Monitoring and Managing Network Application Performance
0 likes•931 views
The document discusses the evolution and significance of protocol analyzers in modern network management, highlighting their shift from basic toolkits to advanced graphical and distributed systems essential for diagnosing performance issues. It emphasizes the importance of detailed analysis for troubleshooting and monitoring, alongside features like network forensics and real-time data access. The text also outlines considerations for selecting appropriate tools and WildPackets' capabilities in providing comprehensive network performance solutions.
Monitoring and Managing Network Application Performance
- 1. The Importance of Protocol Analyzers in Today's Networks Jim Thor – WP Professional Services WildPackets, Inc. www.WildPackets.com (925) 937-3200 © WildPackets, Inc. www.wildpackets.com
- 2. The Early Days of Protocol Analysis • We used to use Protocol Analyzers for Break/Fix ‒ Meaning we would try to fix the problem every other way before getting the protocol analyzer out of the cabinet and trying to figure out how to use it. • Protocol Analyzers were mostly text based decoders ‒ Good for bit level analysis, but very hard to use when looking for the needle in the haystack. • You had to physically be where you wanted to capture the packets ‒ No such thing back then as remote or distributed analysis The Importance of Protocol Analysis © WildPackets, Inc. 2
- 3. Times Have Changed! • Those shortcomings of early analyzers are gone ‒ Many of today’s analyzers are Graphical, Distributed and Historical • Networks are larger and faster than ever before ‒ Getting to 40Gbps now and soon to 100Gbps • Systems are faster and integrated into daily life ‒ There was a day when a computer was a ‘nice to have’. ‒ Most everyone now has a computer in their pocket, and uses it for daily tasks and communications. • Today’s networks are the life blood of businesses ‒ Without a well run network, your business may die! The Importance of Protocol Analysis © WildPackets, Inc. 3
- 4. Is There a Doctor in the House? © WildPackets, Inc. www.wildpackets.com
- 5. How’s Your Network's Health? • We have doctors to keep us healthy ‒ Businesses have Network Administrators and Engineers • But a doctor has to have tools ‒ He has his 5 senses and he is very well educated! ‒ His knowledge alone does not make for a good doctor! He has to be smart and have experience as well. • You better hope your doctor has the right tools ‒ Simple tools he could have stethoscope, a thermometer, a reflex hammer, etc ‒ These would be akin to network tools like ping, traceroute, and logs The Importance of Protocol Analysis © WildPackets, Inc. 5
- 6. It’s All in the Details! • Flow based reporting is nice… ‒ Flow information is a good start, but generally not good for understanding the details. It’s way too generic and high level. • Sometimes, you have to have the details, Period. ‒ But not always. There are a lot of available tools. The right tool depends on the question. • What is the question you are trying to answer? ‒ ‘Proof is in the Details’. With the details, you can answer almost ANY question. ‒ Generally, every question from overall utilization to what bit is set in a packet, can all be answered with a protocol analyzer. The Importance of Protocol Analysis © WildPackets, Inc. 6
- 7. The Right Tools Matter! • The tool should not impact the Network! • Simple tools are helpful and useful even today ‒ Simple tools like ping, tracert, etc., are still necessary and helpful • More advanced tools are necessary ‒ Netflow, S-Flow, and SNMP are helpful, but often leave too many questions unanswered • With the right tools, there is NO need to guess! ‒ Detail oriented tools (packet analysis) give the answers down to the bit level ‒ These tools can also answer questions ‘back in time’ using Network Forensics features The Importance of Protocol Analysis © WildPackets, Inc. 7
- 8. Network Forensics • Knowing what is happening on the network now ‒ Real time information is always important on any network • Often, it is important to go ‘Back in Time’ ‒ Security breaches happen before you know about them ‒ Replicating an issue is often not possible ‒ Why wait for an intermittent issue? Go ‘Back’ and see it! • Network Forensics features allow you to go back and find the packets from the past ‒ It may be that a server was hacked. Who did it, when, and what else did they do or what systems did they access! ‒ Also allows for Comparative Analysis, which makes the task of protocol analysis much easier and more accurate The Importance of Protocol Analysis © WildPackets, Inc. 8
