Message Board

PCAP file from Wireshark capture

SanfordTurbo — Wed, 18 Nov 2009 18:59:03 GMT

When I load a PCAP file into Observer 13, the TCP Events section is blank. However, the UDP events is full of stuff.

If I right click on the decode packet and selection connection dynamics, the TCP conversation comes up just fine. So, i have to scroll thru 10,000 tcp packets and find the TCP SYN packets and fast post filter with a right click.

Shouldn't the TCP events show up in the Expert Analysis, or does this feature only work with BFR files captured by Observer?

Forum: Observer

Error Trak Drivers for Windows 7

rhardy3054 — Wed, 18 Nov 2009 16:08:55 GMT

I am rebuilding our Observer workstation and have loaded intel PRO NIC cards for use with nTaps. Do I need Error Trak drivers to get all the packets and if so, how do I obtain them. Thanks.

Forum: Hardware Forum

Windows 7 support?

pyang — Tue, 03 Nov 2009 00:32:51 GMT

Hi guys,

We are looking into purchasing Link Analyst very soon here and had a few basic questions that may have already been asked.

I did a quick search and found nothing related to Windows 7 compatibility. Our company will most likely convert to Windows 7 slowly next year and our IT dept will most likely convert over to Windows 7 before the end of the year just to test out the new os. Will we have to run Link Analyst in Xp mode or will it be Windows 7 ready?

Forum: Link Analyst

NITrendingSrv32

pete515 — Fri, 30 Oct 2009 11:12:25 GMT

This may be a good product for producing very detailed statistics but it appears to be a real resource (CPU) hog. I produce hourly web reports for around 50 probe instances on Observer Suite. Nothing too complicated, just utlisation and application break down. Observer 12 (which uses NIWSD for the trending) is able to produce these web reports hourly and without problem, Observer 13 - no chance as NITrendingSrv32 uses 100% CPU and can't cope. Despite everything I don't believe that the server is under resourced in terms of CPU power, etc. I am therefore sticking with Observer 12 in order to produce the statistics which I have been asked for.

Is there any possibility of producing a "NITrendingSrv32 lite" or even supporting the NIWSD trending service for those of us who want a coarse multi probe trending capability without having to invest in a server which can run a small country?

Forum: Observer

Windows 7

Bobby — Wed, 21 Oct 2009 13:40:37 GMT

Someone may have already ask this but will Observer 13 run on the new Windows 7?

Thanks Bobby

Forum: Observer

Amr or Wb-Amr voice mobile codecs

sdere — Sat, 17 Oct 2009 20:57:58 GMT

I have a question about the Observer Tools:

The Amr or Wb-Amr voice mobile codecs 're supported by the Observer tools?

The playback work with these codecs and the Rtp jitter is also measured (because frequency sampling is different 8 or 16 KHz)?

Or the tools supported classic codec g711, g729, g723

Thank you
Sdere

Forum: Observer

Number of devices which SNMP can Monitor.

banerjeeprosenjit — Mon, 05 Oct 2009 08:33:44 GMT

Dear Support team,

I have a below query.

What is the maximum number of devices Observer13 can monitor through SNMP monitoring.

Warm regards

Forum: Observer

netbios network question

kabbott — Thur, 01 Oct 2009 18:07:20 GMT

I have a capture showing lots of udp netbios name query retransmissions.

When I look at the decode, I see station 1 making the request, station 2 responding with a negative response, in half an ms, then station 1 asking again 3 seconds later.

I believe this is normal behaviour if the WINS server doesnt know the queried name, is it not?

Thanks for your help!!

Forum: Observer

HAR3

kabbott — Tue, 29 Sep 2009 21:08:21 GMT

OK, Thank you for your help thus far gentlemen. (especially Bill)

I redid the packet capture - spanning VLAN1 Ingress only at our backbone switch, and set a filter to only capture our internal scopes (xx.xx.32.x/255.255.252.0 both ways xx.xx.32.x/255.255.252.0) OR
(xx.xx.32.x/255.255.252.0 both ways xx.xx.36.x/255.255.255.0)

so I could just see our network. - still seeing a ton of events.

