Network Instruments Observer User Manual

Quick Start Manual

®

Volume 16, June 2002

Network Instruments’ Observer

®

ii Quick Start Manual

© 2002 by Network Instruments, LLC (Limited Liability Corporation). All rights reserved.

Network Instruments' Observer for use with Microsoft Windows 98, Windows NT 4.x, Windows 2000,
or Windows XP. “Observer”, “Network Instruments” and the “N with a dot logo” are registered
trademarks of Network Instruments, LLC, and may be registered in certain jurisdictions.

Written and designed by: Network Instruments, LLC, 8800 West Highway Seven, Minneapolis
MN 55426, USA.

Limited Warranty—Software

Network Instruments, LLC will replace defective media or documentation for a 60-day period
after the shipment of the product from Network Instruments, LLC. Should Network Instruments,
LLC release a newer version of the software within 60 days of shipment of the product, Network
Instruments, LLC will update the copy of the software upon request, provided request is made
by the licensed user within the 60-day period of shipment of the new version. This update may
consist of a CD, or a manual, or both at the discretion of Network Instruments, LLC. User may be
charged a shipping fee for updates.

Network Instruments, LLC shall not be liable for material, equipment, data, or time loss caused
directly or indirectly by proper or improper use of the software. In cases of loss, destruction, or
corruption of data, Network Instruments, LLC shall not be liable. Network Instruments, LLC
does not take any other responsibility. Network Instruments, LLC does not warrant that the
product will meet your requirements or that the operation of the product will be uninterrupted
or that the product will be error-free.

NETWORK INSTRUMENTS, LLC SPECIFICALLY DISCLAIMS ALL OTHER
WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO,
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. IN NO EVENT SHALL NETWORK INSTRUMENTS, LLC BE LIABLE FOR ANY
LOSS OF PROFIT OR ANY OTHER COMMERCIAL DAMAGE, INCLUDING BUT NOT
LIMITED TO SPECIAL, INCIDENTAL, CONSEQUENTIAL, OR OTHER DAMAGES.

Network Instruments, LLC makes no other warranty, expressed or implied.

Copyright and License

Network Instruments' Observer, Expert Observer, and Observer Suite are neither shareware nor
freeware. Network Instruments' Observer, Expert Observer, and Observer Suite are commercial
software packages that are subject to international copyright laws.

Upon registration of the Network Instruments’ Observer product, you are licensed to use Network
Instruments’ Observer at
monitored by purchasing additional probe licenses. When additional licenses are purchased, you will
then be licensed to run as many probes as you have licenses. The purchase of a Probe Pack does not
include a license for Observer or Expert Observer. Should you need additional Observer or distributed
Observer consoles, you will need to purchase licenses separately.

If you install Network Instruments’ Observer on additional PCs, you will need to purchase an
additional Observer license for each PC. If you are installing probes on laptops, you will need to
purchase a Probe Pack for each laptop.

Network Instruments’ Observer, Expert Observer, and Observer Suite are the property of Network
Instruments, LLC and may not be copied for purposes other than backup.

Included in the Observer box is a blue activation card containing the Identification Number and
License Number for the product. This activation card is your proof of purchase. You will need to
produce this document for upgrades and you will need to provide the activation numbers to receive
technical support.

This software is licensed as stated above. The license does not constitute ownership of the software,
only the right to use the software.

one

site on

one

LAN on

one

personal computer. Additional segments can be

© 2001 Network Instruments, LLC iii

Purchasing Additional Licenses

To purchase additional licenses of Observer, Expert Observer, or Observer Suite, contact your
software vendor or Network Instruments, LLC at:

Corporate Headquarters:

Network Instruments, LLC

Fourth Floor
8800 West Highway Seven
Minneapolis, MN 55426 USA
[phone] Toll Free
[phone] Voice
[phone] Fax
email: [e-mail]

UK and Europe:

Network Instruments, Ltd.

Brewery House
Black Eagle Close
Westerham TN16 1RG
UNITED KINGDOM
[phone] Voice
[phone] Fax
email: [e-mail]

Technical Support

Network Instruments provides technical support:

By fax (depending on where you are located):

US & countries outside of Europe at [phone]

UK and Europe at [phone]

By phone (depending on where you are located):

US & countries outside of Europe at [phone]

UK and Europe at [phone]

Or by email at:

[e-mail]

Network Instruments provides technical support for a period of 60 days after the purchase of the
product at no charge. After the 60-day initial support period, support will only be provided to
those customers who have purchased a maintenance agreement.

