Sniffer® Portable Professional User's Guide - NetScout
Sniffer® Portable Professional User's Guide - NetScout Sniffer® Portable Professional User's Guide - NetScout
Chapter 7 Setting Expert Options 134 Sniffer Portable Professional For effective network analysis, and depending on your network’s protocol environment, you should configure Expert options before you start capturing data. The Expert options are described in the following sections. See also: Expert Layers and Objects on page 134 Expert Threshold Settings on page 137 Expert Protocol Settings on page 137 Expert Subnet Mask Settings on page 138 Expert RIP Settings on page 138 Expert 802.11 Options on page 140 Expert Mobile Options on page 149 Expert Oracle Options on page 150 Expert IP Options on page 151 Expert Layers and Objects During capture, the Expert constructs a database of network objects from the traffic it sees and categorizes network problems according to the Expert layer at which they occur. NOTE: The Expert’s network layering structure is similar to the OSI model. However, the two schemes do not always map on a one-to-one basis. To configure network object and Expert layer options, select Expert Options from the Tools menu. The Expert Properties dialog box opens displaying the Objects tab. The Expert has configuration options that enable you to: Exclude certain layers from Expert processing. In addition to using capture filters, which let you select the particular traffic you need for network analysis, you can exclude certain Expert layers from processing. Double-click a layer in the Analyze column of the Objects tab and select No to exclude the layer from Expert processing
Real-Time Expert Display Disabling analysis on the lower layer will disable analysis on all upper layers.This enables you to focus on specific network problems precisely. Specify the maximum number of objects that can be created in the database for each Expert layer. To reduce the amount of memory needed to create network objects, you can specify the maximum number of objects that the Expert can create for each Expert layer. Double-click in the Max Objects column of the Objects tab to specify the maximum number of objects that can be created in the database for each Expert layer. NOTE: To help with configuration, the Expert shows the estimated amount of memory needed for the number of objects selected for each layer in the Est. Memory column of the Objects tab. Specify whether to recycle Expert objects (the default) or stop creating new objects when there is no more room in the database. The Expert builds a database of network objects from the information in the packets accumulated in the capture buffer. Because some networks can be immensely complex in their structure, at some point the Expert will have no more memory for new network objects. If you recycle objects, the Expert continues to add new objects to the database, overwriting the least interesting objects when it runs out of memory (objects with no associated errors are considered “least interesting”). If you do not recycle objects, the Expert stops creating new objects when it runs out of memory, and instead, continues to interpret traffic in accordance with the information it has already stored in its database. Enable/disable real-time Expert analysis during capture. By default, when you start a capture, the Expert analyzes the packets coming into the buffer and displays the results in real time in the Expert window. You can observe the network objects, symptoms, and diagnoses that the Expert analyzer creates while the capture progresses. You can disable real-time Expert analysis if you prefer. Specify the maximum number of alarms that can be created in the Expert database. When the maximum number is reached, the Expert will either recycle the oldest and lowest priority alarms (if the Recycle Alarms option is selected) or stop creating new alarms. This Recycle Alarms option specifies what the Expert does when it runs out of memory: User’s Guide 135
- Page 84 and 85: Chapter 5 84 Sniffer Portable Profe
- Page 86 and 87: Chapter 5 86 Sniffer Portable Profe
- Page 88 and 89: Chapter 5 Viewing Access Points Onl
- Page 90 and 91: Chapter 5 90 Sniffer Portable Profe
- Page 92 and 93: Chapter 5 Selecting Wireless Host T
- Page 94 and 95: Chapter 5 94 Sniffer Portable Profe
- Page 96 and 97: Chapter 5 Setting Capture Filters f
- Page 98 and 99: Chapter 5 98 Sniffer Portable Profe
- Page 100 and 101: Chapter 5 ART - The Server-Client R
- Page 102 and 103: Chapter 5 Show Options 102 Sniffer
- Page 104 and 105: Chapter 5 ART Options - Servers Onl
- Page 106 and 107: Chapter 5 106 Sniffer Portable Prof
