Trace Trimmer tabs

Trace Trimmer's tabs offer seven views of a traffic capture.

MAC addresses

Displays a MAC-centric view of your data.

  • Node A is the MAC address of one end of a connection

  • Node B is the MAC address of the other end of that row's connection

  • Packets and Bytes indicate the traffic volume between the two MAC addresses

Conversations

Displays a conversation-centric view of your data.

  • Node A is the IP address of one end of a conversation

  • Node B is the IP address of the other end of that row's conversation

  • Packets and Bytes indicate the traffic volume of that conversation

Connections

Displays a connection-centric view of your data.

  • Node A (graph and table column) is the IP address of one end of a connection, and Node A Port is the port number on that end of the connection.
  • Node B (graph and table column) is the IP address of the other end of that row's connection, and Node B Port is the port number on that end of the connection.
  • Application Protocol (graph and table column), Transport Protocol (table column only), and Network Protocol (table column only) are the active protocols for those three network levels of the connection.
  • You can view and sort connections in the table by MPLS, VLAN, and QoS. These are each shown in graphs and in the table.
    • QoS shows the Quality of Service values for the traffic as encoded in differentiated services code point (DSCP) per-hop behavior (PHB) class. We assume that each connection is associated with one unchanging DSCP value for the whole connection.
      • DF = Default Forwarding. Typically, this is best-effort forwarding.
      • EF = Expedited Forwarding. Typically, this is low-loss, low-latency, low-jitter traffic suitable for real-time audio and video.
      • AF = Assured Forwarding. Typically, delivery of this traffic is guaranteed as long as it stays within the subscribed rate.
      • CS = Class Selector. This is used to maintain backward compatibility with networks that continue to use the old Precedence field to specify traffic priority.
    • Packets and Bytes (table column only) indicate the traffic volume of that connection.

Nodes

Displays a node-centric view of your data.

  • Tables Node A and Node B (under table Node A) both initially list the IP addresses of all nodes; they are identical except for sort order. If you click a node in either table, however, that table will be restricted to only the selected node and the other table will show only those nodes that have a connection with the selected node.

  • Packets and Bytes indicate the traffic volume of that connection

Protocols

Displays a protocol-centric view of your data.

  • Application Protocol displays the name and traffic volume of each application protocol detected in your data. Click an application protocol name to hide all other application protocols.

  • Transport Protocol displays the name and traffic volume of each transport protocol detected in your data. Click a transport protocol name to hide all other transport protocols.

  • Network Protocol displays the name and traffic volume of each network protocol detected in your data. Click a network protocol name to hide all other network protocols.

MPLS

The MPLS tab presents all MPLS labels gathered during trace parsing. If a conversation contains different labels or there are stacked labels, all are concatenated and displayed in one row. Each MPLS label can be used as a view or output filter.

  • Application Protocol displays the name and traffic volume of each application protocol detected in your data. Click an application protocol name to hide all other application protocols.

  • Transport Protocol displays the name and traffic volume of each transport protocol detected in your data. Click a transport protocol name to hide all other transport protocols.

  • Network Protocol displays the name and traffic volume of each network protocol detected in your data. Click a network protocol name to hide all other network protocols.

VLAN

The VLAN tab presents all VLAN labels gathered during trace parsing. There can be more than one label per conversation and in theory a double-tagged, stacked VLAN label is also possible. If a conversation contains different labels or there are stacked labels, all are concatenated and displayed in one row. Each VLAN label can be used as a view or output filter.

  • VLAN ID lists associated VLAN labels.

  • Packets and Bytes indicate the traffic volume associated with this row.