ClearSight AnalyzerS.pdf · ClearSight Analyzer application-centric analysis workflow The ClearSight Analyzer automatically analyzes application flows, and can classify traffic by

Technical DataAnalysis software delivering answers for application performance issues

The award-winning ClearSight™ Analyzer

(CSA) offers advanced application-centric

monitoring and performance analysis,

enabling enterprise Network Administra-

tors and Engineers to maintain, diagnose,

and resolve application and network

performance issues in multi-protocol

network environments. CSA supports most

of the commonly used protocols, and us-

ers can import Wireshark decodes to take

advantage of decodes contributed from

the open-source community – making CSA

the most versatile application analysis

tool in the market.

ClearSight™ AnalyzerApplication-centric analysis software delivering answers for application performance problems

Key Features• Application-centricanalysisthatautomaticallyanalyzesapplicationflowswithintuitive

drilldowntoidentifytherootcauseofperformanceissues

• Real-timeapplicationperformancemonitoringwithalarmsforproblemidentification

• Time-basedanalysisfortracefilesupto4Gigabytestoquicklyidentifyrelevantpacketsfortheapplication-centricview

• Realtimestatistics,bouncechartsandreportsforflowsonsingleormultiplesegments–toseeissuesquickly

• Videoandvoicecallstatus,QoSanalysisandplayback

• Usercustomizablesummaryreport

• SupportsWireSharkdecodeengine

2

Figure 1: QoS analysis of a SIP VoIP call

Figure 2: HTTP Statistics

Figure 3: Trending volume of connections

Innovative application-centric analysisThroughasimpleandintuitivefrontpage,CSApresentsacomprehen-

sive,high-levelapplicationhealthoverviewofyournetwork.Fromthat

framework,youcandrilldowntogainaccesstomoredetailedinforma-

tion.Forexample,CSAwillrecognizeandanalyzeallflowsofanHTTP

application,displaythenumberofservers,clientsandthroughput.

Withasimpleclick,youcanthenseeeachflowwithabouncechart

andexpertidentificationofthepacketsthatcausedtheproblem.This

unparalleledlevelofcontrolandvisibilityspeedstimetoapplication

problemresolutionandminimizesoverallnetworkdowntime.

Real-time monitoring with problem/ issue detectionTheCSAExpertAlertfunctionautomaticallydetectscommunication

faultsfromcapturedormonitoredpacketsanddisplaysthemwith

colorcodedicons.Thespecificapplication,server,orflowthathasa

problemcanbeseenataglancefromtheApplicationSummary

FrontPage.

AlertsdetectedbyCSA,eitherinreal-timeorfromatracefile,are

classifiedasissues(faultsinthecommunicationsequence)orproblems

(faultsthatexceedathresholdvalue)andarelogged.Listscanbe

sortedbysimplyclickingonacolumnheader.Youcandrilldownto

theassociatedflowcausingtheproblembyright-clickingonanalert

duringpost-captureanalysis.Problemsandissuescantriggeremail,

pager,script,orSNMPtrapactions.

Time-based analysis to identify problems quicklyAnalyzinglargecapturefilescanbedifficultbecausethereisjusttoo

muchinformationtosortthrough.CSAprovidesatime-basedanalysis

ofcapturefilesprovidingdetailedstatisticsandtrendinginformation.

Youcandrilldownintimetolookatadjacenteventsduringthetime

ofinterest.ForvideoandvoicetrafficrunningSIPorH.323,theanaly-

sisenginecanclassifythevideoandvoiceRTPstreamsbasedontheir

qualityscore,MOSorVQFactor.Itwillprovidedetailedstatisticsof

theSIPorH.323callstatusandqualityofcalls.Youcanselectoneor

moreoftheRTPstreamstobeextractedfordetailedanalysisorreplay.

AdditionalanalysisisavailableforHTTP,listingtablesclientsbyserver

orvice-versaalongwithspecifcURLsaccessedanderrorcodes.With

thisanalysis,userscanidentifytheproblemsquickly,withoutdrilling

intopacketdecodes.

