be typically around or less than 1 millisecond.<br>In Bridge mode it is also possible to process network traffic from a mirror port or Tap. However, "only" half of the total available ports on each respective Allegro Network Multimeter model can be used to operate in this way. For example on a 4-port Allegro model 500, you can conveniently leave the unit in bridge mode and connect up to two mirror ports on interfaces 1 and 3 respectively. Aforementioned interfaces are physically separated and not an (in-line) interface pair.<br />Always avoid connecting mirror port traffic on an Allegro Network Multimeter interface pair (e.g. 1+2, 3+4 on Allegro 500), as this will result in TX traffic in the direction of a mirror port which if highly undesirable.<br />[[File:Inline mode.jpg|800px|Allegro in brigde mode (in-line)]] | ||
* '''Sink mode''': In Sink mode, the Allegro will operate "receive only".<br />Packets are not forwarded and there's no bi-directional traffic on any of the monitoring ports. This operation mode allows for installation at a Mirror port of a Switch or when using a network Tap to access the network traffic.<br />[[File:Sink mode1.jpg|800px|Allegro in Sink mode on Mirror port or Tap]] | * '''Sink mode''': In Sink mode, the Allegro Network Multimeter will operate "receive only".<br />Packets are not forwarded and there's no bi-directional traffic on any of the monitoring ports. This operation mode allows for installation at a Mirror port of a Switch or when using a network Tap to access the network traffic.<br />[[File:Sink mode1.jpg|800px|Allegro in Sink mode on Mirror port or Tap]] | ||
* '''Mixed bridge/sink mode:''' This mode enables to configure the packet processing mode for each interface pair. Interface pairs default to Bridge mode but the mode can be permanently changed in the [[interface statistics]]. | * '''Mixed bridge/sink mode:''' This mode enables to configure the packet processing mode for each interface pair. Interface pairs default to Bridge mode but the mode can be permanently changed in the [[interface statistics]]. | ||
| Line 34: | Line 34: | ||
=== Webshark support === | === Webshark support === | ||
The Allegro Network Multimeter allows having a preview of packets, directly in the browser. This is the so called Webshark. To support Webshark previewing, the Allegro needs to reserve an amount of system memory. | The Allegro Network Multimeter allows having a preview of packets, directly in the browser. This is the so called Webshark. To support Webshark previewing, the Allegro Network Multimeter needs to reserve an amount of system memory. | ||
This reserved amount of memory (RAM) is configurable and will not be available for the In-Memory database, thus the history of stored statistics in the dashboard becomes a little shorter. If this is not desired, it is possible to disable the Webshark support. | This reserved amount of memory (RAM) is configurable and will not be available for the In-Memory database, thus the history of stored statistics in the dashboard becomes a little shorter. If this is not desired, it is possible to disable the Webshark support. | ||
| Line 65: | Line 65: | ||
It is possible to modify the detail level of all graphs in the interface. This settings allow you to see a more detailed view (with higher time resolution) or to reduce the detail level so more data can be stored on the device. Changing the default values has an impact on the performance and memory usage. Changing a slider to the left increases the detail level of graphs, but increases memory usage and decreases performance. | It is possible to modify the detail level of all graphs in the interface. This settings allow you to see a more detailed view (with higher time resolution) or to reduce the detail level so more data can be stored on the device. Changing the default values has an impact on the performance and memory usage. Changing a slider to the left increases the detail level of graphs, but increases memory usage and decreases performance. | ||
* Best graph resolution: This option configures how detailed the graph information are shown in the best case (the latest information). The default value is one second which means that a graph sample point represents a second of packet time. You can change the resolution up to 1 millisecond which gives a detailed sub-second representation of the traffic. You can also decide to decrease the resolution which enables the Multimeter to store more data for a longer period of time. | * Best graph resolution: This option configures how detailed the graph information are shown in the best case (the latest information). The default value is one second which means that a graph sample point represents a second of packet time. You can change the resolution up to 1 millisecond which gives a detailed sub-second representation of the traffic. You can also decide to decrease the resolution which enables the Allegro Network Multimeter to store more data for a longer period of time. | ||
* Reduce graph resolution of old data by up to: The resolution of older graph data is automatically reduced to save memory and to allow a longer view into the traffic history. This option allows you to change this behaviour. With a reduction factor of 1/1 no reduction is done at all which means the selected graph resolution is available for the complete time. | * Reduce graph resolution of old data by up to: The resolution of older graph data is automatically reduced to save memory and to allow a longer view into the traffic history. This option allows you to change this behaviour. With a reduction factor of 1/1 no reduction is done at all which means the selected graph resolution is available for the complete time. | ||