Telephone technical support hours are between 9:00 am and 5:00 pm (CST U.S.) at each office.

Suggestions are welcomed. Many of the improvements made to Observer have originated as
end-user suggestions. Please submit detailed suggestions in writing to:
[e-mail], or by fax at: [phone]. Please submit any corrections to
or criticism of Network Instruments’ publications to: [e-mail] or by fax at
[phone].

For those parties with the capability to receive Internet email, it is recommended to subscribe to
the Network Instruments’ Observer mailing list.

Subscribe by submitting an email message to:

[e-mail]

with the following in the body (not the subject) of the email:

subscribe observer

iv Observer® Quick Start Manual

Contents

Observer Quick Start Manual ..................................................... 1

Installation........................................................................................ 2

Configuring Observer ..................................................................... 3

Licensing Observer .......................................................................... 3

Running Observer for the First Time................................................ 4

Getting Started with Observer Modes and Tools................... 5

Discover Network Names................................................................ 5

Top Talkers ........................................................................................ 7

Router Observer ............................................................................... 8

Internet Observer ............................................................................. 9

Network Trending........................................................................... 10

Packet Capture ............................................................................. 12

Bandwidth Utilization ..................................................................... 16

Switched Observer ........................................................................ 17

Real-Time Expert............................................................................. 19

Conclusion...................................................................................... 21

© 2001 Network Instruments, LLC v

Observer Quick Start Manual

Welcome to Network Instruments’ Observer, a network monitor and protocol
analyzer for Microsoft, Unix, Novell, Apple, VoIP, and wireless networks (to
name a but a few supported environments). Observer helps the experienced
network administrator to diagnose, solve, and prevent network problems.

This manual does not cover the entire range of Observer’s functionality.
Rather, it briefly describes how to install and configure Observer, and leads
you to some of the most commonly used Observer modes and tools. For more
comprehensive descriptions of Observer’s modes and tools, refer to the
Observer User Guide and the help system.

© 2002 Network Instruments, LLC 1

Installation

Installation

Check the system requirements in the Observer User Guide to make sure that
your system meets the hardware and software requirements necessary to run
Observer.

You can install Observer from a CD-ROM or from the Internet. Network
Instruments recommends that you install Observer from the Internet. The
latest version of Observer is available via anonymous ftp on the Network
Instruments’ ftp site at:

ftp://ftp.networkinstruments.com/pub/demos/obsdemo.exe

To begin the download, you may either:

1. Download OBSDEMO.EXE to an empty temporary directory and run it,
or

2. Insert the Observer CD-ROM in the CD-ROM drive.

3. When the setup program autoruns, follow the instructions on the screen.

Once the executable file is run, you will be taken through the following
process:

1. Setup will ask you to choose a language; select your preferred language
and click on the N

EXT button.

2. You will be asked if you are installing Observer, an Advanced Probe, or
an RMON Probe. Select “Observer” and click on the N

3. Setup will ask you in which directory you would like to install Observer.
Unless you have a specific reason to install Observer elsewhere, install
Observer in the default directory.

4. Check the README.WRI for any additional information.

2 Observer® Quick Start Manual

EXT button.

Configuring Observer

Configuring Observer

In Windows 98/2000 and XP, no additional configuration is required. In
Windows NT you must install a protocol service driver. Follow these steps:

For Windows NT:

1. Setup will open the Windows NT Network Setup dialog.

2. Click the “Services” tab.

3. When asked for the type, select “Have disk” and point to the “Observer
Files” directory.

4. Reboot your system.

Licensing Observer

Observer is always delivered in Demo (evaluation) mode and will run in
Demo mode until it has been activated. The Demo mode provides an
excellent way of seeing each Observer mode in action—each mode is fully
populated with a random collection of real packets, collected from Network
Instruments’ own networks. In this way Observer can be run at any time
without the need of a network connection and it provides an excellent way to
learn Observer's operation.

To activate Observer into full functionality, follow these steps:

1. From the Windows desktop, click

Start > Programs > Observer > Observer.

Observer will start in Demo mode and let you choose between a
simulation demo and a limited real-time demo.

2. Choose “Simulation Demo,” select any device, and then click O

Depending on where and how you purchased Observer, your activation
information may have been provided to you on a “Right to Use” (RTU)
certificate. You’ll need the following four strings: Name, Company
Name, Identification Number, and Licensing Number.

K.

3. Click the “Enter Name” textbox. Enter your name and company name
exactly as on the RTU, click O

K, and then click ACCEPT.