One of the big things I am seeing is udp network delay on SNMP protocol - most often printers or virtualized devices are involved.

Is there anything specific about SNMP that could cause this?

Another strange thing is that I highlighted one of the 'red status' pairs and did a fast post-filter on pair/port but when I looked at the results of the fast post filter, expert analysis indicated no critical errors - the analysis of the pair in the original capture didn't show anything except "client delay information is not available" would that give a red status?

Thanks for your help!!!

Forum: Observer

HAR2

kabbott — Fri, 25 Sep 2009 19:46:45 GMT

Here is another example - how is this even possible - a conversation with 514 packets but 513 retransmissions - wouldnt we have users complaining?

Expert Analysis:

Client: 192.168.1.3 Server: 192.168.1.139/5000

Client analysis: Client delay information is not available.

Server analysis: Server delay information is not available. Error conditions on the network: Excessive retransmissions.

Event 4: 192.168.1.3/5100 <==> 192.168.1.140/5000, Nortel UNIStim

Packets: 514 <==> 514
Bytes: 34952 <==> 34952
Response: - - - <==> - - -
Network Delay: - - - <==> 0
Retransmission: 513 <==>

The data was captured via a span both of vlan 100 on a cisco 3750

Forum: Observer

Help assessing results

kabbott — Fri, 25 Sep 2009 19:23:29 GMT

HELP,

We just had someone conduct a basic network health assessment (prep for a project). They were using Observer V13 just like we are. They spanned our main vlan in collected tons of events in just an hour. I rarely watch the entire vlan because my station has trouble handling it. But now I need to deal with all of the events that he found.

The first issue I would like to find out about are a number of broadcast and multicast storms. I had seen these periodically but they have always been low utilization and short-lived. Our network of, say 350 nodes, is basically flat so based on the short -low utilization nature of the reported storms, I thought the numbers I was seeing was more due to just the flat network architecture and not true issues. Here are a couple of examples I see from our voice-vlan:

duration 1 sec #pkts 124 pct 61.1
duration 2 sec #pkts 124 pct 52.8

These 2 errors occurred from a 1 hr capture of our voice vlan. Do you think they indicate serious problems or the result of a flat network?

Thanks for any input

Forum: Observer

per conversation BW utilisation

peterjamesdonnelly — Sat, 19 Sep 2009 10:35:17 GMT

management are asking me for average bandwidth per citrix session. To this end i was wondering if i could see and live and/or historic view of the bandwidth consumed per conversation so that i may filter on citrix traffic only a give a really good answer.

Thanks a lot

Peter

Forum: Observer

MOS score

rjblanch — Wed, 09 Sep 2009 21:21:20 GMT

Hello all,

How is the best way of using Observer to find out MOS score for Voice between 2 points?
We know that it can get an SLA value from a Cisco router via SNMP, but we find that this is not really accurate.

Also, as a side note, what added value does a NTAP provides over a span port? Is there any???

Forum: Observer

Observer 13 Suite Install question

AlexS — Fri, 28 Aug 2009 11:42:02 GMT

Hi, Does anyone know if it's possible to do a "silent" install of Observer 13 Suite ? ie An install that can accept user variables automatically without asking for details such as install location ..etc ?
I'm using Observer in an educational environment and can manually apply licenses up to the license limit, but it's time-consuming installing Observer to dozens of extra machines for use in restricted/demo mode.

Thanks
Alex

Forum: Observer

Internet OBS report (IP application distribution)

xmolteni — Thur, 20 Aug 2009 08:45:09 GMT

Hi,

I don't understand why the report IE "IP application Distribution" does'nt show the protocol "Other" in OBS V13?! You could see it in the trending viewer but not in the IE "IP application Distribution"?! I try to find the option in the "Protocol definition and server app dicovery"... but nothing!

Thanks for your help.
Xavier

Forum: Observer