Like most analyzers, AppDancer/FA provides real-time statistics on network performance. I monitored routers and switches via SNMP and got interface speed, errors, discards and utilization statistics, as expected. AppDancer/FA can also use Cisco IOS commands via telnet to retrieve device status. After adding a couple Cisco devices, I got buffer, memory and CPU usage stats. AppDancer/FA displayed results in average as well as real time, showing peaks for both statistics.
The capture and decode functionality is standard. The buffer, which ranges in size from 256 KB to 48 MB, can accept a whole packet or portions of a packet. Filtering accepts protocols such as FTP, HTTP, H.323 and SIP. A flow filter can be configured choosing source and destination pairs, with secondary filters for TCP, IP, SMTP and the like.
At the core of most protocol analyzers is the decode ability; accuracy and detail are paramount in decoding. With this in mind, the gold standard in protocol analyzers is Network Associates' Sniffer. I measured the accuracy and number of AppDancer/FA's decodes against those of the Sniffer and found them relatively comparable, though AppDancer's are less detailed.
The analysis or standard protocol decode provided by AppDancer/FA is post capture, not real time. The view shows the classic three-pane display: summary, decode and hex. Statistical displays are preset and easy to access. They are available in graphic and table form by node and protocol. One display that I particularly liked is the response time distribution graphic, which showed ranges of response time in 10 different buckets, from 0-25 ms to more than 2,000 ms. (For what it's worth, some of the developers and founders of AppDancer worked on Sniffer Pro, and in fact worked on the product that Network Associates bought to create Sniffer Pro, Cinco Networks' NetXray.)
Vendor Information
AppDancer/FA Network Flow Analyzer, $4,995.
AppDancer Networks, (770) 643-6800; fax (770) 643-8888. www.appdancer.com
|
AppDancer covers more than 200 Layer 3-plus protocols, in addition to Ethernet, IP, IPX, SPX, HTTP, FTP, NNTP, IMAP, SMTP, POP, PPP, RIP, Quake, SMB, RADIUS and X Window. AppDancer also supports a distinguished list of enterprise-application protocols, including Microsoft SQL and Exchange and Sybase SQL. And plans to include support for Oracle and MGCP are in place, according to AppDancer.
I encouraged the company to add IPsec to help troubleshoot negotiations between client and servers and to provide a tool for wireless security diagnostics.