performance vision version 2.15 news

© SecurActive 2013

WHAT’S NEW IN VERSION

2.15?

© SecurActive 2013 2

PERFORMANCE VISION VERSION 2.15

Http Application Performance

BCN Workflow

Network Analysis

Configuration & Usability


HTTP APPLICATION PERFORMANCE


HTTP APPLICATION PERFORMANCE

500 - Internal Server Error, Service Temporarily Unavailable

Deal with End User complaints

Track Page / Hit load time

Identify Slow / Faulty transactions

© SecurActive 2013

H TTP

APPLICATION

PERFORMANCE

Response Status Code over Time

Response Times & Volumetry over Time

Flows grouped by Server IP

Flows grouped by Client IP

Flows grouped by Host

Flows grouped by User Agent

Web Pages Performance & Timeline Chart

Hits Performance & Inspection

5


HTTP STATUS

Response Status Code over Time


ARE THERE ERRORS?


WHAT CAUSED THE ERRORS?

Hits Performance & Inspection

One-click Drilldown


WHAT CAUSED THE ERRORS?

Look at what happened:

Who is impacted (Client or Servers)?

What are the related resources?


PERFORMANCE OVER TIME

Response Times & Volumetry over Time


ARE THERE SLOW DOWNS?

Check Performance over time for:

Average Page Load Time

Average Hit Response Time


#HOW MANY RESOURCES ARE PROCESSED?

Evolution over time:

Number of Hits

Number of Pages

Number of Hits in Error (4xx & 5xx)


HTTP TOPS

Server IP

Client IP

Host

User Agent

Group HTTP Flows by:


WHAT ARE THE SLOWEST PAGES?


INTEREST OF STANDARD DEVIATION?

11

9

11

9

11

9

11

9

11

9

0

2

4

6

8

10

12

14

16

18

20

1 2 3 4 5 6 7 8 9 10

18

2

18

2

18

2

18

2

18

2

0

2

4

6

8

10

12

14

16

18

20

1 2 3 4 5 6 7 8 9 10

Page Load Average: 10

Standard Deviation: 1

Page Load Average: 10

Standard Deviation: 8


PAGE LEVEL ANALYSIS

Web Pages Performance & Timeline Chart


WHAT ARE THE SLOWEST PAGES?

Check performance indicators on:

Number of Elements composing a page

Page Load Time

Response Payload


SEE ISSUES AT A GLANCE: T IMELINE CHART

© SecurActive 2013

FULL

Q UERY / R ESPONSE

RETENTION

Inspection details of transaction:

Client Query

Server Response

20

© SecurActive 2013

FULL

Q UERY / R ESPONSE

RETENTION

Inspection details of transaction:

Client Query

Server Response

21


HIT LEVEL ANALYSIS

HTTP Hits Performance Analysis


LIST OF HTTP HITS

Detailed list of HTTP hits:

Data Transfer Time

Server Response Time

Payload

User Agent, Method, Status, Category, Flags, URL


HTTP SPECIFIC F ILTERS

Refine your search with HTTP analysis dedicated Filters

Method GET, HEAD, POST…

Status Success, Redirection, Error…

Host www.google.fr, pypi.rd.securactive.lan

URL Path /application1*, /intranet*/*app*…

User Agent Mozilla*, *Gecko*, *MSIE*…

Server Software Apache*, *nginx*, AmazonS3*…

HTTP Category HTML, Scripts, Style…

Be careful when using regular expressions, it can be Highly resource consuming


HTTP ANALYSIS FOR NPS/APS

NPSAPS

Flow metrics for both NPS & APS

HTTP Performance for APS Only


FORMER WEB BROWSING

Marked as Deprecated

Works like before

Should be Removed in an Upcoming Version


BCN WORKFLOW

Updated for drilldown

New


BCN WORKFLOW

BCN Workflow with Easy Drilldown


BUSINESS CRITICAL NETWORK DRILLDOWN

V2.12 V2.15

Link to Performance from the first zone to the second zone

Link to the Bandwidth chart between the two zones

Link to Oriented Conversations from the first zone to the second zone

Link to BCN Edition

Link to the Bandwidth chart between the two zones


SOURCE/DESTINATION PERFORMANCE

Display Source/Destination performance over time:

Data Transfer Time (DTT), Network Latency (RTT) Retransmission Delay (RD)

Retransmission Rate (RR)

Number of Packets


ORIENTED FLOW DETAIL

Display more Information on Source/Destination flows: OS Fingerprint, MAC Addresses, Port, QoS Field…


SOURCE/DESTINATION ADVANCED FILTERS

V2.12 V2.15

Source/Destination Advanced Filters have been Completed. They now Work like in Client/Server Mode.


NETWORK ANALYSIS


NETWORK ANALYSIS

NewUpdated

© SecurActive 2013

CHECK

Q OS CLASS

35

DiffServ FieldClient/Server

Source/Destination


DISPLAY MAC ADDRESSES

MAC AddressesClient/Server

Source/Destination


OPERATING SYSTEM FINGERPRINTING

OS FingerprintingClient/Server

Source/Destination

For TCP Only!


ETHERNET PROTOCOL / MAC VENDOR

Improved Display of Ethernet Protocol

Improved Display of MAC Address Vendor


CONFIGURATION & USABILITY


BETTER PERFORMANCE

Better performance for: Network Sniffing

Data Dumping


IMPROVED SRT & DTT COMPUTATION

In presence of lost TCP segments,more accurate: Server Response Time (SRT)

Data Transfer Time (DTT)


ZONE RULES CHECKER

Find the first Matching Rule for a Zone.


