Allegro Network Multimeter Manual

IP module: Difference between revisions

Page Discussion

IP module (view source)

Revision as of 07:36, 22 June 2022

653 bytes removed ,  22 June 2022
→‎Connections tab
Line 142: Line 142:
The connection tabs lists all connections which involves the current IP. The button rows allow to select which kind of information should be shown.
The connection tabs lists all connections which involves the current IP. The button rows allow to select which kind of information should be shown.


* The table lists the client and server side and shows the IP address, port, and corresponding country of that IP.
* The maximum transmission unit (i.e. layer 2 payload) is calculated for both directions. The maximum values of the connection are displayed in the '''MTU''' column.
* The layer 4 protocol is the protocol of the layer 4 protocol used (TCP, UDP, or others).
* The start time is the time of the first packet for that connection, while the last activity column shows the time of the last packet seen so far for the connection. It is possible to sort for both fields to see the most recent active connections.
* The number of packets and bytes as well as the current throughput is shown too.
* The DPI protocol column shows the detect layer 7 protocol.
* The Response time column contains response times for TCP and the maximum HTTP response for HTTP connections, or the SSL response times for SSL connections. The column also contains a score for this connection and this IP, based on the average response times of the server. See HTTP module and SSL module for additional information. When sorting the column and more than one time value is shown in a field, the maximum of all time values of that field is taken into account.
* The TCP retransmissions columns shows the number of bytes that have been retransmitted on TCP layer because of packet loss. High percentage indicate connection problems for this communication pair.
* The TCP missed data column shows the estimated amount of TCP data not seen for this connection. See [[TCP module#Missed data|TCP module]] for details about missed data.
* The TCP flags column show the amount of TCP SYN, SYN-ACK, FIN and RST packets per direction. Up to 255 packets can be accounted, if more were seen, >= 255 will be displayed.
* The TCP max window size columns show the size of the biggest TCP receive window announced for each direction of a connection.
* The TCP max used window size columns shows how much of the TCP receive window of the corresponding direction has been used at max during the lifetime of the connection, in other words this is the bytes in flight of the opposite, sending direction.
* The TCP window usage columns show the ratio of the TCP max window size compared to the actual max used window size.
* The TCP window size limit columns show the maximum possible value that could be used for the TCP receive window size. This is calculated from the announced TCP window scale option for each direction of a connection.
* The raw window scale (ws) shift count value is displayed in parentheses next to the byte value.
* The TCP window limit usage columns show the ratio of the TCP max window size values compared to the TCP window size limit values in percent.
* The Client announced and negotiated TLS version and cipher suites columns shows the TLS versions and all supported cipher suites announced by the client during a SSL client hello. In the negotiated columns the currently used TLS version and cipher suite is shown as indicated by the SSL server hello. As the client announced cipher suite list can be quite long, it is possible expand or minimize the list by click on it.
* The column Meta data may contain additional information that could be retrieved depending on the protocol. For instance, for HTTP traffic this column shows the request URL and response code for the last transaction seen in the corresponding connection.
* The columns VLANs and Interfaces shows which VLAN tags has been seen for a specific connection and at which interface the connection has been established. This is especially helpful in bridge mode to determine at which side of link the connection has been established.
* The column PPPoE shows the PPPoE session ID which has been seen for packets of that specific connection. If a PPPoE session ID changes at any time while the connection is active, a 'changed' indication is given. In this case the latter session ID is displayed.
{| class="wikitable"
{| class="wikitable"
|+
|+
Line 193: Line 154:
|-
|-
|Layer 4 protocol
|Layer 4 protocol
|
|TCP, UDP, or others
|-
|-
|Go to
|Go to
|
|allows to go to the connection details page which shows all information in more detail.
|-
|-
|Start time
|Start time
|
|The start time is the time of the first packet for that connection.
|-
|-
|Last activity
|Last activity
|
|shows the time of the last packet seen so far for the connection
|-
|-
|Duration
|Duration
|
|Difference between last activity and start time.
|-
|-
|Packets
|Packets
|
|Number of packets
|-
|-
|Bytes
|Bytes
|
|Number of bytes
|-
|-
|Packets/s
|Packets/s
|
|Packet rate
|-
|-
|Bit/s
|Bit/s
|
|Bit rate
|-
|-
|MTU
|MTU
|