3

Automatic bounce chartCSAautomaticallycreatesbouncechartsforeachTCPflowidentified.

Thisgraphicallyrevealsthedynamicsofpacketflowbetweenclients

andserverswithouthavingtomanuallydecodepackets.Timing,direc-

tionofflow,andpayloadsummary,aredisplayedwhileTCPorother

errorsarecolorcodedforquickidentification.Itprovidesanextremely

powerfulwaytounderstandprotocolinteractionsbetweenvarious

networkelements.

Unique multi-segment analysisCSAsupportsmostofthecommonlyusedcapturefileformats.Itcan

receivepacketscapturedfromuptofourlocationsonthenetwork

andmergethemtoprovideamulti-segmentbouncechart.Thisallows

timingissuestobeisolatedquicklybysegmentforrootcauseanalysis.

CombinedwiththepowerfuldecodefeatureofCSA,thisprovides

networkengineersandapplicationanalyststhetoolstoendfinger

pointing.

Triple play readySpeechqualityparametersincludingpacketloss,jitter,Rvalue,and

MOSaredisplayedgraphically.StreamingvideoimplementedbyMPEG2

overUDPissupported.Supportincludesacompletesetoffunctions,

includingdecode,filter,problemdefinitionwithalerts,andafullset

ofreports–real-time,history,tracefile,andvoicequality.Content

playbackissupportedinbothreal-timeandpostanalysis.

Content reconstruction and playbackYoucanrecreateaudioandvideocontentfromVoIPorvideoflows,

eitherduringreal-timemonitoringorfromatracefile.Inaddition,

Microsoft®Exchange®email,FaxoverIP,instantmessagesandHTTP-

basedwebpagescanalsobereconstructed.Thisisveryvaluableas

proofofcomplianceviolationorvisualizationofmultimediaquality.

Figure 4-2: NAT Multi-Segment

Figure 4-3: SIP Multi-Segment

Figure 5-1: Video playback

Figure4-1:VoIPMulti-SegmentAnalysis

Figure 5-2: Email Playback Figure 5-3: Web Playback

4

Figure 7: H.323 Report

Figure 8: HTTP Report

Figure 9: IP Response Time Report

Powerful Filtering SchemeCSAnotonlysupportssimpleaddressandprotocolfilters,butalsosup-

portsfiltersbasedonapplicationcommands,IPsubnets,datapatterns,

andothercriteria.Complexconditions(seeFigure6)canbespecified

witheasebyfreelyaddingandcombiningfilterconditionsusingAND,

OR,andNOToperatorswhileviewingthesettingspanel.Oncespeci-

fied,afilterdefinitioncanbesavedwithanassignednameandthen

reusedatalatertimeforcaptureortracefiledisplay.

Comprehensive Traffic ReportCSAprovidesalargeinventoryofstandardreportsinchartandtable

formatsshowingstatisticsandperformancefornetworktraffic,servers,

andapplications.CSAgeneratesreportsfromreal-timedataortrace

files.SeeQoSreportsforvoiceandvideotraffic,showingstatistics

suchasjitter,latency,packetloss,MOS,J-MOS,R-value,andvideo

qualityfactor.Elementsofthesereportscanbeeasilycombinedto

producecustomreports.

CSA-1045 Adds Advanced Optional Features

History Reporter

Producenetwork,application,andothertrendreportsbasedon

real-timestatisticaldataaccumulatedoverlongerperiodsoftime.

Packet Generator

Aversatilegeneratorallowsyoutoperformnetworkloadtestingand

trafficreproductiontesting.Twomodesaresupported:1)Packetmode;

aspecifiedpacketissentrepeatedly,2)Buffermode;trafficfroma

tracefileisreproducedonthenetwork.

Multicast Analysis

TheMulticastVisualizerOptionprovidescountersandstatistics

describingandquantifyingthetrafficoneachdetectedmulticast

address.CSAextractsmulticastgroupaddresses(IGMPforIPv4and

MLDforIPv6)frompacketssentbyhoststorouters.

