User manual CACE TECHNOLOGIES PILOT CONSOLE REFERENCE MANUAL 10-2010

[. . . ] Reference Manual THE SHARK DISTRIBUTED MONITORING SYSTEM PUBLISHED BY CACE Technologies, Inc. 1949 5th Street, Suite 103 Davis, CA 95616 Copyright © 2010 CACE Technologies, Inc. No part of the contents of this manuscript may be reproduced or transmitted in any form or by any means without the written permission of the publisher. Wireshark and the Wireshark icon are registered trademarks of Wireshark Foundation, Inc. [. . . ] Clicking on the icon to the left of one of the probes on the list will disconnect the Pilot Console from the probe if it is already connected. On the other hand, if the probe is initially disconnected, then clicking on the icon will reconnect the probe as the user shown in the Probes Panel. The last three items on the main panel act on the list as a whole. Delete All, Connect All, and Disconnect All. Selecting a Shark Appliance on the list brings up a submenu containing operations permitted on the selected Shark Appliance. Edit the Description, move the Shark Appliance into a probe group, connect or disconnect the Pilot Console from the Shark Appliance, display the Shark Appliance settings, and delete the Shark Appliance from the list. The Logged as list includes the identity of the users having accounts on the selected Shark Appliance. The bold item is the identity of the user who is currently logged into the Shark Appliance from the Pilot Console. Selecting a user on this list will initiate an attempt to connect to the Shark Appliance on behalf of the selected user. Probe Selection Select All Probes The Select All Probes button highlights (selects) all of probes in the Sources Panel (Devices and Files). Icon 36 Select All Probes Pilot Console Reference Manual Page 58 Expand Selection The Expand Selection button expands all of the selected probes in the sources panel, thereby showing all of their associated interfaces and file folders. Icon 37 Expand Selection Collapse Selection The Collapse Selection button collapses all of the selected probes in the sources panel, hiding all of their associated interfaces, files, and views. Icon 38 Collapse Selection Disconnect from Selected The Disconnect from Selected button disconnects the Pilot Console from the selected probes. The selected probes will continue to process live views and maintain the views associated with trace files. Icon 39 Disconnect from Selected Web Interface The Web Interface button opens the selected remote probe's Web Interface. Icon 40 Web Interface Files Import Files into Probes The Import Files into Probes button will transfer trace files from the Local System to the selected remote probe. If a directory is selected in a remote probe, then the trace files will be transferred to the selected directory, otherwise the files will be transferred to the My Files folder on the Shark Appliance. Icon 41 Import Files into Probes Export Files from Probes The Export Files from Probes button will transfer files from the selected remote probe to the Local System. If a folder on a remote probe is included in the selection, then the folder and its contents will be transferred to the Local System. If a file on a remote probe is in the selection, then just the file will be transferred. Multiple selections are permitted as long as the selections are either all folders or all files. Icon 42 Export Files from Probes Pilot Console Reference Manual Page 59 View Selection Select All on Probes The Select All on Probes button highlights (selects) all of the views on the selected probe. Icon 43 Select All on Probes Close Selected The Close Selected button closes all of the selected views. Icon 44 Close Selected Attach to Selected The Attach to Selected button attaches to the selected views. Icon 45 Attach to Selected Detach from Selected The Detach from Selected button detaches from the selected views. Icon 46 Detach from Selected Share Selected with The Share Selected with button brings up a panel to allow selected views on Shark Appliances to be shared with other users or groups. Icon 47 Share Selected with Figure 84 Share Selected with Groups Pilot Console Reference Manual Page 60 Shark Packet Recorder The usual approach to capturing high-speed and/or long duration traffic is to create a file rotation scheme whereby the capture is broken down into a large collection of small trace files with names indicating the time intervals covered by the individual files. It is not difficult to see that this approach can lead to thousands of small files making analysis and troubleshooting extremely tedious, especially when the traffic of interest spans multiple trace files. The Shark Appliance includes a "dump-to-disk" facility called the Packet Recorder. CACE Technologies' Packet Recorder is based on an optimized packet data store and a novel approach to the use of time filters which together eliminate the need for a file rotation scheme for capturing, analyzing, and viewing massive amounts of network traffic. The Packet Recorder saves network traffic in the packet data store as objects called Job Traces. CACE Technologies has created a new and intuitive approach for creating Trace Clips, which correspond to arbitrary time intervals within a Job Trace. An important feature of a Trace Clip is that it does not require any additional storage beyond the underlying Job Trace. A Trace Clip essentially acts as a time filter on the underlying Job Trace. One of the ways a Trace Clip can be created is by dragging a time selection from a chart on to the underlying Job Trace object ­ the Trace Clip will be created automatically! [. . . ] "^i" would match "intel" but not "cisco". Page 149 Pilot Console Reference Manual $ Match the end of a label. "l$" would match "intel" but not "airlink". "i. t" would match "intel" or "virtech" but not "cisco". [. . . ]