Burst analysis on a Mirror or Packet Broker input

Problem

The Allegro Network Multimeter is connected to a mirror port or packet broker. By default, this makes it very hard to analyze a specific Link for bursts as the packet are aggregated on the mirror or packet broker port.

Please note that this guide is based on the use case guide Network Burst Analysis.

Link Burst Measurement

By default, each Multimeter measures the Bursts per Interface at L2 Ethernet → Burst Analysis

Here you can configure the speed per link as the maximum speed.

MAC Burst measurement

To analyze a specific link, you can use the MAC burst analysis. This is shown at the tab MACs in the burst analysis. It allows to set a specific receive and send packet rate for one mac address. If you have an uplink, simply use the routers MAC address here and the specify the maximum receive and send rate of the routers uplink.

In this example, I have used a test link with 250MBit/s downlink and 40MBit/s uplink for the Router Mac address.

Please note that the Burst analysis is done with 1 millisecond resolution by default. In our example, the router is connected with 1 GBit/s and it can send more than the configured bandwidth. This is shown in the display as an utilization of ">> 100%" and indicates a burst that might not be able to be handeled by this uplink.

Advantage for Mirror Port and Packet Brokers

The MAC burst detection can be used for a specific end device ( a file server,... ) or for the gateway of an uplink ( router,... ). It allows to monitor links and end devices even in out-of-band installations.