Figure 6: Filter

5

Step 1

Step 2

Step 3

Step 4

Step 5

ClearSight Analyzer application-centric analysis workflowTheClearSightAnalyzerautomaticallyanalyzesapplicationflows,and

canclassifytrafficbyapplicationsuchasHTTP,email,andVoIPto

makeiteasytoseetheflowofeachtransaction.Youcanalsodrill

downfromtheflowviewforasessiontothepacketleveland

reconstructtheapplicationcontent.

Step 1: Start Monitor.

Networktrafficmonitoringstartsautomatically.Trafficisclassified

byapplication.Applicationswithproblemsandissuescaneasilybe

identifiedwithYelloworRedicons.

Step 2:Select Application.

Selectinganapplicationdisplaysalistofrespectiveflowsandtheir

associatedserversandhosts.Aredoryellowiconappearsforflowsfor

whichafaultorothereventhasbeendetected,soitiseasyto

seewhichflowshaveaproblem.

Step 3:Select Flow.

Clickingaflowselectsanddisplaystheflowofcommunicationbetween

theclientandserver(ladderview).Packetsforwhichafaultorother

eventhasoccurredareindicatedbyaredoryellowarrow,soyoucan

quicklyidentifyexactlywhereandwhenacommunicationproblem

hasoccurred.

Step 4:Automatic Filter/Packet Decoding Display.

Clickingapacketintheapplicationflowdisplay(ladderview)opens

thepackettranslationscreenwhichisfilteredtoshowonlythe

associatedtransaction.

Assuch,itonlytakesafewclickstogofromthetopapplicationlevel

tothedetailedpacketdisplay,makingtroubleshootingquickerand

easier.

Step 5:Replay Application Content.

Theapplicationcontentoveraselectedflowcanbereproducedin

ClearSighttoshowtheactualcontent.

6

Features Summary

Feature Description

Application-centric Summary PageImmediatelyseetheproblemlayersandquicklydetermineoverallapplicationhealthfromreal-timetrafficmonitoredortracefile

Real-time monitoring of applications Seeapplicationandconfigurationflowviewswithorwithoutcapturingpackets

Expert Alert FunctionSetproblemthresholdsandseeimmediatelywhenanapplication,server,orflowhasaproblem.Programemail,pager,script,orSNMPactionstobeperformedwhenaproblemoccurs

Time-based analysis of trace files

Fortracefilesupto4GByteinsize,conductanalysisbasedonuserdefinedtimerangeforpacketswithinthetracefile.AnalysisincludesapplicationperformanceforHTTP,H.323,SIPandRTP,TrendingNetworkLayercharacteristicssuchasoccurrenceofTCPSYN,Retransmission,IPmatrixandHost,totrafficvolumetrendbyframecount/byte/framesizecount.Userscanexportpacketsthatfitthedisplaycriteriatoconductapplication-centricanalysis.

Protocol ForcingApplyprotocolforcingduringreal-timemonitoringorwhenreplayingatracefiletoidentifyprotocolencapsulatedinanotherprotocol

Timing displays for application conversation Networkdelaysandpoorresponsetimespoprightoutoftheapplicationflowviewandidentifyslowcommands,poorservice,orapplicationperformanceissues

Multi-Segment ViewCorrelateIPpacketflow,UDPand/orTCPbetweentwohostsorserverandclientacrossmultiplephysicalsegments.

Comprehensive Filtering FunctionsLimitmonitoring,capture,ordisplaytothosethingsthatinterestyoubycreatingfiltersbasedonapplicationcommands,IPsubnets,datapatterns,andmanyothercriteria.BuildupcomplexfiltersusingAND,OR,andNOToperations.Name,save,andreusefilters

Quick capture or display filter generation Right-clickonaflowtoapplycapture/displayfilterforthatflowonly

Full packet decodes (with support for Jumbo Frame)

SwitchtoaDecodetabtoseetraditionalfullpacketdecodesinSummary,Detail,andHexscreens,duringreal-timemonitoringorfromatracefile

