ANYOP_GSG.book Page i Wednesday, April 12, 2006 8:28 AM
OmniAnalysis™ Platform
GGeettttiinngg SSttaarrtteedd GGuuiiddee
Getting Started Guide
ANYOP_GSG.book Page ii Wednesday, April 12, 2006 8:28 AM
Copyright © 2006, WildPackets, Inc. All rights reserved. Information in this document is subject to change without
notice. No part of this document may be reproduced or transmitted in any form, or by any means, electronic or
mechanical, including photocopying, for any purpose, without the express written permission of WildPackets, Inc.
AiroPeek SE, AiroPeek NX, AiroPeek VX, EtherPeek SE, EtherPeek NX, EtherPeek VX, Gigabit Analyzer Card (GAC),
GigaPeek NX, iNetTools, NAX, NetDoppler, NetSense, Network Calculator, Omni³, Omni Capture Engine, Omni
Desktop Engine, Omni DNX Engine, OmniEngine Desktop, OmniEngine Enterprise, OmniEngine Workgroup,
Omni Management Console, Omni PacketGrabber, OmniPeek, OmniPeek Enterprise, OmniPeek Enterprise Connect,
OmniPeek Personal, OmniPeek Workgroup, OmniPeek Workgroup Pro, OmniPeek Personal, Omnipliance,
OmniSpectrum, PacketGrabber, Peek DNX, ProConvert, ProtoSpecs, RFGrabber, RMONGrabber, WAN Analyzer
Card (WAC), WANPeek NX, WildPackets, WildPackets Academy, and WildPackets OmniAnalysis Platform are
trademarks of WildPackets, Inc. All other trademarks are the property of their respective holders.
The material in this document is for information purposes only and is subject to change without notice. While
reasonable efforts have been made in the preparation of this document to assure its accuracy, WildPackets, Inc.
assumes no liability resulting from errors or omissions in this document, nor from the use of the information
contained herein.
WildPackets, Inc. reserves the right to make changes in the product design without reservation and without
notification to its users.
Contacting WildPackets
Mailing Address
WildPackets, Inc.
1340 Treat Blvd., Suite 500
Walnut Creek, CA 94597
Voice/Fax
8 AM - 5 PM (PST)
(925) 937-3200
(800) 466-2447 (US only)
Fax: (925) 937-3211
info@wildpackets.com
Sales
sales@wildpackets.com
Web
http://www.wildpackets.com
Technical Support
http://www.wildpackets.com/support
Resources
See http://www.wildpackets.com/support/additional_resources/white_papers for white papers, tutorials, technical
briefs and more.
ii
ANYOP_GSG.book Page iii Wednesday, April 12, 2006 8:28 AM
1
Training and Certification
WildPackets Academy offers the most effective and comprehensive network and protocol analysis training available,
meeting the professional requirements of corporate, educational, government, and private network managers. Our
instructional methodology is centered on practical applications of protocol analysis techniques.
See http://www.wildpackets.com/services for course catalog, current public course scheduling, web-delivered courses,
and consulting services.
WildPackets Academy
(800) 466-2447
training@wildpackets.com
Product Support and Maintenance
WildPackets Product Maintenance Programs ensure that you grow along with our products as new features and
enhancements to existing features are added. All WildPackets customers are entitled to technical support for the life of
their purchased product(s).
Enhanced support services are available through our Premium Maintenance Programs. Premium Maintenance offers
Remote Trace File Analysis assistance and free seats in our WildPackets Academy Training courses, in addition to our
standard maintenance services.
Standard or Premium Maintenance can be purchased by contacting sales@wildpackets.com.
About WildPackets, Inc.
Since 1990, WildPackets has been delivering real-time fault analysis solutions that enable the world's leading
organizations to keep their networks running securely and reliably, day after day. From the desktop to the datacenter,
from wireless LANs to Gigabyte backbones, on local segments and across distributed networks, WildPackets products
enable IT organizations to quickly find and fix problems affecting mission-critical network services. WildPackets
products are sold in over 60 countries through a broad network of channel and strategic partners. More than 5,000
customers, spanning all industrial sectors and including 80% of the Fortune 1000, use WildPackets products daily to
troubleshoot networks and maximize network uptime. WildPackets customers include Agilent, Cisco Systems,
Comcast, EDS, Microsoft, Siemens AG, Qualcomm, Unisys, Motorola, and Deutsche Bank. Strategic partners include
Aruba, Atheros, Cisco, 3Com, Intel and Symbol Technologies. For further information, please visit
www.wildpackets.com.
