Network Instruments Observer 10.1

In the world of network analysis, Observer has always set a high standard. Although it was introduced over ten years ago, a key feature has always been its low price tag, making it highly affordable to smaller businesses.

Observer has gradually evolved over the years, and this latest version delivers plenty of new tools that make it even more versatile. You get a new scheduler for automating packet capture and report generation, improved expert packet decoding capabilities and the ability to measure network delays that can provide an indication of how long data took to travel between two nodes. Optional wireless network analysis was introduced some time ago, but this also gets a few new tools, allowing Observer to detect even more attack types.

Observer only takes a few moments to load and you can start monitoring your network immediately. It uses a combination of local and optional remote probes accessible from the left-hand pane. You can also add SNMP and RMON devices such as switches, and access them directly to view utilisation data.

Monitoring tools are extensive and each loads a window in the pane opposite, along with a row of controls across the top. You can quickly discover network nodes, resolve their IP addresses and start packet capture on specific systems directly from this interface. Custom filters may be applied to refine the information, and the buffer contents saved to disk for future use. Observer's decoding tools are impressive, as they provide views of raw packets and decodes, plus all protocols and summaries. A new tab on the packet-capture settings window now allows you to create daily or weekly schedules for unattended capture sessions.

For general monitoring, you can pull up real-time graphs on the top ten talkers, bandwidth utilisation, protocol distribution or VLAN statistics. The Router Observer keeps an eye on routers, while Web Observer monitors all or selected ports on web servers. Usefully, you can stress-test your network with Observer's traffic generator and capture general network activity over a specific period or continuously for trending purposes. The information gathered can be viewed in graphical or tabular format and also presented in a smart web browser report. As with packet capture, a new feature of this version is the option to schedule the creation of web reports from trend data on a regular basis. Application analysis is also on offer from the trending menu, so you can monitor other protocols such as POP3 and SMTP and view graphs of response times and statistics.

There's much more on offer, as Network Instruments has pushed Observer into the enterprise space with a number of optional features. The new TAPs (test access probes), for example, are hardware components designed to allow monitoring of network links without affecting performance. Available in copper and fibre Fast Ethernet and Gigabit modules, they split the traffic into two identical streams and pass one stream to the Observer analyser software. Traditionally, port mirroring on switches has been the only other method of achieving this.

We've reviewed a wide range of network-analysis products in Enterprise, but nothing comes close to the value offered by Observer. The features available in version 10.1 are more impressive than ever before. Even the basic Observer product on review delivers a full network-analysis toolbox that rivals many of the more costly alternatives.

Author: Dave Mitchell