Viavi Apex Enterprise G3-APEX-ENT-32T, User Manual

Page: 222 / 380

Mining data from your GigaStor
222 GigaStor (23 Feb 2018) — Archive/Non-authoritative version
This option: Allow you to do this:
Forensic analysis Allows you to choose a profile where you have defined which
Snort rules you want to use. The results are displayed on the
Forensic Analysis tab in the GigaStor Control Panel. If you
chose "Expert analysis and decode" and decided you also
wanted to do forensic analysis, you could do that by clicking
the Forensic Analysis tab, which prompts you for a profile. Use
this option if you need to scan high-volume packet captures
for intrusion signatures and other traffic patterns that can be
specified using the familiar Snort rule syntax. You can enforce
your "acceptable use" policies, fight industrial espionage, and
assist with government regulations like Sarbanes Oxley or
HIPPA requirements. Using network forensics you can provide
pre-intrusion tracking and identification while delivering a
paper trail after any intrusion. Or you can perform network
troubleshooting using root-cause analysis and identify network
problems that have been around awhile. See Examining your
network traffic with forensic analysis (page 233) .
Microburst analysis Analyzes the selected time frame for any microbursts (as
defined in the Microburst Analysis Settings dialog) and displays
the results in the Microburst Analysis tab of the GigaStor
Control Panel. This is an easier way to find microbursts across a
much longer time frame than using the Detail Chart where the
longest time frame that can be analyzed is 15 minutes. Use this
option if you need to monitor applications that are sensitive
to microbursts, such as financial, audio, video, or multicast
applications. See Searching for microbursts (page 242) .
Trading Multicast
analysis
Analyzes the selected time frame for trading multicast streams
issues on your network specifically related to stock exchanges.
The streams can be analyzed for tracking UDP sequence
numbers, multiple protocol data units (PDUs) within a UDP
packet, and stream type or ID. Use this option if you want to
analyze any of the Trading Multicast streams Observer supports.
IPTV analysis Analyzes the selected time frame for IPTV traffic on your
network. IPTV is configured by providing the multicast stream IP
(or range of IPs) and, optionally, the UDP ports used to transport
the content, along with the receive capabilities of the devices
consuming the IPTV feeds. These settings allow Observer to
identify IPTV traffic of interest (the IP and UDP ports) and to
accurately calculate metrics about the quality of the feed for
the endpoints, such as MDI , by providing the Delay Factor and
Media Loss Rate information.
Multiple GigaStor
analysis
Combines and analyzes data streams from two or more active
probe instances. The active probe instances are typically from
multiple GigaStor probes, but can also be from the same
GigaStor probe. Use this option if your GigaStor probes captured
the same data from two or more perspectives and you want to
compare them using MultiHop Analysis. The MultiHop Analysis
can be based on IP, IP Pair, IP port, or a filter. Or use it when two
or more perspectives are capturing different parts of the same
communication (one send and the other receive; or 50% of the
connections to an application on one and 50% on the other) and
you want to combine the data to get a complete picture of the
communication. This might be due to the way traffic was routed
(and eventually captured) or part of an architectural decision
to load balance the traffic across multiple physical capture
appliances.