Sniffer Adaptive Application Analyzer: Adaptive Mode ... - NetScout

Table 1-3. Key Terms (2 of 3)
Terms Definition
Network Interface
(Stream)
Capture Buffer
(Store)
EARLY FIELD TRIAL Chapter 1
24 Sniffer Adaptive Application Analyzer
A network interface is the local source of network traffic for Sniffer
Adaptive Application Analyzer monitoring and capture. Sniffer Adaptive
Application Analyzer supports a single network interface for monitoring/
capture – the Ethernet interface on the local PC. This interface is listed
under the local laptop’s entry in the Navigation Panel at the left of the
user interface, like this:
local laptop/desktop
network interface
InfiniStream Console users may be accustomed to referring to the
network interface as a “stream.” The basic idea is the same – it’s the
console’s representation of a packet/data gathering interface. However,
there are several key differences:
• The Sniffer Adaptive Application Analyzer network interface is on the
local PC; streams are on remote InfiniStream appliance.
• Sniffer Adaptive Application Analyzer begins monitoring statistics on
the network interface when it is opened in the Navigation Panel.
Packets themselves are only gathered when capture is started
manually. In contrast, packets/statistics are continuously gathered
for active streams on InfiniStream appliances.
• Sniffer Adaptive Application Analyzer only has a single network
interface – the Ethernet interface on the local laptop (identified in
the list using the loopback IP address of 127.0.0.1). In contrast, the
InfiniStream Console works with multiple remote appliances, each
with multiple network streams.
Sniffer Adaptive Application Analyzer stores captured packet and
metadata in an in-memory capture buffer on the local PC. Recorded data
stored in the capture buffer can be saved to trace files for permanent
storage.
InfiniStream Console users may be accustomed to referring to the
capture buffer as “the store.” The basic idea is the same – a place to
keep capture packets/metadata. However, there are several key
differences between the Sniffer Adaptive Application Analyzer capture
buffer and the store on an InfiniStream appliance:
• Capture buffer is on the local PC; the store is on a remote
InfiniStream appliance.
• Capture buffer is designed for short-term recording and is filled on
demand when capture starts; the store is a persistent stream-todisk
operation designed for long-term forensic storage and analysis.
• Capture buffer is relatively small (up to 1GB) and can be saved to
trace files; the store is massive, typically spanning multiple disks/
arrays.
• Capture buffer is dynamic and is removed when the application
shuts down; the store is persistent.