Feature # 5: Expert view and Expert EventFinder

EtherPeek NX™

> ## Feature # 5: Expert view and Expert EventFinder

> #### Expert analysis of peer-to-peer communications

> The Expert view provides expert analysis of delay, throughput and a wide variety of network events and potential problems in a conversation-centered view of traffic in a Capture window or Packet File window.

> The Expert EventFinder not only helps identify key events, but it also helps you understand the meaning, the typical causes, and the typical solutions to the problems it uncovers. Detailed information is only a click away.

> ### Using the Expert view

> To see the Expert view in action:

> 1. Open a new Capture window and capture a sample of packets.
> 2. Click the Expert tab to open the Expert view.
> 3. Watch the Events column for a conversation with some number of events. Alternatively, you can watch the LED lights at the far left of the Conversations pane. The colors of the LEDs indicate the presence and severity of events within a particular conversation.
> 4. Stop capture when you have a sample containing identified events.
> 5. Scroll in the Conversations pane (the upper pane) of the Expert view and select a conversation or flow with one or more events.
> 6. Expand the view of that flow by clicking on the + (plus) sign at the left margin.
> 7. Expand the descriptions of the individual events encountered, by clicking on the + (plus) sign at the left margin.

> 1. Select an individual event.
> 2. Right-click on the event and choose EventFinder Setting from the context menu to open the Expert EventFinder Settings dialog with this particular class of event highlighted.
> 3. Notice that the Expert EventFinder Settings dialog tells you not only what sensitivity or setting value was used to flag this event as significant, but it also provides a more complete Description of the event and identifies Possible Causes and Possible Remedies.
> 4. Close the Expert EventFinder Settings dialog, but do not close the Expert view.

> The Expert view makes it easy to get to the source of trouble. When the Expert view identifies an event as significant, you have a variety of ways to get to the packets involved. You can select all the packets in a conversation or an individual packet or group of packets with a particular event. Where a diagnosis is based on a change or an unexpected response, you can select the pair of packets that allowed the diagnosis.

> To review all the packets in a conversation diagnosed with one or more events:

> 1. In the Conversations pane (the upper pane) of the Expert view, select a conversation with one or more events.
> 2. Click the Express Select button in the Expert view header section.
> 3. In the Selection Results dialog which appears, choose Hide Unselected, and click OK.
> 4. In the resulting Packets view, scroll to the Expert column. Notice that individual packets have entries here, provided by the Expert Analysis function.
> 5. You can scroll through the Expert column entries to choose a packet to open (by double-clicking on its entry in the Packets view), or

> To see the pair(s) of packets associated with a problem diagnosis:

> 1. In the supplemental information panes area at the bottom of the Expert view, click the Event Log tab to open the Event Log.
> 2. Click in the header of the Event column to sort by that column. You can sort the Event Log by any of its columns. The Event column of the Event Log shows the same information as is provided in the Expert column of the Packets view.
> 3. Each log entry is a single packet. Select one or more log entries containing a reference to a second packet, such as (see packet 503). Events related to transmission retries, response times, rate changes, and so forth may reference a second packet.
> 4. Right-click on the entry or entries and choose Select Related Packets > Selected Entries + "See" or "From Pkt" from the context menu.
> 5. From the Selection Results dialog which appears, you have a number of options for displaying decodes of the packets selected.

> ### Expert EventFinder

> The Expert EventFinder scans traffic in a Capture window or Packet File window, looking for key events. The EventFinder's 91 separate events cover anomalies, sub-optimal performance and other significant events at all layers of the network from application to physical. The Expert monitors Client/Server delay and throughput as well.

> You can enable and disable each test individually. In addition, many of the events have user-defined settings and thresholds, allowing you to fine-tune the Expert system to precisely fit your needs. You can save and reload Expert EventFinder settings for use in particular environments.

> In addition, the Expert EventFinder Settings window shows the Description, Possible Causes, and Possible Remedies for each event it can diagnose.

WildPackets, Inc.
http://www.wildpackets.com
Voice: (800) 466-2447
Fax: (925) 937-2479
sales@wildpackets.com