| Line 78: | Line 78: | ||
Performance implications: The performance degradation and memory usage depends on the actual network traffic and is not exactly predictable. | Performance implications: The performance degradation and memory usage depends on the actual network traffic and is not exactly predictable. | ||
Here are some examples for reference on a Multimeter 1000 series with different configuration values (under ideal test conditions): | Here are some examples for reference on a Allegro Network Multimeter 1000 series with different configuration values (under ideal test conditions): | ||
* 1 second resolution, 1/1 reduction factor: 90% of default performance | * 1 second resolution, 1/1 reduction factor: 90% of default performance | ||
| Line 113: | Line 113: | ||
To enable a time service, switch to the desired type in the dropdown box. The time service field will show whether the selected service is running or not. | To enable a time service, switch to the desired type in the dropdown box. The time service field will show whether the selected service is running or not. | ||
'''NTP''' - For active NTP time retrieval, you can specify and edit dedicated NTP servers the Allegro should communicate with. If you do not specify a NTP server, a set of predefined NTP servers will be automatically selected. | '''NTP''' - For active NTP time retrieval, you can specify and edit dedicated NTP servers the Allegro Network Multimeter should communicate with. If you do not specify a NTP server, a set of predefined NTP servers will be automatically selected. | ||
'''NTP from data plane''' - For passive time retrieval, NTP from data plane can be used to retrieve the time to be synchronized passively from NTP packets within the traffic that is analyzed. The IP address of a desired NTP server must be set. As soon as a NTP server packet is seen, the system time of the Multimeter will be set. The wait period field can be used to set a time period where subsequent updates are ignored. If set to 0, every time packet of that server will be used. NTP from data plane is ideal in situation where the Allegro MGT interface can not or may not actively connect to the network. | '''NTP from data plane''' - For passive time retrieval, NTP from data plane can be used to retrieve the time to be synchronized passively from NTP packets within the traffic that is analyzed. The IP address of a desired NTP server must be set. As soon as a NTP server packet is seen, the system time of the Allegro Network Multimeter will be set. The wait period field can be used to set a time period where subsequent updates are ignored. If set to 0, every time packet of that server will be used. NTP from data plane is ideal in situation where the Allegro MGT interface can not or may not actively connect to the network. | ||
'''PTP''' - For PTP time retrieval, the PTP grandmaster clock identity is shown. This is usually an EUI-64 address. The first and last set of octets of the identity represent the (EUI-48) MAC address of the grandmaster. | '''PTP''' - For PTP time retrieval, the PTP grandmaster clock identity is shown. This is usually an EUI-64 address. The first and last set of octets of the identity represent the (EUI-48) MAC address of the grandmaster. | ||
| Line 125: | Line 125: | ||
* Domain number: The domain number of the grandmaster. This is used to define logical groups of synchronized clocks. | * Domain number: The domain number of the grandmaster. This is used to define logical groups of synchronized clocks. | ||
'''GPS''' - The GPS time retrieval option will become available when a GPS capable PTP grandmaster card is installed in the Multimeter. | '''GPS''' - The GPS time retrieval option will become available when a GPS capable PTP grandmaster card is installed in the Allegro Network Multimeter. | ||
If no time synchronization mechanism is selected the date and time of the device can be manually configured by entering a properly formatted date and time description. | If no time synchronization mechanism is selected the date and time of the device can be manually configured by entering a properly formatted date and time description. | ||
| Line 169: | Line 169: | ||
=== VLAN handling === | === VLAN handling === | ||
The Allegro Network Multimeter can '''ignore VLAN tags''' for connection tracking. Enabling this option may be necessary if network traffic is seen on the Network Multimeter that contains changing VLAN tags for the same connection. For example, depending on the configuration of the Mirror Port to which the Network Multimeter is connected, incoming traffic could contain a VLAN tag while outgoing traffic does not. In this example, a connection would appear twice in the statistics which often is desired behaviour to be able to identify a network misconfiguration. In some cases however, such "duplicate" data in the dashboard may be misleading, and the user would want to see only one connection. In these scenarios the option ignore VLAN tags may be enabled. | The Allegro Network Multimeter can '''ignore VLAN tags''' for connection tracking. Enabling this option may be necessary if network traffic is seen on the Allegro Network Multimeter that contains changing VLAN tags for the same connection. For example, depending on the configuration of the Mirror Port to which the Allegro Network Multimeter is connected, incoming traffic could contain a VLAN tag while outgoing traffic does not. In this example, a connection would appear twice in the statistics which often is desired behaviour to be able to identify a network misconfiguration. In some cases however, such "duplicate" data in the dashboard may be misleading, and the user would want to see only one connection. In these scenarios the option ignore VLAN tags may be enabled. | ||