4. Enter your license number where indicated, and click OK.

5. Close Observer. When you start Observer again, it will be fully
functional.

If you don’t have your licensing information available, contact your
Network Instruments’ sales representative.

© 2002 Network Instruments, LLC

3

Installation

Running Observer for the First Time

In Windows 98, you can run Observer immediately after installation by
double-clicking on the Observer icon in the Observer group or the Probe icon
from the Probe group. Rebooting is not necessary.

In Windows NT, 2000, and XP, you must reboot your PC before you can run
Observer. After rebooting, you can run Observer by double-clicking on the
Observer icon in the Observer group.

4 Observer® Quick Start Manual

Discover Network Names

Getting Started with Observer Modes and Tools

Observer is a large collection of modes and tools useful for diagnosing all
kinds of network problems and understanding how your network is
behaving. Observer contains approximately two dozen modes and tools that
can be configured and combined in hundreds of different ways to help you
understand and manage the network. The following are a few places to start.
Trying out the modes and tools described here should give you a feel for the
design and style of Observer, and give you a good picture of what is
happening on your network.

Discover Network Names

A complete listing of all the stations on the network segment is the obvious
place to start examining a network. The mode that performs this function is
Discover Network Names.

Figure 1: Discover Network Names

This mode captures all network addresses on the segment, stores them in the
filter table, and assigns them aliases. You can manually assign a name to a
network address, or Observer will automatically use DNS names, NetWare
login names, or Microsoft network login names.

© 2002 Network Instruments, LLC

5

Getting Started with Observer Modes and Tools

After storing the addresses and network names, Observer will
automatically use the stored names in queries.

1. Click Tools > Discover Network Names or the icon on the Observer
toolbar.

2. Click

Mode Commands > Setup or the icon on the Discover

Network Names toolbar.

3. Fill in your IP information or check the “Passively discover IP addresses”
checkbox.

4. Click

Mode Commands > Start Mode or the icon on the Discover

Network Names toolbar.

If you have not checked the “Passively Discover IP Addresses” checkbox,
Observer will ARP all addresses twice within the range you’ve specified, then
passively listen for responses. If you’ve chosen to passively discover IP
addresses, Observer will identify each station the first time the station sends
out a packet on the network and add the station’s address to the list.

The advantage of passive discovery is that you don’t have to know what
your local net range is. The disadvantage is that if a station generates
no traffic during the time when Discover Network Names is running,
Observer won’t identify it.

Either way, once the discovery is complete, you can automatically generate IP
aliases for your addresses by clicking the R
the S

AVE ALIASES button.

ESOLVE IP button and then clicking

6 Observer® Quick Start Manual

Top Talkers

Top Talkers

Top Talkers is one of Observer’s simplest, but most useful modes. It permits
the network administrator to see which stations are generating, receiving, or
generating and receiving the most traffic on the network.

Figure 2: Top Talkers

1. Click Statistics > Top Talkers Statistics or the icon on the Observer
toolbar to open Top Talkers.

2. Click

Mode Commands > Start Mode or the icon on the Top Talkers

toolbar to start Top Talkers.

© 2002 Network Instruments, LLC

7

Getting Started with Observer Modes and Tools

Router Observer

Routers are frequently bottlenecks in the network, so Observer allows you to
monitor a router in real-time to determine its utilization rate. With Router
Observer
the router is acting as a bottleneck and, if so, whether the packets clogging the
router are incoming or outgoing (or both).

1. Click Statistics > Router Observer to open Router Observer.

2. Click Mode Commands > Setup or the icon on the Router Observer

it’s a straightforward matter to quickly determine whether or not

Figure 3: Router Observer

toolbar, select your router from the list, and then enter its speed (the
speed you enter depends on your network configuration). Some sample
router/link speeds are shown below:

33.6K baud modem 33600

56K Frame relay or 56K baud modem 56000

One-channel ISDN connection 64000

T1 connection 1544000

4 Megabit Token Ring 4000000

10 Megabit Ethernet 10000000

16 Megabit Token Ring 16000000

100 Megabit (Fast) Ethernet 100000000

ATM 155 Megabit 155000000

Gigabit 1000000000

3. Click

Mode Commands > Start Mode or the icon on the Router

Observer toolbar to start Router Observer.

8 Observer® Quick Start Manual

Device/Link Speed

Internet Observer

Internet Observer

Many situations require some monitoring of Internet usage—as a matter of
company policy prohibiting or restricting personal use of the Internet, as a
way to determine which Internet protocols are in use, or which Internet sites
users are communicating with. Internet Observer makes this easy.