VOIP Call Log browserApplysimplefilteringandsortingtobrowseforindividualcallsusingcriteriasuchasstarttime,callduration,callerandcalleeidentifiers,andMOSscoreduringreal-timemonitoring

Voice and Video QoS AnalysisWhenanRTPflowisrecognizedasincludingavideoflow,ClearSight™AnalyzerdisplaysVQFactor™statisticsforthevideocomponentaswellasMOSstatisticsfortheaudiocomponent

Protocol SpecificationsProtocol Description

Supported Non-VoIP ApplicationsDNS,HTTP,FTP,TELNET,Citrix,POP3,SMTP,Exchange,ISAKMP,KERBEROS,MSSQL,Oracle,SMB,AIM,BOOTP,Gopher,MediaPlayer,Napster,NETBIOS,NFS,NNTP,QuickTime,RIP,RIPNG,SNMP,TFTP,XWindows,YahooMessenger,MSN,Skype

Supported VoIP ApplicationsH.323(H.225,H.245,RAS),SIP(RFC3261,T.38FaxoverIP),MGCP,MEGACOorH.248,SCCP(Skinny),SIGTRAN(IUA:RFC3057ISDNUA,SUA,M2PA,M2TP,M2UA:RFC3331,SS7MTP2UA,M3UA:RFC3332,SS7MTP3UA,MAP,SCTP,ISUP),RTP,RTCP,RTSP

Play (decode) Audio CodecsG.711(µ-lawanda-law),G.721,G.722,G.723,mono,G.726,G.729,GSMmono,4-bitmonoDVI8KHz,11.025KHz,22.05KHz,MPEGlayer(I,II-TS,III,IV),iLBC,AMR(GSM,3GPP),ASF

Mobile Protocol Supportfor3G-324MandLTEtheumbrellaprotocolforvideotelephonyin3G/4Gmobilenetworks

EOAM Decode EthernetOAMframesinbothITUandIEEEformat

Note: Partial list shown above. For full list, please visit www.flukenetworks.com/protocolsupport

7

Fluke NetworksP.O.Box777,Everett,WAUSA98206-0777

Fluke Networksoperatesinmorethan50countriesworldwide.Tofindyourlocalofficecontactdetails,gotowww.flukenetworks.com/contact.

©2012FlukeCorporation.Allrightsreserved.PrintedinU.S.A.6/20123780533C

System RequirementsItem Minimum Requirement

Computer Industrystandardcomputersystem(laptopordesktop),withaCD/DVD-ROMdriveforsoftwareinstallation

Processor Pentium4(orequivalent)runningat1GHzminimum(2GHzrecommended)

RAM512MBminimum(1GBrecommended)2GBminimumifrunningWindows7ProfessionalEdition

Hard Disk Space 40GBharddrivewithatleast15GBofavailablespace.

Operating SystemMicrosoftWindowsXPHomeEditionwithSP3(Disablethefirewall)MicrosoftWindowsXPProfessionalwithSP3(Disablethefirewall)Windows7ProfessionalEdition(32and64bit)

MonitorVGAcolormonitorwith1024x768resolution.SupportforDirectX9graphicswith:WDDMDriver,minimum128MBofgraphicsmemory,PixelShader2.0inhardwareand32bitsperpixelrequiredforWindows7ProfessionalEdition.

Network Adapter NetworkconnectionwithNDIS-compliantnetworkdevicedriver

Product and OptionsModel Description

CSN/CSA-1000 ClearSightAnalyzerSoftware

CSN/CSA-1000CD ClearSightAnalyzerSoftwareonCD

CSN/CSA-1045 CSAwithIPMulticastVisualizer,HistoryReporterandPacketGenerationoption

CSN/CSA-1045CD CSAwithIPMulticastVisualizer,HistoryReporterandPacketGenerationoptiononCD

CSN/OPT-3045 IPMulticastVisualization,HistReporter,andPacketGenforCSA

SupportModel Number Description

GLD-SW-1000 GoldSupportServices,1YearSoftwareMaintenanceforCSA-1000

GLD-SW-1045 GoldSupportServices,1YearSoftwareMaintenanceforCSA-1045