Network Instruments Observer Suite 14 review

After 15 years in the business, one of the reasons Network Instrument's Observer Suite has survived when many others have failed is its sensible price.

The Standard version provides network discovery, real-time traffic analysis, packet capture, decoding and network trending. The Expert version has advanced trending, VoIP analysis, data stream reconstruction and expert analysis tools for applications and servers. The Suite version on review adds the new auto-baselining feature, extra web reports and support for SNMP and RMON.

Installation takes a few minutes, and Observer starts monitoring immediately. It uses local and optional remote probes and you can also add SNMP and RMON devices. It discovers all devices on the monitored network subnets and makes this list available to all tools.

You can check on general network usage using a range of tools, and view general bandwidth utilisation, protocol distribution and errors. The Top Talkers window shows who's using the most bandwidth and a breakdown of each device's traffic and overall utilisation.

The packet capture and decoding tools are worth the price alone. Capture sessions can be started manually from the main menu, or by selecting a specific device from any of the statistics screens. You can also run regular capture sessions and store the buffers on the local system.

Observer's packet decoding tools present the information in an easy-to-understand format. Both the Expert and Suite versions include Expert Analysis, which shows utilisation during the capture period, a summary of detected errors, and an analysis of each one with suggestions for remedial actions.

Data stream reconstruction allows you to see what's happening behind the packets. It will show you the sites visited and associated IP address pairs for the source and destination. Downloaded files can be viewed and emails reconstructed to show the contents of the message, as well as the sender and recipient's addresses and attachments.

SNMP device monitoring is where Observer is weakest. It found all our SNMP-enabled devices, but had no idea what they were and provided only a basic set of monitoring tools.

Observer has VoIP monitoring tools for both H.323 and SIP traffic, and the packet decoder works with it as well. We tested with SIP and could view all VoIP calls made and see the phone numbers of the caller and the recipient, as well as call durations.

The network trending and baselining tools need to be left running for a few days for Observer to be able to inform you on server and application performance. The data is presented in a separate web console, and drilling down into selected entries provides metrics comparing the baseline values with current and past performance.

Observer shows that network monitoring, packet capture and decoding don't need to cost a fortune. It's capable of providing a wealth of information about your networks and the expert analysis makes it all very easy to understand.

Author: Dave Mitchell