Figure 4: Internet Observer

1. Click Statistics > Internet Observer or the icon on the Observer toolbar
to open Internet Observer

.

2. Click Mode Commands > Start Mode or the icon on the Internet
Observer toolbar to start Internet Observer.

© 2002 Network Instruments, LLC

9

Getting Started with Observer Modes and Tools

Network Trending

Network Trending is probably the single most important collection and
predictive tool. By collecting and analyzing data on a historical basis,
Network Trending permits the network administrator to create a baseline of
network performance, by collecting, storing, viewing, and analyzing network
traffic statistics over long periods of time. The network administrator can
often identify problems before they occur by examining this data.

Most acute problems are associated with sudden changes; the baseline
Network Trending provides can help to point toward those.

Network Trending can also give advance warning of impending chronic
problems and help to spot opportunities. For example, if the network’s
bandwidth utilization has been steadily rising over a period of months, it
may predict a need to upgrade to a faster network. An upward trend in the
use of the WWW protocol may indicate increased recreational use of the
World Wide Web—or it may signal an increased load on the company Web
server and predict the need to upgrade the present Internet connection to a
faster one.

Most of Observer’s real-time troubleshooting modes have an associated
trending statistic that can be used as a baseline to compare to current
statistics, as a way of helping to isolate problems.

You can run Network Trending continuously, start it automatically every
time you start Windows, or both. The statistics data is stored in a format that
can be easily compressed and passed for viewing to any site that has a
Network Trending viewer installed. This practice permits a network
administrator on one site to easily confer with a colleague on another one—
provided, of course, they both have copies of Observer.

Many network administrators will choose to keep Network Trending
running constantly as a way of generating a continuous historical baseline.
The simplest way to assure this is to put a shortcut to Observer in the
Windows Startup group:

1. Check the “Run Network Trending continuously” checkbox under the
Data Collection tab of Network Trending Properties. (To do this, click on
the icon on the Network Trending toolbar and then click on the Data
Collection tab.)

10 Observer® Quick Start Manual

Network Trending

2. Check the “Turn on active Modes on Observer startup” checkbox under

Options > Observer General Options > General tab. Whenever the

network administrator starts their computer, it will start Observer and
bring up Network Trending, as well as any other active modes.

Generally, a network administrator will choose to set the data collection
period to 15 or 60 minutes; this offers a good granularity of information
and is a useful number for looking at days and weeks of data.

Figure 5: Network Trending

1. Click Trending > Network Trending, or click the icon on the Observer
toolbar to open Network Trending.

2. Click

Mode Commands > Start Mode or the icon on the Network

Trending toolbar to start Network Trending.

© 2002 Network Instruments, LLC

11

Getting Started with Observer Modes and Tools

Packet Capture

Packet Capture is the mode in which Observer records all traffic in the
segment, storing the data in RAM or on disk for examination. As useful as
statistical and cumulative summaries are—such as those provided by
Network Trending, for example—it is sometimes necessary to look closely at
network packets themselves in order to diagnose a problem.

Filtering

While it is certainly possible for Observer to capture and save all the packets
on the local segment, that’s generally undesirable; wading through all the
network traffic looking for the specific problem or issue can be a prohibitively
time-consuming and annoying task. Fortunately, most often the network
administrator will have some idea of the source of the problem—and perhaps
of the protocols involved—and can choose to filter out much of the
extraneous data.

Click

Tools > Probe Filter Setup or click on the icon on the Observer

toolbar to begin configuring a filter.

Filtering is an important tool in the use of Observer, and while it can be
effectively used in many modes, it’s almost invariably useful in Packet
Capture.

12 Observer® Quick Start Manual

Figure 6: Filtering

Packet Capture

Observer filters allow you to capture packets coming from one hardware
address to another, from one IP address to another, from a hardware address
to an IP address, or from an IP address to a hardware address—in one or both
directions: all incoming packets to a particular address from any source, all
outgoing packets from a particular address to any destination, or all the traffic
on the network—subject to the protocol subfilter. In addition, Observer
allows “exclude” directional settings. This would specifically exclude one
address to another, in either direction. The exclude arrows are the opposite of
include arrows. Additionally, you can capture only error packets by selecting
the “Error” filter.

Exclude filters take precedence over include filters. If a packet is
marked for inclusion by one filter and for exclusion by another, it will be
excluded.

