The award-winning ClearSight™ Analyzer (CSA) offers advanced application-centric monitoring and performance analysis, enabling enterprise Network Administrators and Engineers to maintain, diagnose, and resolve application and network performance issues in multi-protocol network environments. CSA supports most of the commonly used protocols, and users can import Wireshark decodes to take advantage of decodes contributed from the open-source community – making CSA the most versatile application analysis tool in the market.

Innovative application-centric analysis

Through a simple and intuitive front page, CSA presents a comprehensive, high-level application health overview of your network. From that framework, you can drill down to gain access to more detailed information. For example, CSA will recognize and analyze all flows of an HTTP application, display the number of servers, clients and throughput. With a simple click, you can then see each flow with a bounce chart and expert identification of the packets that caused the problem. This unparalleled level of control and visibility speeds time to application problem resolution and minimizes overall network downtime.

Real-time monitoring with problem/ issue detection

The CSA Expert Alert function automatically detects communication faults from captured or monitored packets and displays them with color coded icons. The specific application, server, or flow that has a problem can be seen at a glance from the Application Summary Front Page.Alerts detected by CSA, either in real-time or from a trace file, are classified as issues (faults in the communication sequence) or problems (faults that exceed a threshold value) and are logged. Lists can be sorted by simply clicking on a column header. You can drill down to the associated flow causing the problem by right-clicking on an alert during post-capture analysis. Problems and issues can trigger email, pager, script, or SNMP trap actions.

Time-based analysis to identify problems quickly

Analyzing large capture files can be difficult because there is just too much information to sort through. CSA provides a time-based analysis of capture files providing detailed statistics and trending information. You can drill down in time to look at adjacent events during the time of interest. For video and voice traffic running SIP or H.323, the analy-sis engine can classify the video and voice RTP streams based on their quality score, MOS or VQFactor. It will provide detailed statistics of the SIP or H.323 call status and quality of calls. You can select one or more of the RTP streams to be extracted for detailed analysis or replay. Additional analysis is available for HTTP, listing tables clients by server or vice-versa along with specifc URLs accessed and error codes. With this analysis, users can identify the problems quickly, without drilling into packet decodes.

Automatic bounce chart

CSA automatically creates bounce charts for each TCP flow identified. This graphically reveals the dynamics of packet flow between clients and servers without having to manually decode packets. Timing, direc-tion of flow, and payload summary, are displayed while TCP or other errors are color coded for quick identification. It provides an extremely powerful way to understand protocol interactions between various network elements.

Unique multi-segment analysis

CSA supports most of the commonly used capture file formats. It can receive packets captured from up to four locations on the network and merge them to provide a multi-segment bounce chart. This allows timing issues to be isolated quickly by segment for root cause analysis. Combined with the powerful decode feature of CSA, this provides network engineers and application analysts the tools to end finger pointing.

Triple play ready

Speech quality parameters including packet loss, jitter, R value, and MOS are displayed graphically. Streaming video implemented by MPEG2 over UDP is supported. Support includes a complete set of functions, including decode, filter, problem definition with alerts, and a full set of reports – real-time, history, trace file, and voice quality. Content playback is supported in both real-time and post analysis. 

Content reconstruction and playback

You can recreate audio and video content from VoIP or video flows, either during real-time monitoring or from a trace file. In addition, Microsoft® Exchange® email, Fax over IP, instant messages and HTTP-based web pages can also be reconstructed. This is very valuable as proof of compliance violation or visualization of multimedia quality.

Powerful Filtering Scheme

CSA not only supports simple address and protocol filters, but also sup-ports filters based on application commands, IP subnets, data patterns, and other criteria. Complex conditions (see Figure 6) can be specified with ease by freely adding and combining filter conditions using AND, OR, and NOT operators while viewing the settings panel. Once speci-fied, a filter definition can be saved with an assigned name and then reused at a later time for capture or trace file display.

Comprehensive Traffic Report

CSA provides a large inventory of standard reports in chart and table formats showing statistics and performance for network traffic, servers, and applications. CSA generates reports from real-time data or trace files. See QoS reports for voice and video traffic, showing statistics such as jitter, latency, packet loss, MOS, J-MOS, R-value, and video quality factor. Elements of these reports can be easily combined to produce custom reports.

CSA-1045 Adds Advanced Optional Features

History Reporter

Produce network, application, and other trend reports based on real-time statistical data accumulated over longer periods of time.

Packet Generator

A versatile generator allows you to perform network load testing and traffic reproduction testing. Two modes are supported: 1)Packet mode; a specified packet is sent repeatedly, 2)Buffer mode; traffic from a trace file is reproduced on the network.

Multicast Analysis

The Multicast Visualizer Option provides counters and statistics describing and quantifying the traffic on each detected multicast address. CSA extracts multicast group addresses (IGMP for IPv4 and MLD for IPv6) from packets sent by hosts to routers.

ClearSight Analyzer application-centric analysis workflow

The ClearSight Analyzer automatically analyzes application flows, and can classify traffic by application such as HTTP, email, and VoIP to make it easy to see the flow of each transaction. You can also drill down from the flow view for a session to the packet level and reconstruct the application content.

Step 1: Start Monitor.

Network traffic monitoring starts automatically. Traffic is classified by application. Applications with problems and issues can easily be identified with Yellow or Red icons.

Step 2: Select Application.

Selecting an application displays a list of respective flows and their associated servers and hosts. A red or yellow icon appears for flows for which a fault or other event has been detected, so it is easy to see which flows have a problem.

Step 3: Select Flow.

Clicking a flow selects and displays the flow of communication between the client and server (ladder view). Packets for which a fault or other event has occurred are indicated by a red or yellow arrow, so you can quickly identify exactly where and when a communication problem has occurred.

Step 4: Automatic Filter/Packet Decoding Display.

Clicking a packet in the application flow display (ladder view) opens the packet translation screen which is filtered to show only the associated transaction.

As such, it only takes a few clicks to go from the top application level to the detailed packet display, making troubleshooting quicker and easier.

Step 5: Replay Application Content.

The application content over a selected flow can be reproduced in ClearSight to show the actual content.