20060410-E-OP40_d4
iii
ANYOP_GSG.book Page iv Wednesday, April 12, 2006 8:28 AM
ANYOP_GSG.book Page v Wednesday, April 12, 2006 8:28 AM
i
Contents
Chapter 1
Chapter 2
Chapter 3
Chapter 4
Chapter 5
Chapter 6
Chapter 7
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
System requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
Installing the OmniPeek console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Installing an OmniEngine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Main program window and Start Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
Displaying the Remote Engines window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Connecting to a remote engine. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Capturing Packets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Capturing packets into a Capture window. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Capturing packets on a remote engine . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Viewing Decoded Packets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
The packet decode window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Forensics Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Creating forensic captures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Using the remote engine files tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Monitoring the Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Displaying Monitor statistics on the console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Baselining with summary statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Using the remote monitoring capture template . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Creating Graphs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Creating a graph from a console Capture window . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Creating a top ten protocols graph on a remote engine. . . . . . . . . . . . . . . . . . . . . . . 35
Wireless Statistics in Capture Windows . . . . . . . . . . . . . . . . . . 37
The WLAN view . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
The Channels view . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
The Signal view . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
v
ANYOP_GSG.book Page vi Wednesday, April 12, 2006 8:28 AM
Contents
Chapter 8
Chapter 9
Chapter 10
Chapter 11
Troubleshooting with the Expert . . . . . . . . . . . . . . . . . . . . . . . . 41
The Expert view. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Using the Expert EventFinder Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
Using the Visual Expert . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Creating Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Enabling a filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Creating filters with the Make Filter command. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
Creating a simple filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Using the Peer Map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
The Peer Map view . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
Using VoIP Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
The VoIP view . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Analyzing a single call or channel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Appendix A
Keyboard Shortcuts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
vi
ANYOP_GSG.book Page 1 Wednesday, April 12, 2006 8:28 AM
Introduction
C H A P T E R 1
Welcome to OmniPeek, the software console for distributed network analysis from
WildPackets!
The OmniPeek console provides centralized expert analysis for 10/100 Ethernet, full-duplex
Gigabit Ethernet, 802.11 WLAN, and WAN networks by managing and interacting with
remotely installed OmniEngines. With OmniPeek’s intuitive user interface, network engineers
can quickly troubleshoot problems on remote segments, drill down through multiple layers of
analysis, and pinpoint problems that need correction.
Important! The OmniPeek console and the OmniEngines are described here in their full-featured
versions. Please visit our web site at http://www.wildpackets.com for details about how to
order the Omni features and media types that precisely fit the needs of your distributed
network.
System requirements
The system requirements for the OmniPeek console are:
● Windows XP Professional (SP2), Windows 2000 (SP4) or Windows Server 2003 (SP1)
Internet Explorer 6.0 (SP1)
Microsoft .NET Framework 2.0
Note OmniPeek with Enhanced Voice Option does not support Windows Server 2003.
OmniPeek supports most rack mount, desktop and portable computers as long as the basic
system requirements to run the supported operating systems are met. Depending on traffic
and the particular usage of OmniPeek, the requirements may be substantially higher.
The following system is recommended for OmniPeek:
1
●
●
ANYOP_GSG.book Page 2 Wednesday, April 12, 2006 8:28 AM
Chapter 1: Introduction
P4 2 GHz Processor (P4 2.4 GHz Processor for OmniPeek with Enhanced Voice Analysis)
512 MB RAM (1 GB RAM for OmniPeek with Enhanced Voice Analysis)
10 GB Available Hard Disk Space (20 GB Available Hard Disk Space for OmniPeek with
Enhanced Voice Analysis)
Factors that contribute towards superior performance include high speed CPU, dual CPUs,
two or more GB of RAM, high performance disk storage subsystem (RAID 0), and as much
additional hard disk space as is required to save the trace files that you plan to manage.
Note Supported operating systems require users to have “Administrator” level privileges in order to
load and unload device drivers, or to select a network adapter for the program’s use in
capturing packets.
For more information, please see our web site at http://www.wildpackets.com/products.
Optional hardware requirements
To analyze wireless, Gigabit, WAN, or traffic, a supported network analyzer card (GAC or
WAC) or wireless LAN adapter is required for OmniPeek:
Full-duplex capture of Gigabit Ethernet networks: requires a WildPackets Gigabit
Analyzer Card (GAC).
Note Capture on Gigabit Ethernet networks is also possible using other supported Gigabit Ethernet
interfaces, but not in full-duplex mode.
Capture from T1/E1 WAN links: requires a WildPackets WAN Analyzer Card (WAC).
Capture from T3/E3 WAN links: requires a WildPackets WAN Analyzer Card (WAC).
For more information, refer to the documentation that ships with the product or visit our
website at http://www.wildpackets.com/products.
For information on configuring wireless, Gigabit, and WAN analyzer cards, please refer to the
OmniPeek User Guide or online help.
Network connectivity and drivers
OmniPeek and the OmniEngines communicate over TCP/IP through port 6367, the default
port for the WildPackets DNX proprietary protocol.
2 System requirements
●
●
●
●
●
●