print

Tip of the Month

September 2004

Hyper Drill Down

I love the fluid nature and flexibility of the WildPackets analyzers. The interface is so intuitive to learn and the shortcuts get me to the core of the problem very quickly. Granted, a little experience solving real problems on small to huge networks helps from time-to-time. I'll be sharing some of my favorite speed-dee tips for analyzing the tough ones.

Select a problem of interest in the APNX, EPNX, or OmniPeek Expert, right-click, and select related by event. You are immediately placed in the packet buffer on the problem of interest. You can then right-click and select related by conversation (flow), and by hiding all of the other packets (if post capture), the Expert, Peer Map, node statistics and so forth, are now /focused soley on the problem at hand.

Real world example: I'm at a client with SQL issues. After analyzing traffic to and from one of the main SQL servers, the Expert starts issuing the "non-responsive server" event (which, by the way, works with virtually /any/ client/server protocol you may have). Using the above "two-click" drill down, I'm viewing the packet list highlighting a SQL TDS (tabular data stream) packet requesting a login. Further, I isolate the conversation and immediately see that the login is requested every 30 seconds until the server finally responds.

Bonus: Type "ctrl+u" (_u_nhide) to instantly bring every packet and full analysis back from /any/ window within that trace (from packets to statistics to Expert to Peer Map). No files to write, no traces to bring back in, no multiple trace windows, no problem!