Technical DataAnalysis software delivering answers for application performance issues
The award-winning ClearSight™ Analyzer
(CSA) offers advanced application-centric
monitoring and performance analysis,
enabling enterprise Network Administra-
tors and Engineers to maintain, diagnose,
and resolve application and network
performance issues in multi-protocol
network environments. CSA supports most
of the commonly used protocols, and us-
ers can import Wireshark decodes to take
advantage of decodes contributed from
the open-source community – making CSA
the most versatile application analysis
tool in the market.
ClearSight™ AnalyzerApplication-centric analysis software delivering answers for application performance problems
Key Features• Application-centricanalysisthatautomaticallyanalyzesapplicationflowswithintuitive
drilldowntoidentifytherootcauseofperformanceissues
• Real-timeapplicationperformancemonitoringwithalarmsforproblemidentification
• Time-basedanalysisfortracefilesupto4Gigabytestoquicklyidentifyrelevantpacketsfortheapplication-centricview
• Realtimestatistics,bouncechartsandreportsforflowsonsingleormultiplesegments–toseeissuesquickly
• Videoandvoicecallstatus,QoSanalysisandplayback
• Usercustomizablesummaryreport
• SupportsWireSharkdecodeengine
2
Figure 1: QoS analysis of a SIP VoIP call
Figure 2: HTTP Statistics
Figure 3: Trending volume of connections
Innovative application-centric analysisThroughasimpleandintuitivefrontpage,CSApresentsacomprehen-
sive,high-levelapplicationhealthoverviewofyournetwork.Fromthat
framework,youcandrilldowntogainaccesstomoredetailedinforma-
tion.Forexample,CSAwillrecognizeandanalyzeallflowsofanHTTP
application,displaythenumberofservers,clientsandthroughput.
Withasimpleclick,youcanthenseeeachflowwithabouncechart
andexpertidentificationofthepacketsthatcausedtheproblem.This
unparalleledlevelofcontrolandvisibilityspeedstimetoapplication
problemresolutionandminimizesoverallnetworkdowntime.
Real-time monitoring with problem/ issue detectionTheCSAExpertAlertfunctionautomaticallydetectscommunication
faultsfromcapturedormonitoredpacketsanddisplaysthemwith
colorcodedicons.Thespecificapplication,server,orflowthathasa
problemcanbeseenataglancefromtheApplicationSummary
FrontPage.
AlertsdetectedbyCSA,eitherinreal-timeorfromatracefile,are
classifiedasissues(faultsinthecommunicationsequence)orproblems
(faultsthatexceedathresholdvalue)andarelogged.Listscanbe
sortedbysimplyclickingonacolumnheader.Youcandrilldownto
theassociatedflowcausingtheproblembyright-clickingonanalert
duringpost-captureanalysis.Problemsandissuescantriggeremail,
pager,script,orSNMPtrapactions.
Time-based analysis to identify problems quicklyAnalyzinglargecapturefilescanbedifficultbecausethereisjusttoo
muchinformationtosortthrough.CSAprovidesatime-basedanalysis
ofcapturefilesprovidingdetailedstatisticsandtrendinginformation.
Youcandrilldownintimetolookatadjacenteventsduringthetime
ofinterest.ForvideoandvoicetrafficrunningSIPorH.323,theanaly-
sisenginecanclassifythevideoandvoiceRTPstreamsbasedontheir
qualityscore,MOSorVQFactor.Itwillprovidedetailedstatisticsof
theSIPorH.323callstatusandqualityofcalls.Youcanselectoneor
moreoftheRTPstreamstobeextractedfordetailedanalysisorreplay.
AdditionalanalysisisavailableforHTTP,listingtablesclientsbyserver
orvice-versaalongwithspecifcURLsaccessedanderrorcodes.With
thisanalysis,userscanidentifytheproblemsquickly,withoutdrilling
intopacketdecodes.
3
Automatic bounce chartCSAautomaticallycreatesbouncechartsforeachTCPflowidentified.
