Sniffer Adaptive Application Analyzer: Adaptive Mode ... - NetScout

About Sniffer Adaptive Intelligence
EARLY FIELD TRIAL Chapter 1
16 Sniffer Adaptive Application Analyzer
Sniffer Adaptive Application Analyzer introduces new Adaptive Session
Intelligence technology that streamlines packet-level analysis for
critical protocols while augmenting it with session-awareness. The
Adaptive capture mode stores both Adaptive Session Packets (ASPs) for
bit-level analysis and correlated Adaptive Session Records (ASRs) for
session analysis:
Adaptive Session Intelligence extracts and preserves key fields
from supported packet types, storing condensed Adaptive
Session Packets (ASPs) rather than raw packets for supported
protocols.
ASPs include compressed packet headers through the transport
layer and an intelligently “derived” payload rather than the actual
payload. ASPs are much smaller than their raw counterparts and
can be stored and analyzed much more efficiently. They are also
correlated with parent Adaptive Session Records for session
analysis.
The exact fields preserved in an ASP vary by protocol but include
compressed MAC/IP headers and key data fields (for example, SQL
calls embedded in the data portion of an HTTP packet).
Adaptive Session Records (ASRs) store metadata for flow
analysis, providing end-to-end transaction metrics, including:
Source/Destination Identifiers
Session start/end times
Latency metrics, success/failure codes, and error messages.
Application-specific metrics for HTTP, DNS, Media (RTP), Mail
(SMTP/POP), FTP, and so on.
You work with ASRs and ASPs in separate Session and Decode views
(Figure 1-3). The Adaptive Session and Decode views are very similar to
the classic Sniffer decode window, allowing you to perform network
analysis in Summary and Detail panes. Correlation between a session
and its underlying ASPs let you drill back and forth between the two
views. You get both the top down view of a complete session and the
constituent packet level details.