- Page 108 and 109: Chapter 5 Adding Custom Protocols t
- Page 110 and 111: Chapter 5 History Samples Click to
- Page 112 and 113: Chapter 5 112 Sniffer Portable Prof
- Page 114 and 115: Chapter 5 Protocol Distribution 114
- Page 116 and 117: Chapter 5 Global Statistics 116 Sni
- Page 118 and 119: Chapter 5 118 Sniffer Portable Prof
- Page 120 and 121: Chapter 5 Monitor Alarms 120 Sniffe
- Page 122 and 123: Chapter 6 Capture Controls 122 Snif
- Page 124 and 125: Chapter 6 Capture Buffer 124 Sniffe
- Page 126 and 127: Chapter 6 Tips: 126 Sniffer Portabl
- Page 128 and 129: Chapter 6 Capturing from Specific S
- Page 130 and 131: Chapter 6 130 Sniffer Portable Prof
- Page 132 and 133: Chapter 7 132 Sniffer Portable Prof
- Page 136 and 137: Chapter 7 136 Sniffer Portable Prof
- Page 138 and 139: Chapter 7 Expert Subnet Mask Settin
- Page 140 and 141: Chapter 7 140 Sniffer Portable Prof
- Page 142 and 143: Chapter 7 142 Sniffer Portable Prof
- Page 144 and 145: Chapter 7 Discovered access points
- Page 146 and 147: Chapter 7 146 Sniffer Portable Prof
- Page 148 and 149: Chapter 7 148 Sniffer Portable Prof
- Page 150 and 151: Chapter 7 Expert Oracle Options 150
- Page 152 and 153: Chapter 7 Limitations of the Expert
- Page 154 and 155: Chapter 7 Click to show the packet
- Page 156 and 157: Chapter 7 156 Sniffer Portable Prof
- Page 158 and 159: Chapter 8 Displaying Captured Packe
- Page 160 and 161: Chapter 8 Postcapture Views for Wir
- Page 162 and 163: Chapter 8 162 Sniffer Portable Prof
- Page 164 and 165: Chapter 8 164 Sniffer Portable Prof
- Page 166 and 167: Chapter 8 Table 8-3. Decode Tab Too
- Page 168 and 169: Chapter 8 168 Sniffer Portable Prof
- Page 170 and 171: Chapter 8 b 170 Sniffer Portable Pr
- Page 172 and 173: Chapter 8 a 172 Sniffer Portable Pr
- Page 174 and 175: Chapter 8 174 Sniffer Portable Prof
- Page 176 and 177: Chapter 8 176 Sniffer Portable Prof
- Page 178 and 179: Chapter 8 178 Sniffer Portable Prof
- Page 180 and 181: Chapter 8 Display Setup > Summary D
- Page 182 and 183: Chapter 8 182 Sniffer Portable Prof
Real-Time Expert Display<br />
Disabling analysis on the lower layer will disable analysis on all<br />
upper layers.This enables you to focus on specific network<br />
problems precisely.<br />
Specify the maximum number of objects that can be created<br />
in the database for each Expert layer. To reduce the amount of<br />
memory needed to create network objects, you can specify the<br />
maximum number of objects that the Expert can create for each<br />
Expert layer. Double-click in the Max Objects column of the<br />
Objects tab to specify the maximum number of objects that can be<br />
created in the database for each Expert layer.<br />
NOTE: To help with configuration, the Expert shows the<br />
estimated amount of memory needed for the number of<br />
objects selected for each layer in the Est. Memory column of<br />
the Objects tab.<br />
Specify whether to recycle Expert objects (the default) or<br />
stop creating new objects when there is no more room in the<br />
database. The Expert builds a database of network objects from<br />
the information in the packets accumulated in the capture buffer.<br />
Because some networks can be immensely complex in their<br />
structure, at some point the Expert will have no more memory for<br />
new network objects. If you recycle objects, the Expert continues<br />
to add new objects to the database, overwriting the least<br />
interesting objects when it runs out of memory (objects with no<br />
associated errors are considered “least interesting”). If you do not<br />
recycle objects, the Expert stops creating new objects when it runs<br />
out of memory, and instead, continues to interpret traffic in<br />
accordance with the information it has already stored in its<br />
database.<br />
Enable/disable real-time Expert analysis during capture. By<br />
default, when you start a capture, the Expert analyzes the packets<br />
coming into the buffer and displays the results in real time in the<br />
Expert window. You can observe the network objects, symptoms,<br />
and diagnoses that the Expert analyzer creates while the capture<br />
progresses. You can disable real-time Expert analysis if you prefer.<br />
Specify the maximum number of alarms that can be created<br />
in the Expert database. When the maximum number is reached,<br />
the Expert will either recycle the oldest and lowest priority alarms<br />
(if the Recycle Alarms option is selected) or stop creating new<br />
alarms.<br />
This Recycle Alarms option specifies what the Expert does when<br />
it runs out of memory:<br />
User’s <strong>Guide</strong> 135