Thisgraphicallyrevealsthedynamicsofpacketflowbetweenclients
andserverswithouthavingtomanuallydecodepackets.Timing,direc-
tionofflow,andpayloadsummary,aredisplayedwhileTCPorother
errorsarecolorcodedforquickidentification.Itprovidesanextremely
powerfulwaytounderstandprotocolinteractionsbetweenvarious
networkelements.
Unique multi-segment analysisCSAsupportsmostofthecommonlyusedcapturefileformats.Itcan
receivepacketscapturedfromuptofourlocationsonthenetwork
andmergethemtoprovideamulti-segmentbouncechart.Thisallows
timingissuestobeisolatedquicklybysegmentforrootcauseanalysis.
CombinedwiththepowerfuldecodefeatureofCSA,thisprovides
networkengineersandapplicationanalyststhetoolstoendfinger
pointing.
Triple play readySpeechqualityparametersincludingpacketloss,jitter,Rvalue,and
MOSaredisplayedgraphically.StreamingvideoimplementedbyMPEG2
overUDPissupported.Supportincludesacompletesetoffunctions,
includingdecode,filter,problemdefinitionwithalerts,andafullset
ofreports–real-time,history,tracefile,andvoicequality.Content
playbackissupportedinbothreal-timeandpostanalysis.
Content reconstruction and playbackYoucanrecreateaudioandvideocontentfromVoIPorvideoflows,
eitherduringreal-timemonitoringorfromatracefile.Inaddition,
Microsoft®Exchange®email,FaxoverIP,instantmessagesandHTTP-
basedwebpagescanalsobereconstructed.Thisisveryvaluableas
proofofcomplianceviolationorvisualizationofmultimediaquality.
Figure 4-2: NAT Multi-Segment
Figure 4-3: SIP Multi-Segment
Figure 5-1: Video playback
Figure4-1:VoIPMulti-SegmentAnalysis
Figure 5-2: Email Playback Figure 5-3: Web Playback
4
Figure 7: H.323 Report
Figure 8: HTTP Report
Figure 9: IP Response Time Report
Powerful Filtering SchemeCSAnotonlysupportssimpleaddressandprotocolfilters,butalsosup-
portsfiltersbasedonapplicationcommands,IPsubnets,datapatterns,
andothercriteria.Complexconditions(seeFigure6)canbespecified
witheasebyfreelyaddingandcombiningfilterconditionsusingAND,
OR,andNOToperatorswhileviewingthesettingspanel.Oncespeci-
fied,afilterdefinitioncanbesavedwithanassignednameandthen
reusedatalatertimeforcaptureortracefiledisplay.
Comprehensive Traffic ReportCSAprovidesalargeinventoryofstandardreportsinchartandtable
formatsshowingstatisticsandperformancefornetworktraffic,servers,
andapplications.CSAgeneratesreportsfromreal-timedataortrace
files.SeeQoSreportsforvoiceandvideotraffic,showingstatistics
suchasjitter,latency,packetloss,MOS,J-MOS,R-value,andvideo
qualityfactor.Elementsofthesereportscanbeeasilycombinedto
producecustomreports.
CSA-1045 Adds Advanced Optional Features
History Reporter
Producenetwork,application,andothertrendreportsbasedon
real-timestatisticaldataaccumulatedoverlongerperiodsoftime.
Packet Generator
Aversatilegeneratorallowsyoutoperformnetworkloadtestingand
trafficreproductiontesting.Twomodesaresupported:1)Packetmode;
aspecifiedpacketissentrepeatedly,2)Buffermode;trafficfroma
tracefileisreproducedonthenetwork.
Multicast Analysis
TheMulticastVisualizerOptionprovidescountersandstatistics
describingandquantifyingthetrafficoneachdetectedmulticast
address.CSAextractsmulticastgroupaddresses(IGMPforIPv4and
MLDforIPv6)frompacketssentbyhoststorouters.