1. To create or edit a filter entry, right-click on the desired filter in the
Configured Address Filter column.

2. Click on the C

REATE NEW FILTER ENTRY or EDIT SELECTED FILTER ENTRY

button to display the Add/Edit Address Filter Entry dialog.

3. Select a Network Address Type by selecting the E

OR FDDI option button or the FRAME RELAY option button.

4. Select a filter address type by selecting the H
button or the IP

ADDRESS option button from Address 1 Type and

THERNET, TOKEN RING,

ARDWARE ADDRESS option

Address 2 Type. You can select a hardware filter or IP filter
independently for source or destination.

5. Right-click on the “Address 1” or “Address 2” textboxes to display a
popup list of available addresses. Click on the address you want to
capture or exclude. You may also type in an address you wish to capture
or exclude.

The “Address 1” and “Address 2” list boxes show the addresses (and
aliases) that you may want to monitor. You can create as many entries as
you have on your LAN. However, you can only set a filter to monitor up
to five addresses at a time.

The format of an address entry is either the six numbers of the Ethernet
address separated by colons or dots or the Token Ring address. An alias
is a name that Observer will substitute for an address when showing the
headers of incoming packets (if you tell Observer to use aliases). This can
make packets easier to recognize and analyze (e.g., 00:02:8A:49:B2:48
David Jones).

© 2002 Network Instruments, LLC

13

Getting Started with Observer Modes and Tools

6. Choose a filter direction and include or exclude the address.

7. If you selected the Frame Relay option in step 3 and wish to monitor a
frame relay network, the “Use payload filter” checkbox will be selected
by default. If you do not wish to use the payload filter, uncheck the box.

8. Click on the Use Frame Relay DLCI Filter checkbox to enable the DLCI
textbox. You can type in an address or right-click on the checkbox to see
the list of available addresses.

9. To exclude a particular DLCI, check the “Exclude DLCI” checkbox.

Capturing Packets

After configuring a filter, the next step in Packet Capture is to actually begin
capturing packets for examination.

1. Click

Capture > Packet Capture or click on the icon on the

Observer toolbar to open Packet Capture mode.

2. Click

Mode Commands > Start Mode or click the icon on the Packet

Capture toolbar to begin capturing packets.

3. Click the icon on the Packet Capture toolbar when finished capturing
packets.

Viewing Captured Packets

Without a way of decoding and viewing the captured packets, there would
hardly be any point in capturing them in the first place. Observer’s built-in
viewer is a highly sophisticated and flexible tool, capable of decoding,
processing, and manipulating captured packets in a variety of ways. For most
purposes, though, the network administrator will find that simply paging
through the captured buffer or searching for a specific packet will give a good
picture of what is going on in the specific conversation under examination.

Where the capture buffer is awkwardly large or it’s preferable to take a look
at a subset of the captured data, Observer has built-in post filter capabilities
allowing the network administrator to cut further through clutter to the root
of the problem. Post filter also enables a more experienced network
administrator consulting with a less experienced colleague to have the less
experienced network administrator simply capture and send along all

14 Observer® Quick Start Manual

Packet Capture

possibly relevant data. The senior administrator can then trust superior
experience and post-capture filter to make the data more manageable.

Figure 7: Packet Capture Decode and Analysis

Click on Capture > Decode and Analysis or the icon on the Decode and
Analysis toolbar to open Observer’s viewer.

© 2002 Network Instruments, LLC

15

Getting Started with Observer Modes and Tools

Bandwidth Utilization

Bandwidth Utilization is one of Observer’s most straightforward tools. It
measures the activity on the network and compares it with the theoretical
maximum possible activity on the network. While its functionality is entirely
incorporated in Network Trending, Bandwidth Utilization provides an
uncluttered, at-a-glance interface that simply, immediately, and graphically
shows the amount of activity on the network.

Click on Statistics > Bandwidth Utilization or the on the Observer toolbar to
open and start Bandwidth Utilization

16 Observer® Quick Start Manual

Figure 8: Bandwidth Utilization

.

Switched Observer

Switched Observer

Switches provide both performance advantages and debugging headaches for
network administrators.

The advantages are obvious: since a switch enables the network to handle
traffic effectively, in a way transparent to devices on the network and the
people using them, it provides efficiency and functionality from a centralized
location. Substituting virtual port connections for hard-wired port
connections enables multiple simultaneous connections between stations. It
also permits more efficient use of bandwidth by managing heavily trafficked
connections without the necessity of any intervention (or awareness, for that
matter) on the part of the user on either end.

