Sniffer Adaptive Application Analyzer: Adaptive Mode ... - NetScout

EARLY FIELD TRIAL
Opening ASP Files
Adaptive Session Analysis
The Adaptive Decode View is populated using Adaptive Session Packets.
These packets are saved in .asp files. Each .asp file has a companion
Adaptive Session Record (.asr) file where the session-level metadata is
stored.
When you mine data captured in Adaptive mode, Sniffer Adaptive
Application Analyzer automatically creates temporary .asr/.asp files for
the mining request and stores them in the Sniffer Adaptive Application
Analyzer program directory under \bin\Local-x. You can use standard
File > Open commands to open .asr/.asp files.
IMPORTANT: The exact name of the folder varies according to the
number of NICs/agents in the PC – Sniffer Adaptive Application Analyzer
uses separate \Local-x folders for each local agent.
IMPORTANT: The .asr/.asp files are paired – make sure you don’t
delete one half of the pair and expect to perform full analysis on the
other. For example, if you delete an .asr file, you will not be able to drill
up to session metadata from the companion ASP file.
Opening ASP Files Directly vs. Drilling Down
Keep in mind that the Adaptive Decode View will show different results
when drilling down from the Session View vs. opening an ASP file
directly:
When you drill down from the Session View, Sniffer Adaptive
Application Analyzer displays just those ASPs belonging to the
selected session. This generally results in an ASP view with only a
few events shown, all of which are ASPs.
In contrast, when you open an ASP file directly using File > Open,
you see all captured ASPs in the mined time selection. This includes
ASPs with an ASI Protocol Interpreter and those without.
So, for example, where a drill down to ASPs may show only a few FTP
ASPs, opening an ASP file directly will typically produce a wide variety of
packet data, including raw packets and packets without an ASP protocol
interpreter. Note the following in Figure 7-9:
The total number of ASPs shown in the title bar of the Session View
is far greater when opening an ASP file directly.
The directly-opened ASP file includes packets without an IP layer
(ARP and BPDUCONFIG) captured as raw packets.
User’s Guide 155