- 9. The Important Features of a Good Protocol Analyzer © WildPackets, Inc. www.wildpackets.com
- 10. The Necessary Features Depend on Your Needs! • Most important is Ease of Use! ‒ Protocol Analysis can be hard. Having an analyzer that is hard to use adds unnecessary burden and time to the analysts tasks • Distributed and Local Capture capabilities ‒ Protocol Analysis is only accurate where you are capturing, so you usually want to capture at multiple locations to understand what is happening across the network at various locations • Software and Hardware Solutions ‒ Since you want to have as many capture points as possible, having a cost effective solution for deploying at the distribution and access switches is extremely important The Importance of Protocol Analysis © WildPackets, Inc. 10
- 11. Additional Items to Consider • Speeds and Feeds. ‒ Also make sure the devices are capable of captures on multiple interfaces simultaneously, and aggregating if necessary • Forensics ‒ Do you need the ability to ‘Go Back in Time?” Most people do. • Wireless ‒ Do you have any 802.11 networks? If so, make sure the analyzer you choose supports WLAN captures. • VoIP ‒ If you have a VoIP environment, or are planning on having one soon, make sure to choose an analyzer that supports those needs. The Importance of Protocol Analysis © WildPackets, Inc. 11
- 12. How We Have Helped • Saved lives! ‒ Yes, the results and analysis of 802.11 Wi-Fi traffic in a hospital found the source of interference that was causing device outages • Stopped hackers! ‒ The ongoing long term capture in a software company found the source of the attach, and exactly which systems were compromised • Made networks faster! ‒ Many examples of fixing network issues that were causing poor performance. Fixing the issues made the networks much faster. • Proved it wasn’t the network! ‒ Application vs. Network, we prove constantly who the true culprit is! • Made the network users more productive! ‒ By fixing network, application and systems issues, all users are more productive, including network, system, and application administrators! The Importance of Protocol Analysis © WildPackets, Inc. 12
- 13. The Feature Presentation © WildPackets, Inc. www.wildpackets.com
- 14. Focusing Blame or Fixing the Issue? • Now that we know more about protocol analyzers, let’s look at a common problem ‒ Who is to blame? • The performance is bad, so… ‒ Who is to blame? • The Users are complaining… ‒ Who is to blame? • More importantly, where do we focus to find the issue, and fix it! ‒ Stop the Blame Game! Let’s then now focus on solving this issue and not focusing the blame! The Importance of Protocol Analysis © WildPackets, Inc. 14
- 15. © WildPackets, Inc. www.wildpackets.com
- 16. The Weigh In Create a baseline… • Not just, “How much bandwidth am I consuming on my network or segment?” • Also, “How much is the X Application consuming?” ‒ What users connect to it? ‒ What outbound connections does the app do? ‒ With what ports? With what nodes? What times? How often? • It’s impossible to predict the winner if you don’t know your network and applications… … and understand their behaviors. The Importance of Protocol Analysis © WildPackets, Inc. 16
- 17. Scoring the FIGHT What to look for… • Primary events are anything related to “Slow” ‒ Depending on what events we see, we will know who is at fault • Application events: ‒ HTTP slow response time ‒ Oracle slow response time ‒ Inefficient client • Network events: ‒ TCP SLOW segment recovery ‒ Slow retransmissions ‒ Slow acknowledgements ‒ Low throughput Let the Expert Analysis help be the referee The Importance of Protocol Analysis © WildPackets, Inc. 17
- 18. Did Someone Say, "TKO"? Get Proof… System or Application is at fault Network may be at fault The Importance of Protocol Analysis © WildPackets, Inc. 18
- 19. Who Won? The Network? This shows that there are some slow acknowledgements that could be network related… but keep in mind factors like distance Let’s keep looking… The Importance of Protocol Analysis © WildPackets, Inc. 19
- 20. Or is it the System or Application? This shows slow responses that are system or application related Let’s go round by round… The Importance of Protocol Analysis © WildPackets, Inc. 20
- 21. Follow Events to See Who is Involved Use the JAB right-click option and ‘Select Related Packets’ on the event The Importance of Protocol Analysis © WildPackets, Inc. 21