The disadvantages should also be obvious: since the entire purpose of a
switch is to handle traffic in a way transparent to the rest of the network, it's
difficult to monitor the performance of a switch. This is not a problem when
the network is consistently performing optimally—if it is not broken, or
breaking, there’s no need to fix it—but when a problem does arise, the very
nature and function of a switch makes it difficult to detect, diagnose, and treat
the problem, as a switch is intended to hide what it is doing from the rest of
the network. Because of these complexities, it’s necessary to reconfigure
Observer’s Probe to monitor a switch.

When monitoring a switch, many of Observer’s modes/tools remain
available, but some act differently in order to help the network administrator
monitor the functionality of a switch.

Those modes that become unavailable will be grayed out.

© 2002 Network Instruments, LLC

17

Getting Started with Observer Modes and Tools

For example, consider the appearance and function of Bandwidth Utilization
when monitoring a switch.

Figure 9: Switch Bandwidth Utilization

Compare that to the Bandwidth Utilization window on page 20. Instead of
measuring the gross network bandwidth utilization, Observer is now able to
give the network administrator an ongoing picture of the bandwidth
utilization of the switch on a port-by-port basis and an aggregate “switch
throughput.”

To enable the local probe to monitor a switch:

1. Select

2. Click the S

3. Click O

Options > Selected Probe or SNMP Device Properties.

WITCHED OBSERVER option button.

K in response to the message. This displays the switch dashboard.

Supply the required information, including:

• IP address of the switch

•Switch manufacturer

• Administrative password for the switch (or write community name)

4. Select the type of management you want—looping or static monitoring of
selected ports.

5. Click the icon on the Device Properties toolbar to start monitoring the
switch.

You must be connected to the switch to monitor.

18 Observer® Quick Start Manual

Real-Time Expert

Real-Time Expert

The Real-Time Expert enables you to get both an expert opinion as to what, if
any, problems there are on your network, and to create “what-if” scenarios
about the effects of various changes to your network, based on your actual
network data.

The Real-Time Expert is a “for charge” upgrade to Observer. Visit our
Web site at www.networkinstruments.com
may also call your Network Instruments’ distributor or call your Network
Instruments’ sales representative. In the Americas, Middle East areas,
and Australia, telephone our U.S. office at 1-952-932-9899 or email us
at [e-mail]
office at [phone] or email us at
[e-mail].

. From other areas, contact our U.K.

From the Packet Capture viewer, click on the Expert Analysis tab. The
Summary display contains a list of error conditions found and an Expert
Analysis pane containing a summary of Real-Time Expert’s conclusions about
the problems and possible causes (in the case of a well-functioning network
with few errors, the findings will be brief).

for more information. You

Figure 10: Expert Analysis

To examine a conversation in detail, click on the TCP EVENTS button on the
selection bar and select one of the displayed connections. (If you have any
conversations with a red box in the status column, pick that one.)

Real-Time Expert will analyze the problem and suggest a cause for it. In this
case, the analysis reads:

© 2002 Network Instruments, LLC

19

Getting Started with Observer Modes and Tools

Client analysis: Client responds sufficiently
fast. Error conditions on the network:
Excessive retransmissions.

Server analysis: Slow server.

To examine or analyze the conversation in further detail, right-click on it and
select one of the choices from the pop-up window.

• Connection Dynamics will give you a graphic diagram of the
conversation, showing transmissions and responses. Note how the error
packets are highlighted in red. Right-click on any packet to see more
information about it or to zoom the display in or out.

• Time Interval Analysis gives you a tabular view of transmissions and the
delays between them, while Server Analysis affords the ability to analyze
a server’s performance when handling multiple TCP services and
requests.

•In What-If Analysis, Observer permits you to use captured data as a basis
for hypothetical network situations, to see what would happen if any (or
all) of the characteristics of traffic on the network—number of users,
packet size, traffic levels—or the network devices (server and/or client
processing time, server type) were to change or be changed.

• Any or all of the parameters can be modified to show the effects of
changes in server or client latencies, utilization, and so forth.

20 Observer® Quick Start Manual

Conclusion

Conclusion

This Quick Start Manual has been by no means an exhaustive look at the
modes and capabilities of Observer. On the contrary, the purpose of this has
been to enable the expert user to quickly install and run Observer, using a few
useful modes as examples of what Observer can do and how it does it.

For further information, consult the Network Instruments’ Observer User
Manual, or the Network Instruments’ Web site at:

http://www.networkinstruments.com

© 2002 Network Instruments, LLC

21