Figure 6: Filter
5
Step 1
Step 2
Step 3
Step 4
Step 5
ClearSight Analyzer application-centric analysis workflowTheClearSightAnalyzerautomaticallyanalyzesapplicationflows,and
canclassifytrafficbyapplicationsuchasHTTP,email,andVoIPto
makeiteasytoseetheflowofeachtransaction.Youcanalsodrill
downfromtheflowviewforasessiontothepacketleveland
reconstructtheapplicationcontent.
Step 1: Start Monitor.
Networktrafficmonitoringstartsautomatically.Trafficisclassified
byapplication.Applicationswithproblemsandissuescaneasilybe
identifiedwithYelloworRedicons.
Step 2:Select Application.
Selectinganapplicationdisplaysalistofrespectiveflowsandtheir
associatedserversandhosts.Aredoryellowiconappearsforflowsfor
whichafaultorothereventhasbeendetected,soitiseasyto
seewhichflowshaveaproblem.
Step 3:Select Flow.
Clickingaflowselectsanddisplaystheflowofcommunicationbetween
theclientandserver(ladderview).Packetsforwhichafaultorother
eventhasoccurredareindicatedbyaredoryellowarrow,soyoucan
quicklyidentifyexactlywhereandwhenacommunicationproblem
hasoccurred.
Step 4:Automatic Filter/Packet Decoding Display.
Clickingapacketintheapplicationflowdisplay(ladderview)opens
thepackettranslationscreenwhichisfilteredtoshowonlythe
associatedtransaction.
Assuch,itonlytakesafewclickstogofromthetopapplicationlevel
tothedetailedpacketdisplay,makingtroubleshootingquickerand
easier.
Step 5:Replay Application Content.
Theapplicationcontentoveraselectedflowcanbereproducedin
ClearSighttoshowtheactualcontent.
6
Features Summary
Feature Description
Application-centric Summary PageImmediatelyseetheproblemlayersandquicklydetermineoverallapplicationhealthfromreal-timetrafficmonitoredortracefile
Real-time monitoring of applications Seeapplicationandconfigurationflowviewswithorwithoutcapturingpackets
Expert Alert FunctionSetproblemthresholdsandseeimmediatelywhenanapplication,server,orflowhasaproblem.Programemail,pager,script,orSNMPactionstobeperformedwhenaproblemoccurs
Time-based analysis of trace files
Fortracefilesupto4GByteinsize,conductanalysisbasedonuserdefinedtimerangeforpacketswithinthetracefile.AnalysisincludesapplicationperformanceforHTTP,H.323,SIPandRTP,TrendingNetworkLayercharacteristicssuchasoccurrenceofTCPSYN,Retransmission,IPmatrixandHost,totrafficvolumetrendbyframecount/byte/framesizecount.Userscanexportpacketsthatfitthedisplaycriteriatoconductapplication-centricanalysis.
Protocol ForcingApplyprotocolforcingduringreal-timemonitoringorwhenreplayingatracefiletoidentifyprotocolencapsulatedinanotherprotocol
Timing displays for application conversation Networkdelaysandpoorresponsetimespoprightoutoftheapplicationflowviewandidentifyslowcommands,poorservice,orapplicationperformanceissues
Multi-Segment ViewCorrelateIPpacketflow,UDPand/orTCPbetweentwohostsorserverandclientacrossmultiplephysicalsegments.