|The maximum transmission unit (i.e. layer 2 payload) is calculated for both directions.
|-
|-
|Layer 7 protocol
|Layer 7 protocol
|
|shows the detect application layer 7 protocol.
|-
|-
|TCP handshake time
|TCP handshake time
|
|The time between SYN and ACK.
|-
|TCP response time (max)
|
|-
|-
|TCP response time (avg)
|TCP response time (max/avg)
|
|contains response times for TCP data
|-
|-
|Layer 7 response time
|Layer 7 response time
|
|contains response times for the maximum HTTP response for HTTP connections, or the SSL response times for SSL connections. The column also contains a score for this connection and this IP, based on the average response times of the server. See HTTP module and SSL module for additional information. When sorting the column and more than one time value is shown in a field, the maximum of all time values of that field is taken into account.
|-
|TCP retransmissions
|
|-
|-
|TCP retransmissions %
|TCP retransmissions/TCP restransmission %
|
|shows the number of bytes that have been retransmitted on TCP layer because of packet loss. High percentage indicate connection problems for this communication pair.
|-
|-
|TCP DUP ACKs
|TCP DUP ACKs
|
|Number of DUP ACK packets
|-
|-
|TCP missed data
|TCP missed data
|
|shows the estimated amount of TCP data not seen for this connection. See [[TCP module#Missed data|TCP module]] for details about missed data.
|-
|-
|TCP SYNs
|TCP SYNs/SYN-ACKs/FINs/RSTs
|
|shows the amount of TCP SYN, SYN-ACK, FIN and RST packets per direction. Up to 255 packets can be accounted, if more were seen, >= 255 will be displayed.
|-
|TCP SYN-ACKs
|
|-
|TCP FINs
|
|-
|TCP RSTs
|
|-
|-
|TCP end termination reason
|TCP end termination reason
|
|Connection end can be regular FIN, RST, or timeout if no termination is seen at all
|-
|-
|TCP max window size
|TCP max window size
|
|shows the size of the biggest TCP receive window announced for each direction of a connection.
|-
|-
|TCP max used window size
|TCP max used window size
|
|shows how much of the TCP receive window of the corresponding direction has been used at max during the lifetime of the connection, in other words this is the bytes in flight of the opposite, sending direction.
|-
|-
|TCP window size limit
|TCP window size limit
|
|The TCP window size limit columns show the maximum possible value that could be used for the TCP receive window size. This is calculated from the announced TCP window scale option for each direction of a connection. The raw window scale (ws) shift count value is displayed in parentheses next to the byte value.
|-
|-
|TCP window limit usage
|TCP window limit usage
|
|show the ratio of the TCP max window size values compared to the TCP window size limit values in percent.
|-
|-
|TCP zero window packets
|TCP zero window packets
|
|Number of TCP zero window packets indicated full receive buffer.
|-
|-
|Client announced TLS versions
|Client announced TLS versions/Negotiated TLS version, Client announced cipher suites/Negotiated cipher suite
|
|shows the TLS versions and all supported cipher suites announced by the client during a SSL client hello. In the negotiated columns the currently used TLS version and cipher suite is shown as indicated by the SSL server hello. As the client announced cipher suite list can be quite long, it is possible expand or minimize the list by click on it.
|-
|Negotiated TLS version
|
|-
|Client announced cipher suites
|
|-
|Negotiated cipher suite
|
|-
|-
|TLS alert
|TLS alert
Line 298: Line 235:
|-
|-
|Validity
|Validity
|
|Connections are counted as valid if the handshake succeeded or at least some data is transferred.
|-
|-
|Meta data
|Meta data
|
|may contain additional information that could be retrieved depending on the protocol. For instance, for HTTP traffic this column shows the request URL and response code for the last transaction seen in the corresponding connection.
|-
|-
|Outer VLANs
|Outer VLANs
|
|shows which VLAN tags has been seen for a specific connection.
|-
|-
|Inner VLANs
|Inner VLANs
|
|shows which inner VLAN tags has been seen for a specific connection in QinQ setups.
|-
|-
|PPPoE session ID
|PPPoE session ID
|shows the PPPoE session ID which has been seen for packets of that  
|shows the PPPoE session ID which has been seen for packets of that specific connection. If a PPPoE session ID changes at any time while the connection is active, a 'changed' indication is given. In this case the latter session ID is displayed.
specific connection. If a PPPoE session ID changes at any time while the
connection is active, a 'changed' indication is given. In this case the
latter session ID is displayed.
|-
|-
|MPLS labels
|MPLS labels
Line 322: Line 256:
|-
|-
|Interfaces
|Interfaces
|
|shows at which interface the connection has been established. This is especially helpful in bridge mode to determine at which side of link the connection has been established.
|-
|-
|Two-way latency avg interval
|Two-way latency avg interval
|
|[[Path measurement#Measurement_statistics|Statistics from the path measurement]]
|-
|-
|Two-way latency min interval
|Two-way latency min interval
Ralf
547

edits

Retrieved from "https://allegro-packets.com/wiki/Special:MobileDiff/4018"