HTTP PERFORMANCE ANALYSIS CONFIGURATION

For performance reasons it is recommended to RestrictHTTP performance analysis only to appropriate traffic.

Select Zones on which HTTP performance analysis will be performed, by default: None!

Child zones will be automatically selected.


HTTP PERFORMANCE ANALYSIS IMPACT

HTTP performance analysis Impacts:

System workloadCheck CPU, RAM, Disk…

Database workloadCheck License limit (Virtual appliances)

© SecurActive 2013

HTTP P ORT

S IGNATURES

45

By default, HTTP performance analysis is performed on these ports. Add more ports to Extend analysis scope,

This is Global parameter (for all selected zones).

The more ports are added, the more CPU power is required!


AUTOPCAP CONFIGURATION

For Performance Reasons it is Recommended to RestrictAutoPCAP File Generation only to Appropriate Traffic.

Select Zones on which AutoPCAP files will be captured and generated.

Child Zones will be Automatically Selected.


CUSTOM FILTERS (BETA)

Available fields: app,

capture.begin, capture.end,

device,

diffserv, diffserv.clt, diffserv.srv,

domain,

ip, ip.clt, ip.dst, ip.src, ip.srv,

mac, mac.clt, mac.dst, mac.src, mac.srv,

os, os.clt, os.srv,

port.srv,

proto,

vlan,

zone, zone.clt, zone.dst, zone.src, zone.srv

Combine filters with logical operators: (or, and, not) Order sub expressions using Parentheses

Examples: (ip=10.10.*.* or ip.srv=10.20.30.*) and os.clt=‘linux’

zone in ‘/Private/Servers’ or port.srv < 1024

(proto=udp and port.srv=53) or zone in ‘/Private/DNS’

domain=‘~^www.google.(fr|com)$’

app=’http’ or app=’https’


BCN W ITH < 1 MIBPS LINKS

Business Critical Networks now supports links which available bandwidth is < 1 Mibps


DATA MERGING

Configure when to merge Data

© SecurActive 2013

DATA

M ERGING

50

Increasing levels can generate huge performance issues. In case of slowdowns, consider reducing merging levels.

Configure Merging Level

Begin Time End Time Zone IP Payload EURT

08:00 08:01 Internet 76.20.80.201 10 MB 100 ms

08:05 08:06 Internet 76.20.80.201 3 MB 200 ms

08:10 08:11 Internet 183.28.100.2 6 MB 150 ms

08:10 08:11 Internet 76.20.80.201 3 MB 200 ms

08:12 08:14 Lan/Server 192.168.100.8 5 MB 10 ms E x a m p le

© SecurActive 2013

DATA

M ERGING

51


08:00 08:11:00 Internet 76.20.80.201 16 MB 166 ms

08:10 08:11:00 Internet 183.28.100.2 6 MB 150 ms

08:12 08:14 Lan/Server 192.168.100.8 5 MB 10 ms


08:00 08:11:00 Internet - 22 MB 158 ms

08:12 08:14 Lan/Server 192.168.100.8 5 MB 10 ms

Data Aggregation

Data Merging


APPLICATIVE LOGS

Keep track of events


APPLICATIVE LOGS

Keep track of events on the probe.

Up to 7 days for internal processes

Up to 31 days for other events (ex: Errors)


ADVANCED SNIFFER CONFIGURATION

Advanced Sniffer Configuration


ADVANCED SNIFFER CONFIGURATION

Fine-tuning of the Sniffer’s parameters

© SecurActive 2013

SET

THE MTUOF A POLLER

56

Set the MTU of a Poller. It is a per poller setting

Default is 1800

Over 9000 is not recommended

Reboot is required! MTU

© SecurActive 2013

SNIFFER’S

C APTURE

L ENGTH

57

Defines the “Capture Length” used by the sniffer to analyze the traffic

For best accuracy it should be Equal to the highest poller’s MTU.

However high values are highly CPU Consuming

Smaller values will Save CPU processing power.

Sniffer Restart is required!

CAPTURE LENGTH


UPDATE LOG

Upgrade logs have now their own file:

log nova/install.log


DEFAULT SCREEN

New welcome screen during:

Updates

Services turned Off

© SecurActive 2013

Ve r s i o n 2 . 1 5

U s e r G u i d e

Re l e a s e N o t e s

D OCUMENTATION

UPDATE

60

Documentation update:

One-click access in the interface

Available on SecurActive web site

User guide and release notes

http://www.securactive.net/en/resource-library/usersguide


VERSION 2.15 IMPACTS

Impacts on existing metrics:

SRT, DTT, EURT…

Main Impacts compared to 2.12:

Database Migration Time: Small

Metrics Impact on database is small.

Update should take few minutes.


REBOOT AFTER UPDATE

After the update is completed


YOU’RE READY TO GO, ENJOY!

What’s New

in Version 2.1 5 ?

© SecurActive 2013

THANK YOU!

64

For any [email protected]

[email protected]

Follow Us on@SecurActivePV

www.securactive.netblog.securactive.net

mailto:[email protected]



mailto:[email protected]?subject=Contact from What's new in 2.12

mailto:[email protected]?subject=Contact from What's new in 2.12

http://www.securactive.net/



performance vision version 2.15 news

Technology