[c-nsp] R: Re: multicast issue

[dim0sal]

Hi Chris
Tks for the feedback. 

If I get your description you have the tap (which vendor? ) at source and destination (I guess in span mode?),  these taps send data to niksun appliance (which model?) that create the pcap and then you can analyse for example with wireshark these files,  am I correct? 

Tks

Sent with Mobile 

-------- Messaggio originale --------
Da: Chris Marget <chris at marget.com> 
Data:  
A: R S <dim0sal at hotmail.com> 
Cc: cisco-nsp at puck.nether.net 
Oggetto: Re: [c-nsp] multicast issue 
 
> I manage a network where multicast is the most important traffic and
> sometimes I get issue by customer where they state that some packets are lost…

I used to manage a the network for a very large financial firm, had to
deal with this sort of issue all the time.

I had optical taps in multiple spots in the environment. The most
important ones collected data at the edge and at the server handoff.

These taps fed into a Niksun appliance which wrote full packets to
disk. Niksun is a powerful box, but I used it primarily to deliver
pcaps, not so much for its analysis features.

Analysis was done with some stuff that I'd whipped up, because I
couldn't find any off-the-shelf products that gave useful visibility
into what was happening on the wire.
Case study of a "missing packets" incident here: http://bit.ly/13jjP7z
A video highlighting my analysis tool here: http://bit.ly/ygf8EG

/chris