- 22. Get the Flows, Not Just Those Packets Here we would click on ‘Close’, keeping our 113 packets highlighted! The Importance of Protocol Analysis © WildPackets, Inc. 22
- 23. Do the Winning Combo… ‘Select Related’ We can UPPERCUT (right-click) on any highlighted packet and do a ‘Select Related’, then ‘By Flow’ The Importance of Protocol Analysis © WildPackets, Inc. 23
- 24. All the Packets – All the Flows We have selected every packet, in every flow, with the expert event of interest The Importance of Protocol Analysis © WildPackets, Inc. 24
- 25. Tale of the Tape "Scoring the Fight" When we select ‘Slow Server Response Time’, two sessions to the same server are highlighted. This looks like a system or application issue – not the network. But we need proof! The Importance of Protocol Analysis © WildPackets, Inc. 25
- 26. Visual Expert is the Proof! Here is the proof we were looking for! Two requests for data, two quick TCP Acks, but then a long delay before the server sent us the data we requested. Then the Data Payload Requests and Acks gets returned Length = 0 much later Payload Length = 1260 The Importance of Protocol Analysis © WildPackets, Inc. 26
- 27. A Closer Look Looking more granular at the timing, we see that the ACK came back in 70ms, but the data didn’t get sent back for another 854ms! ACK fast = Network fast Data slow = System slow The Importance of Protocol Analysis © WildPackets, Inc. 27
- 28. Tune the Expert for your network Make these times relevant for your network or the task at hand! And use the Import and Export features to quickly switch when necessary The Importance of Protocol Analysis © WildPackets, Inc. 28
- 29. And the winner is… You! What we covered… • Determining whether the application, system, or network is at fault using TCP • Tapping the power of ‘Select Related’ using flows to troubleshoot root causes • Eliminating false positives by tuning Expert Events The Importance of Protocol Analysis © WildPackets, Inc. 29
- 30. What’s in your network? • Manage proactively or by exception ‒ Determine top talkers, nodes, and protocols ‒ Receive early warnings of performance problems anywhere in the network and then quickly drill down for expert analysis ‒ No need to reproduce issues, simply “replay the tape” (network forensics) • Monitor the entire network ‒ Identify issues and optimize VoIP and Video quality of service ‒ Measure quality of services applications are delivering to end users ‒ Evaluate network utilization for capacity planning and upgrades • Optimize and secure your Wireless infrastructure ‒ Identify and fill security holes such has weak encryption or rogue access points ‒ Determine gaps in service across access points • Extend the capabilities for custom applications ‒ Develop plug-ins to integrate with proprietary equipment ‒ Build decodes for proprietary protocols The Importance of Protocol Analysis © WildPackets, Inc. 30
- 31. About WildPackets © WildPackets, Inc. www.wildpackets.com
- 32. Corporate Overview Pioneer and global leader in network and application performance monitoring, management, and analysis. • Our Company ‒ Founded: 1990 ‒ Headquarters: Walnut Creek, CA ‒ Offices throughout US, EMEA, APAC • Our Customers ‒ Thousands of active mid-market and enterprise customers ‒ 60+ countries / 80% of Fortune 1,000 ‒ Financial, government, education, health care, telecom • Our Products ‒ Patented, awarding-winning hardware and software solutions that optimize network performance and eliminate downtime The Importance of Protocol Analysis © WildPackets, Inc. 32
- 33. Real-World Deployments Education Financial Government Health Care / Retail Telecom Technology The Importance of Protocol Analysis © WildPackets, Inc. 33
- 34. OmniPeek Network Analyzer • Standalone Analysis and Remote Analysis UI ‒ Can be used as a portable analyzer, or standalone ‒ Can also connect and configure distributed OmniEngines/Omnipliances • Comprehensive dashboards present network traffic in real-time ‒ Vital statistics and graphs display trends on network and application performance ‒ Visual peer-map shows conversations and protocols ‒ Intuitive drill-down for root-cause analysis of performance bottlenecks • Visual Expert diagnosis speeds problem resolution ‒ Packet and Payload visualizers provide business-centric views • Automated analytics and problem detection 24/7 ‒ Easily create filters, triggers, scripting, advanced alarms and alerts The Importance of Protocol Analysis © WildPackets, Inc. 34
