Generic troubleshooting processes: Difference between revisions

Herewith Pcap files can be retroactively (back-in-time) extracted out of the Allegro’s ring buffer. The download buttons also can be used to initiate pre-filtered Live captures. E.g. clicking the download button next to IP 192.168.178.101, will initiate a capture that is already pre-filtered to only capture traffic containing that IP during the selected time interval. Again, such time interval may be in the past, as the Allegro can extract this from its packet ring buffer.

If you want very detailed information about a certain IP, go to the IP-details page of that specific IP. This is easily done, by clicking on an IP, everywhere throughout the Allegro web interface. This will bring you to the IP-details page of that specific IP-address. The IP-details page, gives you 1-click access to all sorts of network performance information -during the selected time frame-. The different tabs that you can go through on the IP-details page, are highlighted in green in the image below.   

As you can see, it is very easy to look into and investigate the (mis)use of QoS and protocols by an IP. From the IP details page, you can also quickly and easily look into communication relations on the connection level and even dive into the TCP-statistics for that IP.

For quality and performance assessment, Allegro’s quality dashboard is a great place to start. All of the most important graphs, related to high level quality and performance monitoring/troubleshooting, are gathered on this page.

The first graph on Allegro’s predefined quality dashboard, represents “Burst Analysis”. Because the Allegro Network Multimeter supports data measurement intervals (sampling rates), as detailed as 1 ms, you can identify instances where a Link is 100% saturated, for very short fractions of time. Evidently, micro bursts could potentially be a root cause for network performance issues. Other than Allegro Packets, most monitoring & troubleshooting solutions are unable to pick this up, because of “low resolution” data sampling (i.e. 1, 5, or even 10 minutes).

The second graph provides you with trending information about global response times for TCP and HTTP, SSL, DNS plus DHCP. Clicking on “Application”, will bring you to the response time overview page, where trending response time graphs for HTTP, SSL, DNS and DHCP are individually presented.

From here, it is very easy to identify -and zoom in on- timing related issues that happened on the network. In the 1-day time frame exampled above, clearly HTTP and DHCP show instances where response time deviated massively from the overall median line.  

You can select such a spike in the graph by clicking and holding the left mouse-button, selecting the spike and then releasing the left mouse-button. When zoomed in to your liking, click on the graphs title (e.g. DHCP) which will bring you to that specific details page.

Because you already zoomed into to a specific time frame on the graph, this page will now only show you the client / DHCP-server relations, that happened during the time frame that you selected in the graph. Also on this page, you’ll find a download button for simple (retroactive) extraction of a Pcap, that is pre-filtered to only contain DHCP and BOOTP packets.