Comprehensive Filtering FunctionsLimitmonitoring,capture,ordisplaytothosethingsthatinterestyoubycreatingfiltersbasedonapplicationcommands,IPsubnets,datapatterns,andmanyothercriteria.BuildupcomplexfiltersusingAND,OR,andNOToperations.Name,save,andreusefilters
Quick capture or display filter generation Right-clickonaflowtoapplycapture/displayfilterforthatflowonly
Full packet decodes (with support for Jumbo Frame)
SwitchtoaDecodetabtoseetraditionalfullpacketdecodesinSummary,Detail,andHexscreens,duringreal-timemonitoringorfromatracefile
VOIP Call Log browserApplysimplefilteringandsortingtobrowseforindividualcallsusingcriteriasuchasstarttime,callduration,callerandcalleeidentifiers,andMOSscoreduringreal-timemonitoring
Voice and Video QoS AnalysisWhenanRTPflowisrecognizedasincludingavideoflow,ClearSight™AnalyzerdisplaysVQFactor™statisticsforthevideocomponentaswellasMOSstatisticsfortheaudiocomponent
Protocol SpecificationsProtocol Description
Supported Non-VoIP ApplicationsDNS,HTTP,FTP,TELNET,Citrix,POP3,SMTP,Exchange,ISAKMP,KERBEROS,MSSQL,Oracle,SMB,AIM,BOOTP,Gopher,MediaPlayer,Napster,NETBIOS,NFS,NNTP,QuickTime,RIP,RIPNG,SNMP,TFTP,XWindows,YahooMessenger,MSN,Skype
Supported VoIP ApplicationsH.323(H.225,H.245,RAS),SIP(RFC3261,T.38FaxoverIP),MGCP,MEGACOorH.248,SCCP(Skinny),SIGTRAN(IUA:RFC3057ISDNUA,SUA,M2PA,M2TP,M2UA:RFC3331,SS7MTP2UA,M3UA:RFC3332,SS7MTP3UA,MAP,SCTP,ISUP),RTP,RTCP,RTSP
Play (decode) Audio CodecsG.711(µ-lawanda-law),G.721,G.722,G.723,mono,G.726,G.729,GSMmono,4-bitmonoDVI8KHz,11.025KHz,22.05KHz,MPEGlayer(I,II-TS,III,IV),iLBC,AMR(GSM,3GPP),ASF
Mobile Protocol Supportfor3G-324MandLTEtheumbrellaprotocolforvideotelephonyin3G/4Gmobilenetworks
EOAM Decode EthernetOAMframesinbothITUandIEEEformat
Note: Partial list shown above. For full list, please visit www.flukenetworks.com/protocolsupport
7
Fluke NetworksP.O.Box777,Everett,WAUSA98206-0777
Fluke Networksoperatesinmorethan50countriesworldwide.Tofindyourlocalofficecontactdetails,gotowww.flukenetworks.com/contact.
©2012FlukeCorporation.Allrightsreserved.PrintedinU.S.A.6/20123780533C
System RequirementsItem Minimum Requirement
Computer Industrystandardcomputersystem(laptopordesktop),withaCD/DVD-ROMdriveforsoftwareinstallation
Processor Pentium4(orequivalent)runningat1GHzminimum(2GHzrecommended)
RAM512MBminimum(1GBrecommended)2GBminimumifrunningWindows7ProfessionalEdition
Hard Disk Space 40GBharddrivewithatleast15GBofavailablespace.
Operating SystemMicrosoftWindowsXPHomeEditionwithSP3(Disablethefirewall)MicrosoftWindowsXPProfessionalwithSP3(Disablethefirewall)Windows7ProfessionalEdition(32and64bit)
MonitorVGAcolormonitorwith1024x768resolution.SupportforDirectX9graphicswith:WDDMDriver,minimum128MBofgraphicsmemory,PixelShader2.0inhardwareand32bitsperpixelrequiredforWindows7ProfessionalEdition.
Network Adapter NetworkconnectionwithNDIS-compliantnetworkdevicedriver
Product and OptionsModel Description
CSN/CSA-1000 ClearSightAnalyzerSoftware
CSN/CSA-1000CD ClearSightAnalyzerSoftwareonCD
CSN/CSA-1045 CSAwithIPMulticastVisualizer,HistoryReporterandPacketGenerationoption
CSN/CSA-1045CD CSAwithIPMulticastVisualizer,HistoryReporterandPacketGenerationoptiononCD
CSN/OPT-3045 IPMulticastVisualization,HistReporter,andPacketGenforCSA
SupportModel Number Description
GLD-SW-1000 GoldSupportServices,1YearSoftwareMaintenanceforCSA-1000
GLD-SW-1045 GoldSupportServices,1YearSoftwareMaintenanceforCSA-1045