- 35. The Importance of Protocol Analysis © WildPackets, Inc. 35
- 36. Omnipliance Network Recorders • Captures and analyzes all network traffic at the source 24x7 ‒ Runs our OmniEngine intelligent probe software ‒ Generates vital statistics on network and application performance ‒ Intuitive root-cause analysis of performance bottlenecks • Intelligent data transport ‒ Network data analyzed locally ‒ Detailed analysis passed to OmniPeek on demand ‒ Summary statistics sent to WatchPoint for long term trending and reporting ‒ Efficient use of network bandwidth • Expert analysis speeds problem resolution ‒ Fault analysis, statistical analysis, and independent notification • Multiple Issue Digital Forensics ‒ Real-time and post capture data mining for compliance and troubleshooting The Importance of Protocol Analysis © WildPackets, Inc. 36
- 37. Unprecedented Network Visibility NETWORK HEALTH GLOBAL WatchPoint can manage and report on key devices’ performance and availability across the entire network, from anywhere on the network. UNDERSTAND END-USER PERFORMANCE TimeLine and Omnipliance network recorders monitor DISTRIBUTED and analyze performance across critical network segments, virtual environments, and remote sites. PINPOINT NETWORK ISSUES ANYWHERE Omnipliance Portable can rapidly identify and troubleshoot PORTABLE issues before they become major problems—wired or wireless—down the hall or across the globe. ROOT-CAUSE ANALYSIS OmniPeek network analyzer performs deep packet inspection DPI and can reconstruct all network activity, including e-mail and IM, as well as analyze VoIP and video traffic quality. The Importance of Protocol Analysis © WildPackets, Inc. 37
- 38. WildPackets Product Lines Software and Hardware Solutions for Portable and Distributed Network Monitoring and Analysis © WildPackets, Inc. www.wildpackets.com
- 39. Product Offerings Software and Turnkey Appliances • Enterprise Monitoring and Reporting ‒ WatchPoint Server ‒ OmniFlow, NetFlow, SNMP, and sFlow Collectors • Network Probes & Recorders ‒ Omnipliance Network Recorders – Edge, Core ‒ TimeLine Network Recorder ‒ OmniAdapter Analysis Cards • Portable Hardware Solutions ‒ Omnipliance Portable • Windows based Software Solutions ‒ OmniPeek software – Enterprise, Professional, Basic, Connect ‒ OmniEngine software – Enterprise, Desktop, OmniVirtual The Importance of Protocol Analysis © WildPackets, Inc. 39
- 40. Omnipliance Network Recorders Price/performance solutions for every application Portable Edge Core TimeLine Ruggedized Small Networks / Regional Offices / Datacenter Troubleshooting Remote Offices Small Datacenter Workhorse Chassis 1U 3U 3U Memory 24GB 4 GB 6 GB 18 GB Expansion 2 PCI-E 2 PCI-E 4 PCI-E 4 PCI-E Storage 6 TB 1 TB 8 TB / 16 TB 8 TB / 16 TB / 32 TB Max. CTD 4.5Gbps 1Gbps 3.8Gbps 11+Gbps The Importance of Protocol Analysis © WildPackets, Inc. 40
- 41. Comprehensive Support and Services Standard Support Premier Support Maintenance and upgrades 24 x 7 x 365 Telephone and email contacts Dedicated escalation manager Knowledgebase 2 customer contacts per site MyPeek Portal Plug-in reconfiguration assistance WildPackets Training Academy Public, web-based, and on-site classes Complete curriculum: Technology and product focused Practical applications and labs covering network analysis, wireless, VoIP monitoring and advanced troubleshooting Consulting and Custom Development Services Deployment, configuration, and assessment engagement Systems integration and testing Application integration, driver, decode, interface development The Importance of Protocol Analysis © WildPackets, Inc. 41
- 42. Key Differentiators • High-level network monitoring to root-cause analysis • Single solution for today’s converged networks ‒ Wired, Wireless, 1GB, 10GB, VoIP, Video, TelePresence, IPTV • Reduce and even eliminate network downtime ‒ Automated monitoring 24x7 ‒ Speedy resolution of network bottlenecks • Improve network and application performance • Uniquely extensible platform – tailored to your needs ‒ Plug-ins and APIs for integration and customization • Fastest capture to disk performance in the industry The Importance of Protocol Analysis © WildPackets, Inc. 42
- 43. Thank You! & Questions… Check out MyPeek! @ mypeek.wildpackets.com Follow us on SlideShare! Check out today’s slides on SlideShare WildPackets, Inc. www.slideshare.net/wildpackets www.WildPackets.com (925) 937-3200 © WildPackets, Inc. www.wildpackets.com