Traffic diagnostics report

NAM Server ► Tools ► Diagnostics ► Traffic diagnostics

The Traffic Diagnostics report offers a NAM Probe health report relative to the traffic coming into them. Use it for network performance monitoring (NPM). The report lists monitored devices and offers you a link to start a traffic capture on any device whose performance thresholds are met. Adjust the resolution and time range as needed.

Important
  • If you see no statistics (other than the Packet drop rate percentages in the Attached NAM Probes list), you probably haven't selected a device yet. To select a device, click the device address in the Attached NAM Probes list.
  • It is normal (and desirable) to not see all of the statistics listed here. A statistic is displayed only if it crosses a certain threshold. You should concentrate on the statistics that are displayed, and not worry about the statistics that are not displayed (because they are within normal limits).
  • The statistics on this report are generally prioritized from top to bottom. Resolve issues starting from the top of the list, like it's a sequential procedure.

Attached NAM Probes

Click and select the address of the NAM Probe you want to analyze.

Non-zero Packet drop rate statistics (Controlled and Uncontrolled) can be quick indicators of trouble on a server.

  • Uncontrolled packet drops indicate that the NAM Probe could not cope with the load and started dropping packets on the driver level (overflow). The result is erratic and unreliable performance measurement results.
  • A high controlled packet drop rate indicates that the NAM Probe cannot process the traffic stream it is receiving due to performance reasons, so it has dropped some sessions in a controlled manner. If the list is long, use the Find box to narrow the displayed list to one or more devices that match your search string.

Click a device address and then click the Capture packets on NAM Probe link to capture a sample of traffic on the selected device. For more information, see Capturing packets on NAM Probe.

Status of sniffing interfaces

If this list is empty, you probably haven't selected a device yet. To select a device, click the device address and then click Select Table Row in the pop-up window.

After you select a device, this table lists the following interface information about all sniffing interfaces detected on that device:

Sniffing ifc name

The name of the interface.

State

The state of the interface.

Rx data

The amount of traffic received on the interface.

Important

These are cumulative values that should be increasing with each report update if your NAM Probe is receiving traffic on these sniffing ports. If a port does not increase with screen updates, you may have a SPAN configuration problem on that port.

Traffic statistics

  • Click any point on a chart to see a numerical value for that point on the chart. The graphs are there to give you a quick idea of trends; you can't see actual values unless you click the graph.
  • These are statistics for the Time range and Resolution specified at the top of the report. You can change these settings to suit your purposes.
  • Consider the recommended actions for each statistic. All possible statistics that could be displayed on this report:

Traffic volume

The volume is provided per NAM Probe, so you first select a NAM Probe from the list of attached NAM Probes and then get more detailed information.

The NAM Probe’s capacity to receive and analyze traffic depends on factors such as a traffic profile, number of monitored users, sites, and protocols. In general, the amount of traffic monitored by the NAM Probe should be adjusted so that the NAM Probe has some safety margin.

The chart compares the incoming traffic stream (bps) to the number of requests calculated based on traffic analysis. If the shapes of the two data series are similar, the selected NAM Probe is processing incoming traffic and producing relevant performance data. If the shapes are dissimilar, inspect the NAM Probe status details in the NAM Console.

NAM Probe packet drop rate (Uncontrolled)

This is a graph of the selected NAM Probe's uncontrolled packet drops. The NAM Probe is designed to handle traffic bursts, but sometimes the amount of traffic exceeds the NAM Probe’s capacity. Such a condition is indicated by the packet drop rate measures (controlled or uncontrolled).

Uncontrolled packet drops indicate that the NAM Probe could not cope with the load and started dropping packets on the driver level (overflow). The result is erratic and unreliable performance measurement results.

The NAM Probe first copes with excessive traffic by ignoring some TCP sessions. We call such a condition controlled packet drop. Controlled packet drop preserves the quality of performance measurements, though not all TCP sessions are taken into account. However, if the amount of traffic far exceeds the NAM Probe’s capabilities, it begins uncontrolled packet dropping, which means that packets are dropped at the interface level, thus significantly degrading the performance measurements.

Recommended actions: uncontrolled packet drops cannot be fixed other than by decreasing the monitored traffic level or attaching another NAM Probe so that the entire traffic stream can be handled.

  • If you do not need to monitor that amount of traffic, limit the traffic feed.
  • If you need to monitor that amount of traffic, attach another NAM Probe.

NAM Probe packet drop rate (Controlled)

A high controlled packet drop rate indicates that the NAM Probe cannot process the traffic stream it is receiving due to performance reasons, so it has dropped some sessions in a controlled manner. This data sampling is turned on or off automatically as needed to prevent further NAM Probe performance degradation.

Recommended actions:

  • Change your SPAN configuration to limit the traffic stream the NAM Probe receives.
  • Inspect NAM Probe capacity metrics to learn what might cause the NAM Probe overload.

Driver errors

This indicates that the NAM Probe cannot process the traffic stream it is receiving due to errors on the sniffing interfaces.

Recommended action: inspect NAM Probe capacity metrics to learn what the nature of NAM Probe errors is.

Sequence number gap rate

Graphs breaks in sequence numbers. A gap in the packet sequence means that some packets never reached the NAM Probe, and the sessions with missing packets cannot be measured for performance.

This issue is quite common when a SPAN is overloaded, or when a network packet broker used to aggregate and forward the traffic to the NAM Probe cannot preserve the order of forwarded packets.

Recommended action: inspect SPAN (or NPB) configuration to eliminate losses.

Unidirectional traffic rate

Graphs unidirectional traffic volume. Unidirectional traffic frequently occurs when using a SPAN to mirror traffic. A misconfigured SPAN or network packet broker will result in unidirectional traffic coming from a server or a client only. When more than 5 percent of the traffic is unidirectional, it indicates the NAM Probe cannot reliably monitor and analyze traffic, and that a significant portion of user sessions is not being taken into account during performance analysis.

Recommended action: Change SPAN configuration to minimize unidirectional traffic and make sure it mirrors bi-directional client-server conversations.

IPv4 Duplicates

IPv6 Duplicates

Graphs duplicate IPv4 or IPv6 packets (or both). While not a severe issue, duplicates may significantly influence the NAM Probe’s capacity if the NAM Probe is spending too much time finding and removing duplicates during performance analysis.

A high level of duplicates may be a side effect of SPAN misconfiguration.

Recommended action: inspect SPAN (or NPB) configuration to eliminate or minimize duplicates.

Top retransmission-affected servers (last hour)

This is a table of the servers with the highest two-way loss (retransmission) rates. If you have a high level of packet duplicates (see above) and servers with a high two-way loss rate, you have a low-quality traffic stream. While duplicates mainly affect NAM Probe performance, a retransmission rate above approximately 10 percent is a clear indicator that the monitored traffic stream contains too many out-of-order packets that cannot be processed, which means you will receive irrelevant performance measurements.

Recommended action: inspect and correct your network packet broker settings so your NPB retains the correct order of packets it passes to the NAM Probe.

Non-IP traffic

Graphs non-IP traffic volume. The NAM Probe considers non-IP traffic to be noise, as such traffic is not analyzed for performance.

A high rate of non-IP traffic (5 percent or more) indicates that the traffic the NAM Probe is monitoring is mainly traffic that is not part of a client-server data exchange. Either there is no user activity in the monitored network, or the SPAN is misconfigured, or the number of monitored client-server conversations is a fraction of the intended traffic to be monitored.

Recommended action: inspect the SPAN configuration to make sure it is mirroring client-server conversations.