===Tunnel view mode=== | ===Tunnel view mode=== | ||
The Allegro Network Multimeter can decapsulate VXLAN, ERSPAN type II and type III, GENEVE, CAPWAP as well as L2TPv3 data traffic. In this mode all non-encapsulated traffic will be discarded. On the Dashboard a dropped counter will display dropped non-encapsulated packets for indication if this mode is active. The Multimeter will show the encapsulated content in all analysis modules. When capturing, packets with complete outer Layer 2, Layer 3, GRE, ERSPAN, GENEVE, CAPWAP and L2TPv3 headers will be stored as seen on the wire. | The Allegro Network Multimeter can decapsulate VXLAN, ERSPAN type II and type III, GENEVE, CAPWAP as well as L2TPv3 data traffic. In this mode all non-encapsulated traffic will be discarded. On the Dashboard a dropped counter will display dropped non-encapsulated packets for indication if this mode is active. The Allegro Network Multimeter will show the encapsulated content in all analysis modules. When capturing, packets with complete outer Layer 2, Layer 3, GRE, ERSPAN, GENEVE, CAPWAP and L2TPv3 headers will be stored as seen on the wire. | ||
===Database mode settings === | ===Database mode settings === | ||
The database mode is a special analysis mode for high-performance Network Multimeters with multiple processors to increase the performance on such systems. It is normally enabled automatically but depending on the actual network traffic and system usage, some parameter tweak might be necessary to improve overall system performance. | The database mode is a special analysis mode for high-performance Allegro Network Multimeters with multiple processors to increase the performance on such systems. It is normally enabled automatically but depending on the actual network traffic and system usage, some parameter tweak might be necessary to improve overall system performance. | ||
You should only change these parameters in discussion with the Allegro Packets support department. | You should only change these parameters in discussion with the Allegro Packets support department. | ||
These settings are only visible if your Network Multimeter is capable of running this mode. | These settings are only visible if your Allegro Network Multimeter is capable of running this mode. | ||
You can read more about the meaning of the settings [[DB mode|here]]. | You can read more about the meaning of the settings [[DB mode|here]]. | ||
| Line 185: | Line 185: | ||
===Network performance=== | ===Network performance=== | ||
There are several network performance settings available to improve performance on high-performance systems in case of packet drops during very high incoming bandwidth. They are only visible if your Network Multimeter is capable of changing these settings. | There are several network performance settings available to improve performance on high-performance systems in case of packet drops during very high incoming bandwidth. They are only visible if your Allegro Network Multimeter is capable of changing these settings. | ||
*Max RX queues per socket: This setting specifies the quantity of threads dedicated to read and write interactions with the network interface controllers. By increasing this value, network receive bandwidth can be increased before packet drops occur. By decreasing this value, data analysis will improve. The default setting of 2 RX queues is suitable for most configurations since data analysis typically needs much more processing ressources. | *Max RX queues per socket: This setting specifies the quantity of threads dedicated to read and write interactions with the network interface controllers. By increasing this value, network receive bandwidth can be increased before packet drops occur. By decreasing this value, data analysis will improve. The default setting of 2 RX queues is suitable for most configurations since data analysis typically needs much more processing ressources. | ||
| Line 195: | Line 195: | ||
===Processing performance=== | ===Processing performance=== | ||
Processing performance may be modified on high-performance systems. This is only visible if your Network Multimeter is capable of changing this setting. | Processing performance may be modified on high-performance systems. This is only visible if your Allegro Network Multimeter is capable of changing this setting. | ||
* Processing performance mode: This setting allows for fine tuning processing performance. By using '''Analysing''', as much processing ressources on all CPUs as possible are used for data analysis. By using '''Capturing''', the focus will be on high data throughput and low latency for capturing purposes by using only the CPU where the preferred network controller is attached to. This has an impact on data analysis performance. '''Analysing''' is used by default. | * Processing performance mode: This setting allows for fine tuning processing performance. By using '''Analysing''', as much processing ressources on all CPUs as possible are used for data analysis. By using '''Capturing''', the focus will be on high data throughput and low latency for capturing purposes by using only the CPU where the preferred network controller is attached to. This has an impact on data analysis performance. '''Analysing''' is used by default. | ||