NAM Probe statistics

NAM Server ► Tools ► Diagnostics ► NAM Probe statistics

Use the NAM Probe statistics reports to review capacity-related statistics for one of the NAM Probes connected to this NAM Server.

To select the NAM Probe on which to focus these reports, open the Capacity tab and select one of the listed NAM Probes in the NAM Probe IP address column.

Capacity

The Capacity tab shows the selected NAM Probe's licensing state.

NAM Probe licensing and capacity are discussed in detail in the licensing guide.

The License overview for yesterday section shows the current licensing state. In this example, everything is within limits. If the NAM Probe had been over capacity, for example, this section would make that clear and show why.

The Daily NAM Probe capacity section charts bandwidth over time.

  • Click the chart to see details for the selected time.
  • Click the Show yearly NAM Probe capacity button to display an additional Yearly NAM Probe capacity chart.

Packet stats

Use the Packet stats report to verify the general state of capture ports on the selected NAM Probe. Information is gathered directly from the NIC driver operating on the NAM Probe.

The calculation of analyzed traffic is performed in several stages, gradually excluding the irrelevant statistics:

  1. The overruns are excluded first. When the received packets are counted, the overruns are omitted.
  2. The calculation of the received packets depends on the subtraction of errors and filtered-out packets.
  3. The dropped packets are counted after the filtered packets are disregarded.
  4. The number of analyzed packets is the count of packets remaining after all of the previous categories are subtracted.

In default NAM Probe installations, non-TCP/UDP packets are not part of this process and are never counted when the number of analyzed packets is given. Non-TCP/UDP traffic increases the amount of analyzed traffic only if you enable the monitoring of the default software services.

Packet stats

Wire-level packet distribution chart

Sample chart:

Wire-level packet distribution chart
Wire-level packet distribution chart

Click the Distro over time link above the chart to also chart these statistics over time.

This chart displays a breakdown of statistics at the wire level:

  • RX packets
    Packets received by the driver.
  • Overruns
    Overruns may indicate a link overload. The overload is typically caused by an exceptionally high traffic volume. This value may also indicate that the network interface or network interface driver cannot manage the amount of traffic received. Other hardware-related issues may also cause overruns. If a high overrun occurs, limit the traffic volume received by the card.
  • Dropped (too large)
    Packets dropped by the driver due to size exceeding the buffer size. Packets are reported when they are too big (such as jumbo frames) or are bigger than the maximum transmission unit (MTU). To avoid such problems, you can increase Maximum packet size in the Entire Configuration perspective.
  • Dropped (sampling)
    Packets dropped due to sampling - controlled drops. Sampling here means dropping packets when the driver performance is degraded. Packets are dropped in a controlled manner, and always with care, to preserve complete and consistent sessions. The packet drops almost always mean that traffic is too heavy for a complete analysis and that, with packet drops, the precision of NAM Server reports is diminished.
    Sampling is only active with the customized 64-bit driver and diagnostics always use this sampling mechanism regardless of the settings used in the general NAM Probe configuration.
  • Filtered out (software service cfg)
    Packets filtered out by the driver due to user defined software services configuration.
  • Non-IP
    Non-IP packets (such as ARP traffic) dropped by the driver. Even large numbers of such packets are generally considered harmless. They are not analyzed by the NAM Probe software and are regarded as noise. Preventing such traffic from reaching the NAM Probe may reduce performance degradation.
  • Dropped (invalid checksum)
    Packets dropped by the driver due to invalid checksum. Typically caused by insufficient signal strength on an optical link. In other cases, checksum errors may indicate Ethernet distortion, such as duplex problems, where the checksum errors may result, for example, when the duplex auto-negotiation process fails. Check the host switch and NAM Probe duplex settings.
  • Dropped (NAM Probe performance)
    Packets dropped due to performance problems - uncontrolled drops. Drops are always a symptom of problems, especially when SSL analysis is deployed. Drops occur when NAM Probe software is unable to analyze all of the packets it receives from the driver. If you use 32-bit or native drivers, you may experience uncontrolled packet dropping. If you use the 64-bit customized driver, packet dropping may occur, but in a software-controlled manner with care for monitored data contingency.
    To avoid packet dropping, decrease the traffic volume that your NAM Probe analyzes or reduce the number of monitored software services.
  • Filtered out (link cfg)
    Packets filtered out by the driver due to link configuration. In default installations, where monitoring of the default software services is turned off, the driver limits the number of processed packets to only those that are relevant to the IP addresses included in user-defined software service definitions.
  • Filtered out (load balancing)
    Packets filtered out due to load balancing configuration. This setting is only applicable in deployments with multiple NAM Probes where each device only analyzes a certain part of the same traffic.

IP packet distribution chart

Sample chart:

IP packet distribution chart
IP packet distribution chart

Click the Distro over time link above the chart to also chart these statistics over time.

This chart displays a breakdown of packet traffic by IP traffic type:

  • IPv4 TCP
  • IPv4 UDP
  • IPv6 TCP
  • Other

Interface utilization

Use the Interface utilization tab to review the interface statistics on the selected NAM Probe.

Interfaces per NAM Probe

For each interface on the selected NAM Probe, this table lists the following.

NAM Probe interface

The name of the interface.

NAM Probe interface mode

Whether the interface is a communication port, a sniffing port, or not used.

NAM Probe interface state

Whether the interface is up or down.

Duplex

Whether the interface is half duplex, full duplex, or unknown.

Negotiation

The status of link speed negotiation.

Speed

The speed of the selected interface.

Received bytes

The number of bytes received on this interface during the selected time range.

Use the Find box to search for any string in the table and display only those rows that match.

Interface utilization

For each interface on the selected NAM Probe, this section displays a chart of received bytes over time. Click any time on a chart to see the bytes received at that time.

NAM Probe processes CPU stats

Use the NAM Probe processes CPU stats tab to review NAM Probe CPU usage.

Per NAM Probe, and per CPU on the NAM Probe, this report charts total CPU usage (percentage) over the selected time range.

In addition, each chart shows a breakdown of the CPU usage according to the following.

  • CPU hardirq
  • CPU iowait
  • CPU nice
  • CPU softirq
  • CPU steal
  • CPU system
  • CPU user

Resource utilization

Use the Resource utilization tab to display charts of basic NAM Probe resource utilization over the selected time range.

  • Received traffic
    A chart of the number of bps (kbps, mbps, etc.) received on this NAM Probe over the selected time range.
  • CPU usage
    A chart of the percentage of CPU used on this NAM Probe over the selected time range.
  • Memory usage A chart of the amount of memory used on this NAM Probe over the selected time range.
  • Disk space usage
    A chart of the amount of disk space used on this NAM Probe over the selected time range.