In this webinar, Group Product Manager Rob Hock and Network Management Head Geek Leon Adato will show how SolarWinds deep packet inspection and analysis and the new Quality of Experience dashboard within Network Performance Monitor (NPM) version 11 can help you solve both common and complex application and network performance issues.

1. Product Management Technical Drilldown on
Deep Packet Inspection and Analysis
Is it the application or the network?
August, 2014
© 2014 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.

2. © 2014 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
A Few Notes About Today’s Session
» Today’s content will cover using packet
analysis for quality of experience
monitoring
» Ask questions!!!
 No attendee left behind
 Ask questions using the chat box and we
will do our best to cover them all
» Today’s session is being recorded
 Solarwinds.com
 Slideshare.com
2
Rob Hock
SolarWinds Group Product
Manager
Leon Adato
SolarWinds Head Geek
Network Management

3. © 2014 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
Agenda
» What is Deep Packet Analysis and what it can do for you?
» How is it Done? Calculating application & Network Response Time
» End-to-end visibility from the network to the Application
» Deployment Best Practices
» Licensing Overview
» Q&A
3

4. © 2014 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
Deep Packet Analysis
» Also known as Deep packet Inspection
(DPI)
» Capturing (by making a copy of) and
analyzing the contents of network
packets that flow between clients &
servers
» Packets are typically captured using a
‘TAP’ or switch port ‘mirroring’ or
‘spanning’
4

5. © 2014 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
Manual Packet Analysis
» Packet analyzers (or sniffers) are
typically moved around and used as
needed to troubleshoot specific
problems – no continual inspection
» Requires a highly skilled user to
configure, perform captures, and
analyze the packet flows
» A number of vendors offer high
throughput DPI appliances, but these
can become very pricey
5

6. © 2014 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
What you can do with Packet Analysis
6
» Network response time can be measured
» Application response time can be obtained
» Application traffic categorization
» Is it the Application or the Network?

7. © 2014 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
Measuring Network Response Time (NRT)
7
» TCP 3-Way Handshake
» Client sends server a ‘SYN’ Packet
» Server responds with a ‘SYN ACK’
packet
» Clients returns an ‘ACK’ packet

8. © 2014 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
Measuring Application Response Time (ART)
» TIME TO FIRST BYTE
» Client sends a ‘GET’ request to
server
» Server ‘ACKs’ the request
» Some Amount of time goes by
while server processes the
request and responds
» Server sends first data packet
8

9. © 2014 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
Deep Packet Inspection & Quality of Experience
» New in NPM version 11
» Easy-to-deploy software deep packet inspection and analysis sensors
» Quality of Experience dashboard for a quick summary of network and application
performance metrics
 Visual presentation of over 1200 application (Skype®, SQL, facebook®, etc…) response times,
classification (messaging, database, social, etc…), categorization (business vs. non-business), and risk
profile
 Visual presentation of network response time
 Graphical display of traffic volume and transaction count
9

10. © 2014 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
Demo
10

11. Network Sensor Deployment
11
» Captures and analyzes network
traffic at a single aggregation point
 Core data switch or remote site access
switch
» Sensor is deployed to a physical or
virtual dedicated server connected
to a physical or virtual switch SPAN
port
© 2014 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.

12. © 2014 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
Server Sensor Deployment
» Deploy to critical servers monitored by
your main poller
» Each sensor can analyze up to 1 Gbps
» Requires server admin rights

13. © 2014 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
Packet Analysis Deployment
HTTP FTP SMTP DNS
App App App AppNPM
NPAS
SPAN Port
NPAS
SPAN Port
DMZ
SPAS deployment on
app server aggregates
app traffic
NPAS
SPAN
Port Internal Network
Remote Site
NPAS deployment at
remote site aggregates all
traffic from remote site
NPAS deployment on
SPAN port aggregates
filtered app traffic
Internet

14. © 2014 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
Remote Site Considerations
I want my QoE to be
aggregated…
I’m a network engineer I’m a server/application admin
Recommended
Sensor Deployment
Required Managed
Node Config
Recommended
Sensor Deployment
Required Managed
Node Config
Per application
(aggregated)
NPAS connected to a
SPAN port on a
switch located close
to the app server
(data center)
The server
supporting the app
should be a managed
node configured
under the NPAS
SPAS deployed on
the application
server
Application server
needs to be an NPM
managed node
configured under the
SPAS
Per Remote Site NPAS connected to a
mirrored switch port
at remote site(s)
Add sampling of
endpoints as
managed nodes and
add to NPAS
Deploy SPAS to
sampling of remote
endpoints
Endpoints must be
NPM managed nodes
Per individual
workstation
NPAS connected to a
mirrored switch port
at remote site(s)
Add all endpoints as
managed nodes and
add to NPAS
Deploy SPAS to
remote endpoints
Endpoints must be
managed nodes

15. © 2014 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
Packet Analysis Sensor Licensing
» Included with your NPM license
 One (1) Network Packet Analysis Sensor (NPAS)
 Ten (10) Server Packet Analysis Sensors (SPAS)
» During Evaluation
 Unlimited sensors can be evaluated during the 30 day sensor evaluation period
» Additional sensors are available for purchase through the web console or by
contacting sales

16. © 2014 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
Summary
» Deep packet inspection and analysis has a number of benefits
 Network response time can be measured
 Application response time can be obtained
 Application traffic can be identified and categorized by ip addresses, ports, protocols, or urls
» SolarWinds NPM provides affordable, easy-to-deploy DPI along with a visual
presentation of key application and network performance metrics
» You can finally answer the question: “Is it the Application or the Network?”
16

17. © 2014 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
Thanks for your attention!
Download a FREE fully functional 30-day trial of SolarWinds
Network Performance Monitor
www.solarwinds.com
Join our community of 150,000+ IT pros at www.thwack.com
Thank you for attending!
17

18. © 2014 SOLARWINDS WORLDWIDE, LLC. ALL RIGHTS RESERVED.
The SOLARWINDS and SOLARWINDS & Design marks are the exclusive property of SolarWinds
Worldwide, LLC, are registered with the U.S. Patent and Trademark Office, and may be registered or
pending registration in other countries. All other SolarWinds trademarks, service marks, and logos
may be common law marks, registered or pending registration in the United States or in other
countries. All other trademarks mentioned herein are used for identification purposes only and
may be or are trademarks or registered trademarks of their respective companies.